Move base images to dhi.io

[Abhishek9639]

Fixes #123

Moves the builder and runtime stages to Docker Hardened Images, on the same base image digests score-compose and score-k8s are on today:

Stage	Before	After
builder	golang:1.26-alpine	dhi.io/golang:1.26.5-alpine3.24-dev
runtime	gcr.io/distroless/static	dhi.io/static:20260611-alpine3.24

Following score-spec/score-compose#391 and score-spec/score-k8s#250, this also covers the two knock-on effects of the move.

dhi.io is an authenticated registry

• .github/dependabot.yml gets the dhi registry, otherwise Dependabot silently stops bumping the base image digests.
• CI logs in to dhi.io before building the image.
• The docker steps are skipped for PRs from forks, since secrets aren't available there the same guard score-compose and score-k8s put on their container jobs. make test, lint and make test-app still run, so fork PRs keep meaningful CI.

The hardened runtime image runs as a nonroot user

init and generate write into the mounted working directory, which the container user doesn't own. make test-container now runs those two commands as the current user.

score-compose and score-k8s solve the same thing with sudo chown -R 65532:65532 in CI. --user is used here instead because this repo drives its container test through the Makefile, which is also run locally, where sudo would prompt for a password.

Needed before CI can go green

DOCKER_HUB_USERNAME and DOCKER_HUB_TOKEN need to be added as both Actions secrets (for the CI login) and Dependabot secrets (for the registry in dependabot.yml) these are separate stores, and configuring only one leaves the other silently broken.

Testing

• make test passes.
• Both changed YAML files parse, and the new docker/login-action SHA is v4.6.0.
• I don't have a DHI-entitled Docker account, so I could not build the image end to end locally. The digests here are the ones score-compose currently has on main with green CI.

Notes

• Not ported from score-k8s: --platform=$BUILDPLATFORM, since this repo has no multi-arch build.
• Happy to switch the CI login to the OIDC flow both repos moved to in OIDC login now with docker/login-action directly score-compose#532 it needs DOCKER_HUB_ORG and DOCKER_HUB_OIDC_CONNECTION_ID repo variables, so I kept the username/password login that Dependabot needs regardless.
• This repo is a template anyone using "Use this template" will now need DHI entitlement to docker build. Flagging in case that changes what you'd like here.

[Abhishek9639]

Hi @mathieu-benoit,

This is ready for review. It moves the builder and runtime stages to dhi.io, following the same setup as score-compose and score-k8s, and also covers the Dependabot registry config, the CI login, and the nonroot user in the container test.

Two things worth flagging:

• CI is waiting on maintainer approval to run, as this is my first PR here from a fork.
• The DOCKER_HUB_USERNAME and DOCKER_HUB_TOKEN secrets need to be added as both Actions and Dependabot secrets before the docker steps can pass.

Happy to adjust anything, including switching the CI login to the OIDC flow if you'd prefer that.
Thanks!

[mathieu-benoit]

Amazing, @Abhishek9639, thanks!
And yes, let's switch to OIDC please.

[Abhishek9639]

Hi @mathieu-benoit,
I've updated the PR.

• Switched the CI Docker login to use OIDC
• Rebasing onto main to resolve the conflict from the recent Go 1.27 bump
• Updated the builder to dhi.io/golang:1.27-alpine-dev

Let me know if anything else is needed!
Thanks!

[mathieu-benoit]

LGTM, thanks!