Add hash-pinned Dockerfile and Gitea workflow, drop Drone

.drone.yml

@@ -1,10 +0,0 @@
-kind: pipeline
-name: test-go
-
-steps:
-- name: test-go
-  image: golang
-  commands:
-    - go test ./...
-    #- go get github.com/golangci/golangci-lint/cmd/golangci-lint@v1.31.0
-    #- golangci-lint run

.gitea/workflows/check.yml

@@ -0,0 +1,9 @@
+name: check
+on: [push]
+jobs:
+    check:
+        runs-on: ubuntu-latest
+        steps:
+            # actions/checkout v4.2.2, 2026-02-22
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+            - run: docker build .

Dockerfile

@@ -0,0 +1,60 @@
+# The checks behind `make check` are split across independent stages so that
+# formatting and lint failures surface in seconds, before any compilation:
+#
+#   lint    - gofmt and golangci-lint (make fmt-check-go, make lint)
+#   docs    - prettier check of all markdown (make fmt-check-md)
+#   builder - tests (make test) and the release build
+#
+# The builder stage declares explicit dependencies on lint and docs so
+# BuildKit cannot finish the build unless every check passed.
+
+# Lint stage: fast feedback on Go formatting and lint issues
+# golangci/golangci-lint:v2.12.2, 2026-05-06
+# Pinned below v2.13.0 until the canonical .golangci.yml disables
+# exhaustruct_v5 (see the TODO in README.md). Keep in sync with Makefile.
+FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN make fmt-check-go
+RUN make lint
+
+# Docs stage: markdown formatting check with the pinned prettier
+# node:24-alpine, 2026-10-28
+FROM node@sha256:8a32c8cf649a49915a66e81e7a609223c708d0adabf288ee3f4077d765542f85 AS docs
+RUN apk add --no-cache make
+WORKDIR /src
+COPY package.json yarn.lock ./
+RUN yarn install --frozen-lockfile
+COPY . .
+RUN make fmt-check-md
+
+# Build stage
+# golang:1.26-alpine, 2026-10-27
+FROM golang@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 AS builder
+# gcc and musl-dev are needed only because `make test` uses -race, which
+# requires cgo; the release binary below is built with CGO_ENABLED=0.
+RUN apk add --no-cache make gcc musl-dev
+WORKDIR /src
+
+# Force BuildKit to run the lint and docs stages before proceeding
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=docs /src/package.json /dev/null
+
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN make test
+
+ARG VERSION=dev
+RUN CGO_ENABLED=0 go build -trimpath \
+    -ldflags="-s -w -X main.version=${VERSION}" \
+    -o /sutil ./cmd/sutil
+
+# Runtime stage: the binary plus the full source it was built from
+# alpine:3.24, 2026-10-23
+FROM alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
+COPY --from=builder /sutil /usr/local/bin/sutil
+COPY --from=builder /src /usr/local/src/x
+ENTRYPOINT ["sutil"]