Merge pull request #2557 from Nordix/lentzi90/release-0.11-security-scan

🌱 Make security scanners happy release-0.11

Author: k8s-ci-robot

.trivyignore

@@ -0,0 +1,4 @@
+# These require updating the go version to 1.23.
+# According to govulncheck we are not using code that is affected by them anyway
+CVE-2025-22870
+CVE-2025-22872

Dockerfile

@@ -13,7 +13,8 @@
 # limitations under the License.
 
 # Build the manager binary
-FROM golang:1.22.0 as builder
+ARG GO_VERSION
+FROM golang:${GO_VERSION} AS builder
 WORKDIR /workspace
 
 # Run this with docker build --build_arg goproxy=$(go env GOPROXY) to override the goproxy
@@ -30,7 +31,7 @@ COPY orc/go.sum orc/go.sum
 # Cache deps before building and copying source so that we don't need to re-download as much
 # and so that source changes don't invalidate our downloaded layer
 RUN --mount=type=cache,target=/go/pkg/mod \
-    go mod download
+  go mod download
 
 # Copy the sources
 COPY ./ ./
@@ -42,10 +43,10 @@ ARG ldflags
 
 # Do not force rebuild of up-to-date packages (do not use -a) and use the compiler cache folder
 RUN --mount=type=cache,target=/root/.cache/go-build \
-    --mount=type=cache,target=/go/pkg/mod \
-    CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} \
-    go build -ldflags "${ldflags} -extldflags '-static'" \
-    -o manager ${package}
+  --mount=type=cache,target=/go/pkg/mod \
+  CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} \
+  go build -ldflags "${ldflags} -extldflags '-static'" \
+  -o manager ${package}
 
 # Production image
 FROM gcr.io/distroless/static:nonroot

Makefile

@@ -27,7 +27,7 @@ unexport GOPATH
 TRACE ?= 0
 
 # Go
-GO_VERSION ?= 1.22.7
+GO_VERSION ?= 1.22.12
 
 # Directories.
 ARTIFACTS ?= $(REPO_ROOT)/_artifacts
@@ -359,7 +359,7 @@ generate-api-docs-%: $(GEN_CRD_API_REFERENCE_DOCS) FORCE
 
 .PHONY: docker-build
 docker-build: ## Build the docker image for controller-manager
-	docker build -f Dockerfile --build-arg goproxy=$(GOPROXY) --build-arg ARCH=$(ARCH) --build-arg ldflags="$(LDFLAGS)" . -t $(CONTROLLER_IMG_TAG)
+	docker build -f Dockerfile --build-arg GO_VERSION=$(GO_VERSION) --build-arg goproxy=$(GOPROXY) --build-arg ARCH=$(ARCH) --build-arg ldflags="$(LDFLAGS)" . -t $(CONTROLLER_IMG_TAG)
 
 .PHONY: docker-push
 docker-push: ## Push the docker image