chore: pin dev dockerfile go base image and distroless base image

[SoulPancake]

Description

What problem is being solved?

How is it being solved?

What changes are made to solve it?

References

Review Checklist

• I have clicked on "allow edits by maintainers".
• I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
• The correct base branch is being used, if not main
• I have added tests to validate that the change in functionality is working as expected

Summary by CodeRabbit

• Chores
  • Improved build reproducibility by pinning container images to specific versions.
  • Updated the development build environment to use a current Go image.
  • Secured the release packaging environment with a fixed, verified base image.
  • Application behavior and runtime functionality remain unchanged.

[coderabbitai]

Walkthrough

The Docker builder image now uses go:latest pinned by digest, and the GoReleaser distroless image is also pinned by digest. Existing build stages and commands remain unchanged.

Changes

Container image pinning

Layer / File(s)	Summary
Pin build and release base images .dev.Dockerfile, .goreleaser.Dockerfile	The builder and distroless static base image references now use SHA256 digests while preserving the existing Docker build flow.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• openfga/cli#716: Updates the GoReleaser Dockerfile to use the distroless non-root static Debian base.

Suggested reviewers: copilot, rhamzeh, archy-rock3t-cloud, runabol, siddhant-k-code

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: pinning the Go dev Docker base image and the distroless base image by digest.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/pin-distroless-image-digest

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Pins container base images by switching to digest-qualified (@sha256:...) references for the release and dev Docker build flows, improving supply-chain reproducibility.

Changes:

• Pinned the distroless runtime image in .goreleaser.Dockerfile to an exact digest.
• Pinned the Chainguard Go builder image in .dev.Dockerfile to an exact digest (but changed the tag to latest).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.goreleaser.Dockerfile	Pins the distroless runtime base image via digest for reproducible release images.
.dev.Dockerfile	Pins the dev builder base image via digest (currently uses a latest tag with the digest).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

🧹 Nitpick comments (1)

.dev.Dockerfile (1)

1-1: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Retain the intended Go version alongside the digest.

This changes the declared base from go:1.25 to go:latest. Prefer go:1.25@sha256:... and verify that the digest resolves to the intended Go 1.25 image; otherwise this pin can silently select a different toolchain lineage during future maintenance.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.dev.Dockerfile at line 1, Update the builder image declaration to use the
explicit go:1.25 tag together with the existing digest, rather than go:latest.
Verify that the digest corresponds to the intended Go 1.25 image before
retaining it.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.dev.Dockerfile:
- Line 1: Update the builder image declaration to use the explicit go:1.25 tag
together with the existing digest, rather than go:latest. Verify that the digest
corresponds to the intended Go 1.25 image before retaining it.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f25c83d8-131c-49c4-8366-19b5eec607b4

📥 Commits

Reviewing files that changed from the base of the PR and between cd511b8 and a267031.

📒 Files selected for processing (2)

• .dev.Dockerfile
• .goreleaser.Dockerfile