[shawnburke]

Summary

Adds a second flavor of the agent image, cortex-axon-agent:<version>-grpc, that:

1. Ships no Node binaries. Node, npm and snyk-broker are never installed (549MB vs 876MB for the full image).
2. Only runs grpc-tunnel. config.ForcedRelayMode is stamped into the binary via ldflags. Setting AXON_RELAY_TRANSPORT (or RELAY_MODE) to anything else panics at startup with this build only supports AXON_RELAY_TRANSPORT=grpc-tunnel, got "snyk-broker", so it fails loudly instead of later on a missing snyk-broker.
3. Runs only the gRPC E2E tests in CI. docker-tests-grpc now builds the go-only image and runs the gRPC relay suite against it. The snyk-broker and scaffold tests stay on the full image in docker-tests.

Publishing

Git tag	Publishes
v0.3.11	cortex-axon-agent:0.3.11, :0.3, cortex-axon-tunnel-server:0.3.11, :0.3, and cortex-axon-agent:0.3.11-grpc, :latest-grpc
v0.3.10-grpc	only cortex-axon-agent:0.3.10-grpc (does not move latest-grpc)
push to main	full images' main tags, as before, and cortex-axon-agent:main-grpc
PR	builds + Trivy-scans both agent variants, publishes nothing

• docker.yml now calls a reusable docker-image.yml once per variant, so the go-only image gets its own build, PR Trivy gate and release scan (SARIF category trivy-cortex-axon-agent-grpc). The full image's category is unchanged.
• -grpc tags are skipped by the full-image job and tunnel-server-release.yml. Otherwise semver reads v0.3.10-grpc as a prerelease and would publish the full image and the tunnel server as 0.3.10-grpc.
• The go-only image publishes <version>-grpc and latest-grpc per release (no 0.3-grpc), plus main-grpc from main. The daily Trivy sweep scans main-grpc too.
• docker.yml and docker-image.yml default to permissions: {}, and each job declares only what it needs.

This is an intermediate stage. Once snyk-broker is fully deprecated, the full image becomes go-only and the -grpc variant collapses back into it.

Dependency bumps

google.golang.org/grpc v1.82.1 → v1.83.2 and golang.org/x/net v0.53.0 → v0.60.0 in sdks/go, scaffold/go/axon_client and examples/go/axon-ev-sync, matching agent/ and server/. This clears the open Go Dependabot alerts (#17–19, #28–29, #31, #33–38).

Dockerfile

VARIANT build arg (full default, grpc). The Node install moved into a deps-full stage after the shared apt and Go layers. BuildKit only builds the stages the selected variant reaches, so the grpc build never runs it. make docker-build-grpc builds cortex-axon-agent:local-grpc locally.

Test plan

• go test ./config/ ./cmd/: new tests cover the forced mode as default, and rejection via both AXON_RELAY_TRANSPORT and RELAY_MODE
• make docker-build-grpc: built without running any Node or snyk-broker steps
• make docker-build: full image still has node and /usr/bin/snyk-broker
• CI verify script on the go-only image: no node/npm/npx/snyk-broker; AXON_RELAY_TRANSPORT=snyk-broker is refused
• AXON_AGENT_IMAGE=cortex-axon-agent:local-grpc make -C agent grpc-relay-test-with-proxy and grpc-relay-test-no-proxy both pass locally
• actionlint: no new findings
• go build, go vet and go test pass in all three bumped modules
• CI on this PR: both agent variants build and pass their Trivy scan
• After merge: push v0.3.10-grpc (or the next v* tag) and confirm the expected tags appear in ghcr

🤖 Generated with Claude Code

[keithfz]

gonna just keep stamping away