fix(ui): trivy security issues on envtest

.github/workflows/build-and-push-ui-images-standalone.yml

@@ -79,6 +79,7 @@ jobs:
       with:
         context: ./clients/ui
         file: ./clients/ui/Dockerfile.standalone
+        target: release
         platforms: ${{ env.PLATFORMS }}
         push: true
         tags: ${{ steps.meta.outputs.tags }}

clients/ui/Dockerfile.standalone

@@ -51,18 +51,20 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o bf
 RUN go install sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.19
 RUN setup-envtest use 1.29.3 --bin-dir /envtest-bin -p path
 
-# Final stage
+# Release stage - clean image without envtest binaries
 # Use distroless as minimal base image to package the application binary
-FROM ${DISTROLESS_BASE_IMAGE}
+FROM ${DISTROLESS_BASE_IMAGE} AS release
 WORKDIR /
 COPY --from=bff-builder /usr/src/app/bff ./
 COPY --from=ui-builder /usr/src/app/dist ./static/
-# Copy envtest binaries for mock K8s mode
-COPY --from=bff-builder /envtest-bin /envtest-bin
-ENV ENVTEST_ASSETS_DIR=/envtest-bin
 USER 65532:65532
 
 # Expose port 8080
 EXPOSE 8080
 
 ENTRYPOINT ["/bff"]
+
+# Mock stage - extends release, adds envtest for --mock-k8s-client=true
+FROM release AS mock
+COPY --from=bff-builder /envtest-bin /envtest-bin
+ENV ENVTEST_ASSETS_DIR=/envtest-bin

clients/ui/Makefile

@@ -82,6 +82,10 @@ docker-build:
 docker-build-standalone:
 	$(CONTAINER_TOOL) build -f Dockerfile.standalone --build-arg DEPLOYMENT_MODE=standalone --build-arg STYLE_THEME=mui-theme -t ${IMG_UI_STANDALONE} .
 
+.PHONY: docker-build-standalone-release
+docker-build-standalone-release:
+	$(CONTAINER_TOOL) build -f Dockerfile.standalone --target release --build-arg DEPLOYMENT_MODE=standalone --build-arg STYLE_THEME=mui-theme -t ${IMG_UI_STANDALONE} .
+
 .PHONY: docker-build-federated
 docker-build-federated:
 	$(CONTAINER_TOOL) build --build-arg DEPLOYMENT_MODE=federated --build-arg STYLE_THEME=patternfly -t ${IMG_UI_FEDERATED} .