- Lint stage: golangci/golangci-lint:v1.64.8 (sha256-pinned)
Runs make fmt-check and make lint for fast feedback
- Build stage: golang:1.24-bookworm (sha256-pinned, matches go.mod 1.24.0)
COPY --from=lint forces BuildKit to run lint stage
Runs make test, then make build
- Runtime stage: debian:bookworm-slim (sha256-pinned)
- All base images updated from ancient versions to current
- Removed vendoring/source tarball (per CLAUDE.md: avoid vendoring)