fix: keep Go image digest pinned when GO_VERSION is overridden

[Namanlashkari]

Problem

GO_VERSION is passed as a build-arg from the release workflow. It is only the version extracted from go.mod (for example 1.26.6). That overrides the Dockerfile default tag@digest value, so published images are built from an unpinned golang:1.26.6 base. The digest pinning in the Dockerfile does not take effect for release builds.

#1998

ref: #1997 (comment)

Fix

Split the Go image pin into two args:

1. GO_VERSION — tag only (1.26.6)
2. GO_IMAGE_DIGEST — digest (sha256:…)

FROM is now golang:${GO_VERSION}@${GO_IMAGE_DIGEST}. The release workflow can still pass GO_VERSION from go.mod; the digest stays in the Dockerfile.

Testing

Manual (Docker Desktop, linux/arm64):

GO_VERSION=$(grep '^go ' go.mod | cut -d' ' -f2)
docker build \
  --build-arg GO_VERSION="$GO_VERSION" \
  --build-arg TAG=local-test \
  --build-arg COMMIT=deadbeef \
  -t deck:digest-test .

• Build resolved golang:1.26.6@sha256:0d1d3a794be25f809dd2cb3160d8c73276c4056a9f8242a138e908ddeee7b6b6 (digest kept after GO_VERSION override)
• Image built successfully (sha256:1b39ce0f95713cb2c73c0df47d68a36700c7c27c18c71f37ec4a71610dac7cac)

CI:

• Release image job is unchanged except that GO_VERSION no longer strips the digest

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}