chore: use Docker image instead

.github/dependabot.yml

@@ -3,36 +3,49 @@ version: 2
 updates:
   - package-ecosystem: "pip"
     directory: "/"
+    labels:
+      - "python"
+    commit-message:
+      prefix: "chore(dev-deps)"
     groups:
       python-minor-and-patch:
         update-types:
           - "minor"
           - "patch"
     schedule:
       interval: "weekly"
-      day: "friday"
+      day: "thursday"
       time: "19:00"
       timezone: "America/Chicago"
     cooldown:
       default-days: 7
 
   - package-ecosystem: "github-actions"
     directory: "/"
+    labels:
+      - "github_actions"
+    commit-message:
+      prefix: "chore(dev-deps)"
     groups:
       github-actions:
         update-types:
           - "minor"
           - "patch"
     schedule:
       interval: "weekly"
-      day: "friday"
+      day: "thursday"
       time: "19:00"
       timezone: "America/Chicago"
     cooldown:
       default-days: 7
 
   - package-ecosystem: "docker"
     directory: "/"
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "chore(deps)"
     schedule:
       interval: "daily"
       time: "13:00"
@@ -42,14 +55,18 @@ updates:
 
   - package-ecosystem: "npm"
     directory: "/"
+    labels:
+      - "javascript"
+    commit-message:
+      prefix: "chore(dev-deps)"
     groups:
       npm-minor-and-patch:
         update-types:
           - "minor"
           - "patch"
     schedule:
       interval: "weekly"
-      day: "friday"
+      day: "thursday"
       time: "19:00"
       timezone: "America/Chicago"
     cooldown:

.github/pull_request_template.md

@@ -0,0 +1,9 @@
+## Summary
+
+-
+
+## Release Notes Checklist
+
+- [ ] I applied at least one release label that matches `.github/release.yml`.
+- [ ] If this PR should be excluded from release notes, I applied `ignore-changelog`.
+- [ ] If this is a breaking change, I applied `type: breaking` and documented impact/migration notes.

.github/release.yml

@@ -1,42 +1,62 @@
+---
 changelog:
   exclude:
     labels:
       - ignore-changelog
 
   categories:
-    - title: ":warning: Update considerations and deprecations"
+    - title: ":warning: Breaking changes and deprecations"
       labels:
         - "type: breaking"
         - "type: deprecation"
         - "type: regression"
         - "type: revert"
 
-    - title: ":rocket: New features and improvements"
+    - title: ":whale: Image and runtime updates"
       labels:
         - "type: release"
         - "type: feat"
-        - "type: enhancement"
-        - "type: refactor"
+        - "type: fix"
         - "type: perf"
+        - "type: enhancement"
+        - "enhancement"
+        - "bug"
 
-    - title: ":lady_beetle: Bug fixes"
+    - title: ":rocket: CI and build pipeline"
       labels:
-        - "type: fix"
+        - "type: ci"
+        - "type: build"
+        - "type: refactor"
 
-    - title: ":nail_care: Style, UI, UX"
+    - title: ":book: Documentation and tests"
       labels:
+        - "type: docs"
+        - "type: test"
         - "type: style"
+        - "documentation"
 
-    - title: ":book: Documentation"
+    - title: ":tools: Development dependency updates"
       labels:
-        - "type: docs"
+        - "github_actions"
+        - "javascript"
+        - "npm"
+        - "python"
 
-    - title: ":hammer: Build/Test Dependency Upgrades"
+    - title: ":package: Container dependency updates"
       labels:
-        - "type: dependencies"
         - "dependencies"
-        - "type: test"
-        - "type: ci"
-        - "type: build"
+        - "docker"
+        - "go"
+
+    - title: ":broom: Chores and maintenance"
+      labels:
+        - "chore"
         - "type: chore"
         - "type: task"
+
+    - title: ":grey_question: Other labeled changes"
+      labels:
+        - "question"
+        - "invalid"
+        - "duplicate"
+        - "wontfix"

.github/workflows/build.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Get Go versions
         id: versions
         env:
-          GO_VERSION: ${{ vars.GO_VERSION }}
+          GO_VERSION: ${{ vars.GO_VERSION || '' }}
         run: |
           if [ -n "$GO_VERSION" ]; then
             # Repository variable overrides the API — build only that version
@@ -60,6 +60,16 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
 
+      - name: Resolve Go image digest
+        id: go-image
+        run: |
+          digest=$(docker buildx imagetools inspect "golang:${{ matrix.go-version }}-bookworm" | awk '/^Digest:[[:space:]]/ {print $2; exit}')
+          if [ -z "$digest" ]; then
+            echo "Failed to resolve digest for golang:${{ matrix.go-version }}-bookworm" >&2
+            exit 1
+          fi
+          echo "digest=$digest" >> $GITHUB_OUTPUT
+
       - name: Log in to Docker Hub
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 #v4.0.0
         with:
@@ -90,5 +100,6 @@ jobs:
           tags: ${{ steps.tags.outputs.tags }}
           build-args: |
             GO_VERSION=${{ matrix.go-version }}
+            GO_IMAGE_DIGEST=${{ steps.go-image.outputs.digest }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/labeler.yml

@@ -0,0 +1,14 @@
+name: Labeler
+
+on:
+  pull_request:
+    types:
+      - opened
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label-pr:
+    uses: esacteksab/.github/.github/workflows/labeler.yml@1bc431f64337f1576cb374586c7cc51e3f723fb7  # v0.80.0

Dockerfile

@@ -1,31 +1,6 @@
-FROM ubuntu:24.04@sha256:d1e2e92c075e5ca139d51a140fff46f84315c0fdce203eab2807c7e495eff4f9 AS base
-
 ARG GO_VERSION=1.25.8
-
-# Install dependencies, download Go, and set it up in one layer
-RUN set -eux && \
-    apt-get update && \
-    apt-get install -y --no-install-recommends \
-        ca-certificates=20240203 \
-        wget=1.21.4-1ubuntu4.1 && \
-    wget -O go.tar.gz "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" && \
-    tar -C /usr/local -xzf go.tar.gz && \
-    rm go.tar.gz && \
-    rm /root/.wget-hsts && \
-    mkdir -p /go/src /go/bin && \
-    chmod -R 750 /go && \
-    apt-get clean && apt-get autoremove -y && \
-    rm -rf /var/lib/apt/lists/* && \
-    rm -rf /var/log/apt/* && \
-    rm -rf /var/log/dpkg.log
-
-# Set environment variables
-ENV GOPATH=/go
-ENV PATH=$GOPATH/bin:/usr/local/go/bin:$PATH
-ENV CGO_ENABLED=0
-
-# Set the working directory
-WORKDIR /go
+ARG GO_IMAGE_DIGEST=sha256:7af46e70d2017aef0b4ce2422afbcf39af0511a61993103e948b61011233ec42
+FROM golang:${GO_VERSION}-bookworm@${GO_IMAGE_DIGEST} AS go-dist
 
 FROM ubuntu:24.04@sha256:d1e2e92c075e5ca139d51a140fff46f84315c0fdce203eab2807c7e495eff4f9
 
@@ -47,7 +22,9 @@ ENV PATH=$GOPATH/bin:/usr/local/go/bin:$PATH
 ENV CGO_ENABLED=0
 ENV GO_VERSION=${GO_VERSION}
 
-COPY --from=base /usr/local/go /usr/local/go
+COPY --from=go-dist /usr/local/go /usr/local/go
+
+RUN mkdir -p /go/src /go/bin && chmod -R 750 /go
 
 # Set the working directory
 WORKDIR /go