chore: when using ubuntu, use hardened intermediate container

[kristof-mattei]

What does this PR accomplish?

• 🪣 Misc

Changes proposed by this PR:

Use a hardened image when testing & building.

Notes to reviewer:

Running as is Chainguard's sanctioned way to install packages: https://edu.chainguard.dev/chainguard/chainguard-images/about/differences-development-production/#:~:text=Chainguard%20Containers%20use,packages%20with%20apk.

📜 Checklist

• Works on the ./demo sub directory
• Test coverage is excellent and passes
• Documentation is thorough

[kristof-mattei]

@drahnr sorry to ping you. Anything else you'd like me to add here?

[drahnr]

One small ask: I'd like to see if the binary produced has runtime deps, specifically on libonig - a simple step of ldd -v $binary would be sufficient.

Thank you!

Otherwise, LGTM

[kristof-mattei]

Will do.

[kristof-mattei]

@drahnr used readelf because that one was available.

This actually made me realize we were linking it dynamically. Had to downgrade the C standard to make it work.

Also removed the caching mechanism because that didn't work.

Log output on that:

  ... Cleaning /__w/cargo-spellcheck/cargo-spellcheck/target ...
  ... Cleaning cargo registry (cache-all-crates: false) ...
  ... Cleaning cargo/bin ...
  ... Cleaning cargo git cache ...
  ... Saving cache ...
  /usr/bin/tar --posix -cf cache.tgz --exclude cache.tgz -P -C /__w/cargo-spellcheck/cargo-spellcheck --files-from manifest.txt -z
  /usr/bin/tar: unrecognized option '--posix'"

[kristof-mattei]

Lastly, if we force a dynamic build, this is how it errors out: https://github.com/kristof-mattei/cargo-spellcheck/actions/runs/23567473268/job/68622372856

This is how I forced the error: kristof-mattei/cargo-spellcheck@hardened-image...kristof-mattei:cargo-spellcheck:hardened-image-force-fail