chore: update build distro and go version

Author: lockwobr

.github/workflows/agent-ci.yaml

@@ -36,6 +36,7 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
   PYTHON_VERSION: 3.13
+  DEBIAN_VERSION: trixie
 jobs:
   fetch-distroless-versions:
     name: Fetch Latest Distroless Versions
@@ -172,9 +173,11 @@ jobs:
           echo "🏷️  Tags: ${TAGS}"
           export REGISTRY=${REGISTRY@L}
           export BUILD_ARGS="--push"
-          export DISTROLESS_VERSION=${{ needs.fetch-distroless-versions.outputs.distroless-version }}
-          export PYTHON_VERSION=${{ env.PYTHON_VERSION }}
-          make docker-build-only agent_version=${AGENT_VERSION}
+          make docker-build-only \
+            agent_version=${AGENT_VERSION} \
+            DISTROLESS_VERSION=${{ needs.fetch-distroless-versions.outputs.distroless-version }} \
+            PYTHON_VERSION=${{ env.PYTHON_VERSION }} \
+            DEBIAN_VERSION=${{ env.DEBIAN_VERSION }}
           cat metadata.json
           echo "digest=$(cat metadata.json | jq -r .\"containerimage.digest\")" >> $GITHUB_OUTPUT
           cat $GITHUB_OUTPUT
@@ -204,7 +207,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.5'
+          go-version: '1.25.6'
           cache-dependency-path: operator/go.sum
 
       - name: Log in to the Container registry
@@ -226,8 +229,8 @@ jobs:
         id: cached-binaries
         uses: actions/cache/restore@v4
         with:
-          key: 1.25.5-${{ runner.os }}-${{ runner.arch }}-bin-${{ hashFiles('operator/deps.mk') }}
-          restore-keys: 1.25.5-${{ runner.os }}-${{ runner.arch }}-bin-
+          key: 1.25.6-${{ runner.os }}-${{ runner.arch }}-bin-${{ hashFiles('operator/deps.mk') }}
+          restore-keys: 1.25.6-${{ runner.os }}-${{ runner.arch }}-bin-
           path: |
             ${{ github.workspace }}/operator/bin
             ~/.cache/go-build
@@ -242,7 +245,7 @@ jobs:
         if: steps.cached-binaries.outputs.cache-hit != 'true'
         uses: actions/cache/save@v4
         with:
-          key: 1.25.5-${{ runner.os }}-${{ runner.arch }}-bin-${{ hashFiles('operator/deps.mk') }}
+          key: 1.25.6-${{ runner.os }}-${{ runner.arch }}-bin-${{ hashFiles('operator/deps.mk') }}
           path: |
             ${{ github.workspace }}/operator/bin
             ~/.cache/go-build

.github/workflows/cli-release.yaml

@@ -23,7 +23,7 @@ on:
       - cli/*
 
 env:
-  GO_VERSION: 1.25.5
+  GO_VERSION: 1.25.6
 
 jobs:
   release:

.github/workflows/operator-ci.yaml

@@ -41,7 +41,8 @@ on:
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
-  GO_VERSION: 1.25.5
+  GO_VERSION: 1.25.6
+  DEBIAN_VERSION: trixie
   PLATFORMS: linux/amd64,linux/arm64
 
 jobs:
@@ -289,6 +290,7 @@ jobs:
             --build-arg GIT_SHA=${GIT_SHA} \
             --build-arg VERSION=${VERSION} \
             --build-arg GO_VERSION=${{ env.GO_VERSION }} \
+            --build-arg DEBIAN_VERSION=${{ env.DEBIAN_VERSION }} \
             --build-arg DISTROLESS_VERSION=${{ needs.fetch-distroless-versions.outputs.go-version }} \
             --push \
             --platform ${{ matrix.platform }} \

agent/Makefile

@@ -16,6 +16,9 @@ VENV := ./venv/bin/
 REGISTRY ?= ghcr.io
 AGENT_IMAGE ?= nvidia/skyhook/agent
 DOCKER_CMD ?= docker
+PYTHON_VERSION ?= 3.13
+DEBIAN_VERSION ?= trixie
+DISTROLESS_VERSION ?= 4.0.1
 
 .PHONY: all
 all: venv test
@@ -65,6 +68,7 @@ docker-build-only:
 		--build-arg GIT_SHA=$(GIT_SHA) \
 		--build-arg DISTROLESS_VERSION=$(DISTROLESS_VERSION) \
 		--build-arg PYTHON_VERSION=$(PYTHON_VERSION) \
+		--build-arg DEBIAN_VERSION=$(DEBIAN_VERSION) \
 		--platform linux/amd64,linux/arm64 $(ACTUAL_TAGS) --metadata-file=metadata.json -f ../containers/agent.Dockerfile .
 
 ##@ Vendor

containers/agent.Dockerfile

@@ -15,8 +15,10 @@
 # limitations under the License.
 
 ARG PYTHON_VERSION
+ARG DEBIAN_VERSION
+ARG DISTROLESS_VERSION
 
-FROM python:${PYTHON_VERSION}-bookworm AS builder
+FROM python:${PYTHON_VERSION}-${DEBIAN_VERSION} AS builder
 
 ARG AGENT_VERSION 
 
@@ -38,15 +40,12 @@ RUN make build build_version=${AGENT_VERSION}
 # Install the wheel in the builder stage
 RUN python3 -m venv venv && ./venv/bin/pip install /code/skyhook-agent/dist/skyhook_agent*.whl
 
-ARG DISTROLESS_VERSION \
-    PYTHON_VERSION
-
 FROM nvcr.io/nvidia/distroless/python:${PYTHON_VERSION}-v${DISTROLESS_VERSION}
 
-ARG AGENT_VERSION \
-    GIT_SHA \
-    DISTROLESS_VERSION \
-    PYTHON_VERSION
+ARG PYTHON_VERSION
+ARG DISTROLESS_VERSION
+ARG AGENT_VERSION
+ARG GIT_SHA
 
 ## https://github.com/opencontainers/image-spec/blob/main/annotations.md
 LABEL org.opencontainers.image.base.name="nvcr.io/nvidia/distroless/python:${PYTHON_VERSION}-v${DISTROLESS_VERSION}" \

containers/operator.Dockerfile

@@ -16,14 +16,16 @@
 
 # Build the manager binary
 ARG GO_VERSION
+ARG DEBIAN_VERSION
+ARG DISTROLESS_VERSION
 
-FROM golang:${GO_VERSION}-bookworm as builder
+FROM golang:${GO_VERSION}-${DEBIAN_VERSION} as builder
 
-ARG TARGETOS \
-    TARGETARCH \
-    VERSION \
-    GIT_SHA \
-    GO_VERSION
+ARG TARGETOS
+ARG TARGETARCH
+ARG VERSION
+ARG GIT_SHA
+ARG GO_VERSION
 
 WORKDIR /workspace
 
@@ -39,15 +41,14 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -mod=ven
     -X github.com/NVIDIA/skyhook/operator/internal/version.VERSION=${VERSION}" \
     -a -o manager cmd/manager/main.go
 
-ARG DISTROLESS_VERSION
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless/tree/main/base for more 
 FROM nvcr.io/nvidia/distroless/go:v${DISTROLESS_VERSION}
 
+ARG DISTROLESS_VERSION
+ARG GO_VERSION
 ARG VERSION
-    GIT_SHA \
-    GO_VERSION \
-    DISTROLESS_VERSION
+ARG GIT_SHA
 
 ## https://github.com/opencontainers/image-spec/blob/main/annotations.md
 LABEL org.opencontainers.image.base.name="nvcr.io/nvidia/distroless/go:v${DISTROLESS_VERSION}" \

operator/Makefile

@@ -16,7 +16,9 @@ include deps.mk
 
 ## Version of the operator
 VERSION ?= $(GIT_TAG_LAST)
-GO_VERSION ?= 1.25.5
+GO_VERSION ?= 1.25.6
+DEBIAN_VERSION ?= trixie
+DISTROLESS_VERSION ?= 4.0.1
 
 # Image URL to use all building/pushing image 
 ## TODO: update this to the correct image location
@@ -418,6 +420,8 @@ docker-build: ## Build docker image with the manager.
 	--build-arg VERSION=$(VERSION) \
 	--build-arg GIT_SHA=$(GIT_SHA) \
 	--build-arg GO_VERSION=$(GO_VERSION) \
+	--build-arg DEBIAN_VERSION=$(DEBIAN_VERSION) \
+	--build-arg DISTROLESS_VERSION=$(DISTROLESS_VERSION) \
 	-t $(IMG):testing .
 
 ##@ Deployment

operator/go.mod

@@ -1,6 +1,6 @@
 module github.com/NVIDIA/skyhook/operator
 
-go 1.25.5
+go 1.25.6
 
 require (
 	github.com/go-logr/logr v1.4.3