adding test containers

haven-notify/Dockerfile

@@ -1,20 +1,22 @@
-# Start from the official Golang image for building
-FROM --platform=$BUILDPLATFORM golang:1.22-alpine AS builder
+ARG BUILDPLATFORM
+FROM --platform=$BUILDPLATFORM golang:1.25.10-alpine3.23@sha256:8d22e29d960bc50cd025d93d5b7c7d220b1ee9aa7a239b3c8f55a57e987e8d45 AS builder
 
 ARG TARGETARCH
 ARG TARGETOS
 
-WORKDIR /app
-COPY . .
-# Build statically for Linux
-RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o haven-notify main.go
-
-# Use Alpine for running, with CA certificates for TLS
-FROM alpine:latest
-WORKDIR /app
-RUN apk --no-cache add ca-certificates
+WORKDIR /src
+COPY go.mod go.sum ./
+COPY *.go ./
 COPY template/ template/
-COPY --from=builder /app/haven-notify .
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath -ldflags="-s -w" -o /out/haven-notify .
+
+FROM alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
+WORKDIR /app
+RUN apk --no-cache add ca-certificates \
+    && addgroup -S haven-notify \
+    && adduser -S -D -H -G haven-notify haven-notify
+COPY --from=builder --chown=haven-notify:haven-notify /out/haven-notify /app/haven-notify
 EXPOSE 8080
 ENV WEBHOOK_URL=""
+USER haven-notify
 ENTRYPOINT ["/app/haven-notify"]