Move base images to dhi.io

.github/dependabot.yml

@@ -1,4 +1,10 @@
 version: 2
+registries:
+  dhi:
+    type: docker-registry
+    url: dhi.io
+    username: ${{ secrets.DOCKER_HUB_USERNAME }}
+    password: ${{ secrets.DOCKER_HUB_TOKEN }}
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -20,6 +26,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    registries:
+    - dhi
     groups:
       ci:
         patterns:

.github/workflows/ci.yaml

@@ -6,6 +6,7 @@ on:
   pull_request:
 permissions:
   contents: read
+  id-token: write
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -29,7 +30,16 @@ jobs:
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: latest
+      - name: docker login for dhi.io
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ secrets.DOCKER_HUB_OIDC_CONNECTION_ID }}
+        with:
+          registry: dhi.io
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
       - name: Build docker image
+        if: ${{ !github.event.pull_request.head.repo.fork }}
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
@@ -42,5 +52,6 @@ jobs:
         run: |
           make test-app
       - name: make test-container
+        if: ${{ !github.event.pull_request.head.repo.fork }}
         run: |
           make test-container

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS builder
+FROM dhi.io/golang:1.27-alpine-dev AS builder
 
 ARG VERSION
 ARG GIT_COMMIT
@@ -20,8 +20,8 @@ RUN CGO_ENABLED=0 GOOS=linux \
         -X github.com/score-spec/score-implementation-sample/internal/version.BuildDate=${BUILD_DATE}" \
     -o /usr/local/bin/score-implementation-sample ./cmd/score-implementation-sample
 
-# We can use gcr.io/distroless/static since we don't rely on any linux libs or state, but we need ca-certificates to connect to https/oci with the init command.
-FROM gcr.io/distroless/static:530158861eebdbbf149f7e7e67bfe45eb433a35c@sha256:5c7e2b465ac6a2a4e5f4f7f722ce43b147dabe87cb21ac6c4007ae5178a1fa58
+# We can use static since we don't rely on any linux libs or state, but we need ca-certificates to connect to https/oci with the init command.
+FROM dhi.io/static:20260611-alpine3.24@sha256:93568eb7c673afb3ad79b15cca341469d3e02cf859caae1049aa22fe7fbce90a
 
 # Set the current working directory inside the container.
 WORKDIR /score-implementation-sample

Makefile

@@ -29,9 +29,11 @@ test-app: build
 build-container:
 	docker build -t score-implementation-sample:local .
 
+# The image runs as the nonroot user of the hardened base image, which does not own the
+# mounted directory, so run the commands that write to it as the current user instead.
 test-container: build-container
 	docker run --rm score-implementation-sample:local --version
-	docker run --rm -v .:/score-implementation-sample score-implementation-sample:local init
+	docker run --rm --user $(shell id -u):$(shell id -g) -v .:/score-implementation-sample score-implementation-sample:local init
 	cat score.yaml
-	docker run --rm -v .:/score-implementation-sample score-implementation-sample:local generate score.yaml
+	docker run --rm --user $(shell id -u):$(shell id -g) -v .:/score-implementation-sample score-implementation-sample:local generate score.yaml
 	cat manifests.yaml