build(docker): dockerfile improvements

[DevipriyaS17]

Summary

Dockerfile improvements

Changes

Dockerfile

• ca-certificates (Medium): Added RUN apk add --no-cache ca-certificates in
  builder stage. Previously COPY ca-certificates.crt in the final stage silently
  copied nothing since the package was never installed.
• GOARCH hardcoded (Medium): Replaced GOARCH=amd64 with ARG TARGETARCH=amd64
  to support cross-platform builds via docker buildx --platform.
• No build cache mounts (Medium): Added --mount=type=cache for
  /root/.cache/go-build and /go/pkg/mod/cache for faster iterative builds.
• go mod tidy cache guard (High): Removed go mod tidy — the modules stage
  already downloads deps; re-running tidy after COPY . /app invalidated the cache
  on every source change.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.45%. Comparing base (861e864) to head (54eda2a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1173   +/-   ##
=======================================
  Coverage   44.45%   44.45%           
=======================================
  Files         144      144           
  Lines       13732    13732           
=======================================
  Hits         6105     6105           
  Misses       7054     7054           
  Partials      573      573           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sudhir-intc]

What is the analysis on the comment for these

Empty directories created but never populated (Low) : Lines 27 and 35 create /app/tmp/ and /.config/device-management-toolkit/ via RUN mkdir, then copy them. Use COPY --from=builder only if the app actually writes to them at runtime. On scratch, pre-created empty dirs are the right approach, but verify the app doesn't expect them at different paths.

[DevipriyaS17]

Verified that the app writes TLS certs/temp files to os.TempDir() (ENV TMPDIR=/tmp → tmp) and stores the SQLite DB via os.UserConfigDir() (ENV XDG_CONFIG_HOME=/.config → console.db). Both paths match exactly what's pre-created in the Dockerfile. On scratch, seeding empty dirs via RUN mkdir + COPY --from=builder is the only option since there's no base filesystem, will update the jira accordingly.

[madhavilosetty-intel]

@DevipriyaS17 This change is related to Docker build configuration, so build(docker): would be a better Conventional Commit type than fix:

[Copilot]

Pull request overview

This PR improves the project’s Docker build to better support cross-platform builds and faster rebuilds, while fixing missing CA certificates in the final scratch image to enable proper TLS verification.

Changes:

• Installs ca-certificates in the builder stage so the final stage’s certificate copy actually includes the bundle.
• Switches from a hardcoded GOARCH=amd64 to TARGETARCH for multi-arch docker buildx builds.
• Adds BuildKit cache mounts for Go build and module cache paths to speed up iterative builds.

Suppressed comments (1)

Dockerfile:39

• GOARCH=$TARGETARCH alone is not sufficient for arm variants; ensure GOARM is set from TARGETVARIANT when TARGETARCH=arm so buildx --platform=linux/arm/v7 produces the correct binary.

    if [ -n "$BUILD_TAGS" ]; then \
      CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -tags="$BUILD_TAGS_GO" -o /bin/app ./cmd/app; \
    else \
      CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -o /bin/app ./cmd/app; \
    fi'

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.