QD-14979: pin dhi.io/golang base to a dlopen-safe digest

[Anna Zhukova (bindreams)]

Fixes QD-14979. qodana-go nightlies fail to start the bundled JBR:

java.lang.UnsatisfiedLinkError: /opt/idea/jbr/lib/libzip.so: libz.so.1: shared object cannot be dlopen()ed
→ Error occurred during initialization of VM / Unable to load zip library

Root cause

The DHI golang:1.26.3-debian13-dev baked into go-base-latest (2026-05-21) ships libz.so.1 built -z nodlopen (DF_1_NOOPEN). The IDE launcher starts the JVM by dlopen-ing libjvm, and the JVM then dlopens libzip.so at runtime → which pulls in libz.so.1 → glibc refuses to dlopen a NOOPEN object. (Bare bin/java works — it loads libz at startup as a DT_NEEDED, never via dlopen, which is why this looked JBR-specific but is purely a base-image defect.) DHI cleared the flag in 1.26.4; stock debian:trixie was never NOOPEN. The base floated silently onto the bad image because the 1.26-debian13-dev tag was unpinned.

Fix

• go.Dockerfile — pin GO_TAG to the known-good multi-arch digest (@sha256:17e7e33c…, NOOPEN-clear). On merge, base.yml rebuilds & pushes go-base-latest on this digest → the next QodanaGoNightly is green.
• renovate.json — add a dhi.io hostRules block so Renovate authenticates (read-only Docker Hub OAT) and keeps the pinned digest fresh.

⚠️ Before merging

Add two repository secrets in the Mend Developer Portal (developer.mend.io → JetBrains/qodana-cli → Credentials), as plaintext:

Secret	Value
DHI_USERNAME	the Docker Hub org slug (for an OAT the username is the org name, not an account or token label)
DHI_PASSWORD	the read-only Organization Access Token (needs Image Pull on the dhi.io repos Renovate reads — at least golang)

A missing secret only fails dhi.io auth (no repo-wide config break), but provisioning before merge means Renovate's digest-bump PRs start working immediately.

Verified

• End-to-end IDE scan on a base built from the exact pinned digest → docker run exit 0, no libzip error, full analysis ran to completion.
• renovate-config-validator passes; hostRules + {{ secrets.* }} accepted. Renovate substitutes {{ secrets.* }} into username (confirmed from source) and digest auto-update is on by default for an already-pinned tag@sha256 under config:base.
• Multi-arch verified: sha256:17e7e33c… is an OCI image index covering linux/amd64 + linux/arm64.

Out of scope / follow-ups

• Other DHI bases (jvm, python, cpp, rust, void, dotnet, js, php, ruby) stay on rolling tags — same NOOPEN-class risk. The host-level hostRules already fixes their Renovate no-result lookups as a side effect.
• Pre-existing: config:base is deprecated (→ config:recommended); a CI renovate-config-validator step could be added.

[github-actions]

Qodana for Go

114 new problems were found

Inspection name	Severity	Problems
Check dependency licenses	🔴 Failure	5
Vulnerable declared dependency	🔴 Failure	1
Check GO source code coverage	🔶 Warning	51
Unhandled error	🔶 Warning	13
Potential resource leak	🔶 Warning	6
Check dependency licenses	🔶 Warning	4
Deprecated element	🔶 Warning	4
Imported package name as a name identifier	🔶 Warning	1
Reserved word used as name	🔶 Warning	1
Vulnerable declared dependency	🔶 Warning	1
Unsorted imports	◽️ Notice	13
Name starts with a package name	◽️ Notice	8
Empty slice declared using a literal	◽️ Notice	3
Comment of exported element starts with the incorrect name	◽️ Notice	1
Redundant type conversion	◽️ Notice	1
Vulnerable declared dependency	◽️ Notice	1

@@ Code coverage @@
+ 65% total lines covered
10664 lines analyzed, 6959 lines covered
# Calculated according to the filters of your coverage tool

☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions