From 159c317fcaafd54e4da7eb33f652d2487cf7958e Mon Sep 17 00:00:00 2001
From: Adarsh Prashar <adarsh.prashar32@gmail.com>
Date: Sun, 31 May 2026 16:24:45 +0530
Subject: [PATCH] fix: align Dockerfile Go version with go.mod (release
 blocker)

The Dockerfile build stage pinned golang:1.23, but a dependency forces the
go.mod `go` directive to 1.25.7, so `docker build` failed at `go mod download`
with "go.mod requires go >= 1.25.7". CI didn't catch it because the Actions
jobs use go-version-file (go.mod) while the Dockerfile hardcoded a version;
the release image build would have failed the same way on the v0.1.0 tag.

Bump the build stage to golang:1.25 and align CONTRIBUTING ("Go 1.25+").
Verified: image rebuilds (19.6 MB, nonroot 65532), /healthz 200, in-container
HEALTHCHECK exits 0, and the governor enforces a loop budget (402) in the
container.

Fixes #20
---
 CONTRIBUTING.md | 4 ++--
 Dockerfile      | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f3ad4af..1fd739f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,8 +9,8 @@ labeled [`good first issue`](https://github.com/prashar32/riskkernel/labels/good
 
 ## Getting started
 
-Requires **Go 1.23+** (the daemon is pure-Go, no cgo) and, for SDK work, Python
-3.9+.
+Requires **Go 1.25+** (matches the `go` directive in `go.mod`; the daemon is
+pure-Go, no cgo) and, for SDK work, Python 3.9+.
 
 ```bash
 git clone https://github.com/prashar32/riskkernel
diff --git a/Dockerfile b/Dockerfile
index 9ac51e2..33f9c7f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,9 @@
 # --- build: pure-Go static binary (no cgo, thanks to modernc.org/sqlite) ---
 # Runs on the builder's native platform and cross-compiles to the target, so
 # multi-arch builds don't pay the QEMU tax for the Go compile.
-FROM --platform=$BUILDPLATFORM golang:1.23 AS build
+# NOTE: keep this >= the `go` directive in go.mod (currently 1.25.x), or the build
+# fails with "go.mod requires go >= ..." (the image pins GOTOOLCHAIN=local).
+FROM --platform=$BUILDPLATFORM golang:1.25 AS build
 WORKDIR /src
 
 # Cache deps first.