build(docker): dockerfile improvements

[DevipriyaS17]

Summary

Dockerfile improvements

Changes

Dockerfile

• ca-certificates (Medium): Added RUN apk add --no-cache ca-certificates in
  builder stage. Previously COPY ca-certificates.crt in the final stage silently
  copied nothing since the package was never installed.
• GOARCH hardcoded (Medium): Replaced GOARCH=amd64 with ARG TARGETARCH=amd64
  to support cross-platform builds via docker buildx --platform.
• No build cache mounts (Medium): Added --mount=type=cache for
  /root/.cache/go-build and /go/pkg/mod/cache for faster iterative builds.
• go mod tidy cache guard (High): Removed go mod tidy — the modules stage
  already downloads deps; re-running tidy after COPY . /app invalidated the cache
  on every source change.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.09%. Comparing base (1900d7d) to head (239c9c7).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1173   +/-   ##
=======================================
  Coverage   50.09%   50.09%           
=======================================
  Files         146      146           
  Lines       13552    13552           
=======================================
  Hits         6789     6789           
  Misses       6171     6171           
  Partials      592      592           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[madhavilosetty-intel]

@DevipriyaS17 This change is related to Docker build configuration, so build(docker): would be a better Conventional Commit type than fix:

[Copilot]

Pull request overview

This PR improves the project’s Docker build to better support cross-platform builds and faster rebuilds, while fixing missing CA certificates in the final scratch image to enable proper TLS verification.

Changes:

• Installs ca-certificates in the builder stage so the final stage’s certificate copy actually includes the bundle.
• Switches from a hardcoded GOARCH=amd64 to TARGETARCH for multi-arch docker buildx builds.
• Adds BuildKit cache mounts for Go build and module cache paths to speed up iterative builds.

Suppressed comments (1)

Dockerfile:39

• GOARCH=$TARGETARCH alone is not sufficient for arm variants; ensure GOARM is set from TARGETVARIANT when TARGETARCH=arm so buildx --platform=linux/arm/v7 produces the correct binary.

    if [ -n "$BUILD_TAGS" ]; then \
      CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -tags="$BUILD_TAGS_GO" -o /bin/app ./cmd/app; \
    else \
      CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -o /bin/app ./cmd/app; \
    fi'

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.