build(chip-router): make the image build hermetic with a cmd/chip-router module

The Dockerfile deleted go.mod's replace and ran 'go mod tidy' at build time.
Tidy resolves packages missing from go.mod at latest and shifts direct deps
(x/sync 0.22->0.23, x/net, x/sys, x/text, x/crypto, genproto, otel 1.46->1.47 in a
scratch simulation), so an image built from a pinned commit was not reproducible,
and an upstream release needing a newer go than the pinned builder broke the build
with no change in this repo.

The router binary imports neither the framework module nor the deploy-side library,
so give cmd/chip-router its own module (go.mod/go.sum checked in; versions equal to
what the parent resolved) and build from those pins only: go mod download from
go.mod+go.sum, then go build -mod=readonly. Same pattern as framework/leak/cmd.

The library module's go.mod no longer requires the binary's dependencies.

Author: pkcll

framework/components/chiprouter/.changeset/v1.0.5.md

@@ -4,3 +4,4 @@
 - `chip-router`: failures return `codes.Internal` (the write-service's failure code), including when no subscribers are registered or none accepted, instead of acking undelivered events
 - `chip-router`: implement `Ping` like the write-service
 - `chip-router`: self-contained image build (builder `golang:1.26.6`, binary no longer imports the `framework` module); bump the `chainlink-common/pkg/chipingress` pin so `PublishResult.Error` is available
+- `chip-router`: `cmd/chip-router` is now its own Go module with checked-in `go.mod`/`go.sum`, so the image build uses pinned dependencies only (no `replace` editing or `go mod tidy` at build time); the library module no longer requires the router binary's dependencies (grpc, cloudevents, chipingress, protobuf)

framework/components/chiprouter/Dockerfile

@@ -1,24 +1,22 @@
 FROM golang:1.26.6 AS builder
 
-WORKDIR /src
+# cmd/chip-router is its own Go module (go.mod/go.sum are checked in next to
+# main.go), so the image builds from pinned dependencies only: no `replace`
+# editing and no `go mod tidy` at build time. The router binary does not import
+# the parent chiprouter module (the deploy-side library) or `framework`.
+WORKDIR /src/cmd/chip-router
 
-COPY . .
+COPY cmd/chip-router/go.mod cmd/chip-router/go.sum ./
+RUN go mod download
 
-# The module's go.mod replaces the parent framework module with ../../ (a
-# monorepo-dev convenience) which cannot resolve inside this build's
-# module-dir context, and the published framework does not compile against
-# this module's moby pins. The router binary no longer imports framework
-# (only the deploy-side library does, and it is not compiled into the
-# image), so drop the replace and fetch the published framework module from
-# the proxy for module-graph completeness only.
-RUN sed -i '/^replace /d' go.mod && go mod tidy && go mod download
+COPY cmd/chip-router/ ./
 
 ARG TARGETOS=linux
 ARG TARGETARCH=amd64
 ARG CTF_LOG_LEVEL=info
 ENV CTF_LOG_LEVEL=${CTF_LOG_LEVEL}
 
-RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath -ldflags="-s -w" -o /out/chip-router ./cmd/chip-router
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -mod=readonly -trimpath -ldflags="-s -w" -o /out/chip-router .
 
 FROM gcr.io/distroless/static-debian12:nonroot
 

framework/components/chiprouter/cmd/chip-router/go.mod

@@ -0,0 +1,24 @@
+module github.com/smartcontractkit/chainlink-testing-framework/framework/components/chiprouter/cmd/chip-router
+
+go 1.26.6
+
+require (
+	github.com/cloudevents/sdk-go/binding/format/protobuf/v2 v2.16.2
+	github.com/google/uuid v1.6.0
+	github.com/rs/zerolog v1.33.0
+	github.com/smartcontractkit/chainlink-common/pkg/chipingress v0.0.11-0.20260915184316-2730f1867c92
+	golang.org/x/sync v0.22.0
+	google.golang.org/grpc v1.83.2
+)
+
+require (
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	go.opentelemetry.io/otel v1.46.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
+)

framework/components/chiprouter/cmd/chip-router/go.sum

@@ -5,16 +5,10 @@ go 1.26.6
 replace github.com/smartcontractkit/chainlink-testing-framework/framework => ../../
 
 require (
-	github.com/cloudevents/sdk-go/binding/format/protobuf/v2 v2.16.2
-	github.com/google/uuid v1.6.0
 	github.com/moby/moby/api v1.54.1
 	github.com/pkg/errors v0.9.1
-	github.com/rs/zerolog v1.33.0
-	github.com/smartcontractkit/chainlink-common/pkg/chipingress v0.0.11-0.20260915184316-2730f1867c92
 	github.com/smartcontractkit/chainlink-testing-framework/framework v0.15.8
 	github.com/testcontainers/testcontainers-go v0.42.0
-	golang.org/x/sync v0.22.0
-	google.golang.org/grpc v1.83.2
 )
 
 require (
@@ -43,6 +37,7 @@ require (
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.26.0 // indirect
 	github.com/go-resty/resty/v2 v2.16.3 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20240226150601-1dcf7310316a // indirect
@@ -61,6 +56,7 @@ require (
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/rs/zerolog v1.33.0 // indirect
 	github.com/shirou/gopsutil/v4 v4.26.3 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/stretchr/testify v1.12.1 // indirect
@@ -77,8 +73,7 @@ require (
 	golang.org/x/crypto v0.55.0 // indirect
 	golang.org/x/exp v0.0.0-20260112195511-716be5621a96 // indirect
 	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/text v0.41.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
-	google.golang.org/protobuf v1.36.12 // indirect
 )