fix(images): prefix GOVULNCHECK_VERSION with v per Go module semver

Andrew Dunnrequested to merge
andunn-govulncheck-pin into main

What this MR ships

One-character fix to containers/ci-go.Containerfile. The GOVULNCHECK_VERSION ARG was set to 1.3.0 (no v prefix); Go's module loader rejects bare-semver pseudo-versions:

go: golang.org/x/vuln/cmd/govulncheck@1.3.0: invalid version: unknown revision 1.3.0

The sibling pin GOLANGCI_LINT_VERSION=v2.4.0 has the v correctly. This one drifted at some point — likely a Renovate config that wasn't carrying v prefixes when writing pin values back.

Why this blocks more than itself

build:ci-go fails closed, no allow_failure. Pipeline gate blocks every stage downstream (images-derived → release). The catalog's tag pipelines have all been silently failing the release-stage dogfood since this pin went bad.

Surfaced when v3.3.1 tag pipeline 2547240927 blocked at images-derived/build:ci-go, preventing the release-create job (the new fix from MR !57 (merged)) from running its first self-dogfood.

Test plan

  • MR pipeline builds build:ci-go green (proves the pin fix)
  • On merge, follow-up tag v3.3.2 cuts the next patch with the original backtick fix from MR !57 (merged) + this pin fix together; tag pipeline runs the full matrix end-to-end and self-dogfoods the release-create job
  • If the catalog has Renovate watching this pin, file a follow-up to ensure the manager config preserves the v prefix on future bumps (out of scope here)

🤖 Generated with Claude Code

Merge request reports