[dependabot]

Bumps the docker-minor-patch group with 2 updates in the / directory: golang and alpine.

Updates golang from 1.26.10-alpine3.24 to 1.27.2-alpine3.24

Updates alpine from 3.24.1 to 3.24.2

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: e2d0449
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0f652a7b-d153-4695-b751-70b9920c84b7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

What failed: the image built and ran without problems. What failed was the shipped-image scan (scripts/scan-shipped-image.sh) in both "Build Docker Image" legs. golang 1.27.2's standard library carries GO-2026-6809 (crypto/x509 intermediate distrust), which is fixed in 1.26.10 and 1.27.3. Both /app/cudly and /usr/local/bin/migrate were flagged. The go.mod go/toolchain line wasn't involved. I reproduced it locally with docker build plus the scan script and got the same two FIXABLE findings.

Fix (b89201d):

• I put the golang builder back to 1.26.10-alpine3.24 (main's digest) in Dockerfile, Dockerfile.dev and Dockerfile.test. go.mod, go.work and ci.yml's GO_VERSION all pin 1.26.10. Moving only the images would ship a Go 1.27 build of code that CI tests on 1.26.
• The alpine 3.24.1 → 3.24.2 runtime bump stays (I also updated the refresh comment).
• I added a Dependabot ignore for golang version-update:semver-minor in the docker ecosystem, so the next group run doesn't reopen a 1.27 image bump on its own. Go 1.26.x patch releases still come through.

Trade-off: the image stays on Go 1.26 until someone moves to 1.27 on purpose. That move should update go.mod, go.work, GO_VERSION and the three Dockerfiles together, on 1.27.3 or later.

Local checks: docker build of the fixed tree (amd64) succeeds. scan-shipped-image.sh with the pinned govulncheck v1.1.4 reports OK: both binaries are built with go1.26.10, and the only advisory is GO-2026-5932, which has no published fix and is tolerated. /app/cudly -h runs and migrate -version prints v4.19.1. The runtime is alpine 3.24.2. hadolint, check-yaml, trivy config v0.69.3, the Dockerfile migrate-drift test, the secrets scan and the git-secrets allowlist test all pass.