@@ -134,9 +134,11 @@ FROM delve-${DELVE_SUPPORTED} AS delve

 FROM base AS gowinres

 # GOWINRES_VERSION defines go-winres tool version

 ARG GOWINRES_VERSION=v0.3.1

+ADD https://github.com/tc-hib/go-winres.git?ref=${GOWINRES_VERSION}&keep-git-dir=1 /go/src/github.com/tc-hib/go-winres

 RUN --mount=type=cache,target=/root/.cache/go-build \

     --mount=type=cache,target=/go/pkg/mod \

-        GOBIN=/build CGO_ENABLED=0 go install "github.com/tc-hib/go-winres@${GOWINRES_VERSION}" \

+        cd /go/src/github.com/tc-hib/go-winres && \

+        GOBIN=/build CGO_ENABLED=0 go install . \

      && /build/go-winres --help

 # containerd

@@ -187,27 +189,34 @@ FROM containerd-${TARGETOS} AS containerd

 FROM base AS golangci_lint

 ARG GOLANGCI_LINT_VERSION=v2.8.0

+ADD https://github.com/golangci/golangci-lint.git?ref=${GOLANGCI_LINT_VERSION}&keep-git-dir=1 /go/src/github.com/golangci/golangci-lint

 RUN --mount=type=cache,target=/root/.cache/go-build \

     --mount=type=cache,target=/go/pkg/mod \

-        GOBIN=/build CGO_ENABLED=0 go install "github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}" \

+        cd /go/src/github.com/golangci/golangci-lint && \

+        GOBIN=/build CGO_ENABLED=0 go install ./cmd/golangci-lint \

      && /build/golangci-lint --version

 FROM base AS gotestsum

 # GOTESTSUM_VERSION is the version of gotest.tools/gotestsum to install.

 ARG GOTESTSUM_VERSION=v1.13.0

+ADD https://github.com/gotestyourself/gotestsum.git?ref=${GOTESTSUM_VERSION}&keep-git-dir=1 /go/src/gotest.tools/gotestsum

 RUN --mount=type=cache,target=/root/.cache/go-build \

     --mount=type=cache,target=/go/pkg/mod \

-        GOBIN=/build CGO_ENABLED=0 go install "gotest.tools/gotestsum@${GOTESTSUM_VERSION}" \

+        cd /go/src/gotest.tools/gotestsum && \

+        GOBIN=/build CGO_ENABLED=0 go install . \

      && /build/gotestsum --version

 FROM base AS shfmt

 ARG SHFMT_VERSION=v3.8.0

+ADD https://github.com/mvdan/sh.git?ref=${SHFMT_VERSION}&keep-git-dir=1 /go/src/mvdan.cc/sh

 RUN --mount=type=cache,target=/root/.cache/go-build \

     --mount=type=cache,target=/go/pkg/mod \

-        GOBIN=/build CGO_ENABLED=0 go install "mvdan.cc/sh/v3/cmd/shfmt@${SHFMT_VERSION}" \

+        cd /go/src/mvdan.cc/sh && \

+        GOBIN=/build CGO_ENABLED=0 go install ./cmd/shfmt \

      && /build/shfmt --version

 FROM base AS gopls

+# No ARG GOPLS_VERSION, as gopls is only used for devcontainer

 RUN --mount=type=cache,target=/root/.cache/go-build \

     --mount=type=cache,target=/go/pkg/mod \

         GOBIN=/build CGO_ENABLED=0 go install "golang.org/x/tools/gopls@latest" \

@@ -32,6 +32,7 @@ RUN <<EOT

 EOT

 FROM base AS tools

+# go install: versions are pinned in go.mod

 RUN --mount=from=src,source=/out,target=.,rw \

     --mount=type=cache,target=/root/.cache/go-build <<EOT

   set -ex

@@ -8,9 +8,11 @@ FROM golang:${GO_VERSION}-alpine AS base

 WORKDIR /go/src/github.com/moby/moby

 RUN apk add --no-cache jq moreutils

 ARG GOVULNCHECK_VERSION

+ADD https://github.com/golang/vuln.git?ref=${GOVULNCHECK_VERSION}&keep-git-dir=1 /go/src/golang.org/x/vuln

 RUN --mount=type=cache,target=/root/.cache \

     --mount=type=cache,target=/go/pkg/mod \

-    go install golang.org/x/vuln/cmd/govulncheck@$GOVULNCHECK_VERSION

+    cd /go/src/golang.org/x/vuln && \

+    go install ./cmd/govulncheck

 FROM base AS run

 ARG FORMAT