From 3603f547a52f17cf1e9a4a176e9cc026f608e4e5 Mon Sep 17 00:00:00 2001
From: Fabio Bonelli <fb@fabiobonelli.it>
Date: Sat, 30 May 2026 10:28:21 +0200
Subject: [PATCH] ci: make builds reproducible

---
 .goreleaser.yml       | 5 ++++-
 Dockerfile.goreleaser | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 96335334..4a866c2d 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -11,10 +11,13 @@ builds:
   id: publiccode-parser
   binary: publiccode-parser
   main: ./publiccode-parser/publiccode_parser.go
+  flags:
+    - -trimpath
   ldflags:
-    - -s -w -X main.version={{.Version}} -X main.date={{.Date}}
+    - -s -w -buildid= -X main.version={{.Version}} -X main.date={{.CommitDate}}
   env:
     - CGO_ENABLED=0
+    - SOURCE_DATE_EPOCH={{.CommitTimestamp}}
   goos:
     - linux
     - darwin
diff --git a/Dockerfile.goreleaser b/Dockerfile.goreleaser
index a4850c53..51a43c74 100644
--- a/Dockerfile.goreleaser
+++ b/Dockerfile.goreleaser
@@ -2,7 +2,7 @@
 # This is the Docker image that gets published to DockerHub.
 # Goreleaser takes care of building the binary.
 #
-FROM alpine:3
+FROM alpine:3.23.4@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
 
 COPY publiccode-parser /usr/local/bin/publiccode-parser