chore: pin mysql-operator source refs to the v0.8.0 tag

images/mgr-operator/Dockerfile

@@ -3,13 +3,13 @@ ARG BASE_IMAGE_REPOSITORY=ghcr.io/ksmartdata/community-operator
 FROM alpine:3.22.2 AS downloader
 
 ARG MGR_OPERATOR_REF=package
-ARG MYSQL_OPERATOR_EXTRA_IMAGE_REF=extra_image
+ARG MYSQL_OPERATOR_EXTRA_IMAGE_REF=v0.8.0
 WORKDIR /tmp
 RUN wget -q "https://github.com/ksmartdata/mgr-operator/archive/${MGR_OPERATOR_REF}.zip" -O mgr-operator.zip && \
     unzip -q mgr-operator.zip && \
     mv mgr-operator-* mgr-operator-src && \
-    wget -q "https://github.com/ksmartdata/mysql-operator/archive/${MYSQL_OPERATOR_EXTRA_IMAGE_REF}.zip" -O extra_image.zip && \
-    unzip -q extra_image.zip && \
+    wget -q "https://github.com/ksmartdata/mysql-operator/archive/${MYSQL_OPERATOR_EXTRA_IMAGE_REF}.zip" -O mysql-operator.zip && \
+    unzip -q mysql-operator.zip && \
     mv mysql-operator-* mysql-operator-src
 
 FROM golang:1.24.13-alpine AS builder

images/mysql-operator-sidecar-5.7/Dockerfile

@@ -1,4 +1,6 @@
-FROM --platform=$TARGETPLATFORM golang:1.21.11 as builder
+# keep the Go version current: the stdlib compiled into the sidecar binary
+# is what the trivy CRITICAL gate scans (see the 8.4 image)
+FROM --platform=$TARGETPLATFORM golang:1.26-bookworm as builder
 
 USER root
 
@@ -8,18 +10,22 @@
 ENV GOPROXY=https://goproxy.cn
 ENV GOPATH=/build
 
+# pinned mysql-operator ref (tag or commit - repo policy forbids pulling
+# from branch heads); bump via build-args when cutting a new release
+ARG OPERATOR_REF=v0.8.0
+
 # build mysql-operator-sidecar
 WORKDIR /build
-RUN wget -O extra_image.zip https://github.com/ksmartdata/mysql-operator/archive/refs/heads/extra_image.zip
-RUN unzip extra_image.zip
-WORKDIR /build/mysql-operator-extra_image
+RUN wget -O src.zip https://github.com/ksmartdata/mysql-operator/archive/${OPERATOR_REF}.zip
+RUN unzip src.zip && mv mysql-operator-* mysql-operator-src
+WORKDIR /build/mysql-operator-src
 RUN go mod tidy
 RUN CGO_ENABLED=0 go build -o /mysql-operator-sidecar cmd/mysql-operator-sidecar/main.go
 
 # install rclone
 RUN curl https://rclone.org/install.sh | bash
 
 FROM --platform=$TARGETPLATFORM jiuker/mysql-operator-sidecar-5.7:v0.6.2
 USER root
 COPY --from=builder /mysql-operator-sidecar /usr/local/bin/
 COPY --from=builder /usr/bin/rclone /usr/local/bin/

images/mysql-operator-sidecar-8.0/Dockerfile

@@ -1,4 +1,6 @@
-FROM --platform=$TARGETPLATFORM golang:1.21.11 as builder
+# keep the Go version current: the stdlib compiled into the sidecar binary
+# is what the trivy CRITICAL gate scans (see the 8.4 image)
+FROM --platform=$TARGETPLATFORM golang:1.26-bookworm as builder
 
 USER root
 
@@ -8,19 +10,26 @@
 ENV GOPROXY=https://goproxy.cn
 ENV GOPATH=/build
 
+# pinned mysql-operator ref (tag or commit - repo policy forbids pulling
+# from branch heads); bump via build-args when cutting a new release
+ARG OPERATOR_REF=v0.8.0
+
 # build mysql-operator-sidecar
 WORKDIR /build
-RUN wget -O arm64.zip https://github.com/ksmartdata/mysql-operator/archive/refs/heads/extra_image.zip
-RUN unzip arm64.zip
-WORKDIR /build/mysql-operator-extra_image
+RUN wget -O src.zip https://github.com/ksmartdata/mysql-operator/archive/${OPERATOR_REF}.zip
+RUN unzip src.zip && mv mysql-operator-* mysql-operator-src
+WORKDIR /build/mysql-operator-src
 RUN go mod tidy
 RUN CGO_ENABLED=0 go build  -o /mysql-operator-sidecar  cmd/mysql-operator-sidecar/main.go
 
 # install rclone
 RUN curl https://rclone.org/install.sh | bash
 
 FROM --platform=$TARGETPLATFORM ghcr.io/ksmartdata/mysql-operator-sidecar-8.0:v0.7.4
 USER root
+# the v0.7.4 base ships a full Go toolchain at /usr/local/go; a runtime
+# image needs no compiler and trivy gates on its stale stdlib CVEs
+RUN rm -rf /usr/local/go
 COPY --from=builder /mysql-operator-sidecar /usr/local/bin/
 COPY --from=builder /usr/bin/rclone /usr/local/bin/
 RUN chmod +x /usr/local/bin/mysql-operator-sidecar

images/mysql-operator-sidecar-8.0/Dockerfile.base

@@ -14,10 +14,14 @@ RUN apt install -y wget gcc unzip
 ENV GOPROXY=https://goproxy.cn
 ENV GOPATH=/build
 
+# pinned mysql-operator ref (tag or commit - repo policy forbids pulling
+# from branch heads); bump via build-args when cutting a new release
+ARG OPERATOR_REF=v0.8.0
+
 WORKDIR /build
-RUN wget -O extra_image.zip https://github.com/ksmartdata/mysql-operator/archive/refs/heads/extra_image.zip
-RUN unzip extra_image.zip
-WORKDIR /build/mysql-operator-extra_image
+RUN wget -O src.zip https://github.com/ksmartdata/mysql-operator/archive/${OPERATOR_REF}.zip
+RUN unzip src.zip && mv mysql-operator-* mysql-operator-src
+WORKDIR /build/mysql-operator-src
 RUN go mod tidy
 RUN CGO_ENABLED=0 go build  -o /mysql-operator-sidecar  cmd/mysql-operator-sidecar/main.go
 

images/mysql-operator-sidecar-8.4/Dockerfile

@@ -11,13 +11,13 @@
 # build mysql-operator-sidecar from the operator fork; the Go version also
 # pins the stdlib compiled into the binary - keep it current or the trivy
 # CRITICAL gate rejects the image (the module itself builds fine on new Go)
 FROM --platform=$TARGETPLATFORM golang:1.26-bookworm AS builder
 
 # Release convention: tag the mysql-operator repo first (e.g. v0.8.0), then
 # dispatch the build with build-args OPERATOR_REF=<that tag> so the sidecar
 # binary is pinned to an exact commit (git clone --branch accepts tags).
-# The default only exists for ad-hoc builds and floats with the branch head.
-ARG OPERATOR_REF=extra_image
+# The default is pinned to the latest release tag; bump it per release.
+ARG OPERATOR_REF=v0.8.0
 
 # git is bundled with the golang image (wget/unzip are not)
 RUN git clone --depth 1 --branch ${OPERATOR_REF} \
@@ -26,7 +26,7 @@
 RUN CGO_ENABLED=0 go build -o /mysql-operator-sidecar ./cmd/mysql-operator-sidecar
 
 # runtime: EL9 (matches Percona's own PXB 8.4 image base)
 FROM --platform=$TARGETPLATFORM oraclelinux:9
 
 # -o: uid/gid 999 must match the other sidecar images (the operator runs the
 # pod with this identity), but EL9 already assigns 999 to a system account
@@ -62,7 +62,7 @@
 
 # re-declared so the builder-stage ARG is visible here; records which
 # mysql-operator ref the embedded sidecar binary was built from
-ARG OPERATOR_REF=extra_image
+ARG OPERATOR_REF=v0.8.0
 LABEL io.ksmartdata.operator-ref=${OPERATOR_REF}
 
 COPY --from=builder /mysql-operator-sidecar /usr/local/bin/mysql-operator-sidecar