fix: address Codacy security findings

[rasifr]

• Bump Go toolchain directive to 1.25.9 and update goreleaser-cross image to v1.25.9 so released binaries are built with a patched stdlib, resolving all golang/stdlib CVEs (CVE-2025-68121, CVE-2025-61726–61730, CVE-2026-27139/27142/25679/32281/32288/32289)
• Upgrade github.com/moby/buildkit v0.27.1 → v0.28.1 (CVE-2026-33747, CVE-2026-33748)
• Upgrade go.opentelemetry.io/otel/sdk and exporters v1.38/1.41 → v1.43.0 (CVE-2026-39882, CVE-2026-39883)
• Upgrade google.golang.org/grpc v1.79.1 → v1.80.0 (CVE-2026-33186)
• Add explicit USER nonroot to Dockerfile (base image already runs as UID 65532 but Codacy requires an explicit instruction)
• Pin docker/* GitHub Actions to full commit SHAs to prevent supply-chain attacks via mutable version tags

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5da63ccf-5a14-4298-94da-07e3c20ed29c

📥 Commits

Reviewing files that changed from the base of the PR and between fc08de4 and ccd65ca.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (3)

• .github/workflows/release.yaml
• Dockerfile
• go.mod

✅ Files skipped from review due to trivial changes (1)

• Dockerfile

🚧 Files skipped from review as they are similar to previous changes (2)

• .github/workflows/release.yaml
• go.mod

---

📝 Walkthrough

Walkthrough

The pull request pins Docker-related GitHub Actions to specific commit SHAs in the release workflow, updates the GoReleaser cross-compilation image tag, adds USER nonroot to the Docker runtime stage, and upgrades the Go toolchain plus multiple indirect dependencies in go.mod.

Changes

Cohort / File(s)	Summary
Workflow & Release CI .github/workflows/release.yaml	Pinned docker/setup-qemu-action, docker/setup-buildx-action, and docker/login-action to specific commit SHAs instead of @v3. Updated the GoReleaser container image tag from goreleaser/goreleaser-cross:v1.25.4 to goreleaser/goreleaser-cross:v1.26.0.
Container Configuration Dockerfile	Added USER nonroot to the runtime stage immediately before ENTRYPOINT/CMD to ensure the container runs as a non-root user.
Go Toolchain & Modules go.mod	Bumped Go toolchain directive from go 1.25.4 to go 1.26.0. Updated multiple indirect modules (e.g., klauspost/compress, moby/*, in-toto/attestation modules, pelletier/go-toml/v2, go-securesystemslib, sigstore-go, OpenTelemetry packages, golang.org/x/*, google.golang.org/*) to newer versions/revisions. Small dependency list and version adjustments recorded across +27/-25 lines.

Poem

🐇 I pinned the actions, snug and tight,
Switched the runtime to nonroot flight,
Go toolchain rose, modules anew,
Builds hop forward—v1.26.0 true.
Tiny rabbit cheers the CI night!

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix: address Codacy security findings' is directly related to the pull request's main objective of addressing security issues and CVE vulnerabilities across multiple dependencies and configurations.
Description check	✅ Passed	The pull request description clearly outlines all major security-related changes including Go toolchain updates, dependency upgrades, Dockerfile modifications, and GitHub Actions pinning, all of which are reflected in the actual changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/SPOC-467/triage-codacy-security-issues

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/release.yaml:
- Line 34: Replace the non-existent Docker image tag
"goreleaser/goreleaser-cross:v1.25.9" with the valid tag
"goreleaser/goreleaser-cross:v1.25.8" in the workflow so the release job can
pull the image; if you intentionally need a newer Go toolchain, verify
compatibility and optionally use "goreleaser/goreleaser-cross:v1.26.0" or
"v1.27.0" instead, updating the single occurrence of the image reference
accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 02a1155d-9a73-4b90-9fc3-aa44f7696da7

📥 Commits

Reviewing files that changed from the base of the PR and between cf8794d and fc08de4.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (3)

• .github/workflows/release.yaml
• Dockerfile
• go.mod

[mason-sharp]

Overlaps with , closing