Pin the Serena gopls builder image to a SHA256 digest #14995

Code scanning finding

• Alert: Code scanning alert #4
• Scanner: Opengrep OSS
• Severity: High
• Rule: dockerfile-non-sha-pinned-image
• Location: containers/serena-mcp-server/Dockerfile:5

Finding

The gopls-builder stage uses golang:1.25-alpine by tag only:

FROM golang:1.25-alpine AS gopls-builder

Tags are mutable, so the same source revision can resolve to different base-image contents over time. A compromised or unexpectedly updated tag could also introduce unreviewed components into the build.

Recommended remediation

Pin the image to its verified immutable digest while retaining the tag for readability, for example:

FROM golang:1.25-alpine@sha256:<verified-digest> AS gopls-builder

Ensure the digest is maintained through the repository's dependency-update process.

Acceptance criteria

• The builder image is pinned to a verified SHA256 digest.
• The Serena container still builds successfully.
• Code scanning alert Lpcox/add difc #4 is resolved, or dismissed with documented justification if pinning is intentionally managed elsewhere.