feat: made changes to Dockerfile addressing security concerns

Author: amanstep

.github/workflows/licensing.yaml

@@ -1,17 +1,17 @@
-FROM --platform=$TARGETARCH ghcr.io/planetscale/ghcommit:v0.1.74 AS ghcommit
+FROM golang:1.25-alpine3.22
 
-# hadolint ignore=DL3007
-FROM --platform=$TARGETARCH pscale.dev/wolfi-prod/base:latest AS base
-
-COPY --from=ghcommit /ghcommit /usr/bin/ghcommit
+ARG GHCOMMIT_VERSION=v0.1.75
 
 # hadolint ignore=DL3018
-RUN apk add --no-cache \
-        bash \
-        git-crypt \
-        curl \
-        git
+RUN apk add --no-cache bash git-crypt curl git
+
+# Download and build ghcommit from source
+RUN git clone --depth 1 --branch "${GHCOMMIT_VERSION}" https://github.com/planetscale/ghcommit.git /ghcommit
+WORKDIR /ghcommit
+RUN go mod download
+RUN CGO_ENABLED=0 go build -o /usr/bin/ghcommit .
 
 COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh /usr/bin/ghcommit
 
 ENTRYPOINT ["/entrypoint.sh"]