[pkcll]

Stacked on #2877 (recreation of the closed #2861; the base is its branch, so only the delta is in the diff). Retarget to main after #2877 merges.

Problem

The router image build deleted go.mod's replace and ran go mod tidy at build time (Dockerfile, added in #2861/#2873). tidy resolves packages missing from go.mod at latest and shifts direct dependencies, so the image for a given commit is not reproducible. In a scratch simulation it moved golang.org/x/sync 0.22→0.23 (the router's errgroup), x/net, x/sys, x/text, x/crypto, genproto/rpc and otel 1.46→1.47. Consumers build this image from a pinned CTF commit (chainlink's setup.toml clones the repo at a commit and builds framework/components/chiprouter/Dockerfile with the module dir as context), so a later upstream release, or one needing a newer go than the pinned builder, can break the build for an unchanged commit.

Change

• cmd/chip-router is now its own Go module (go.mod/go.sum checked in; every retained version equals what the parent module resolved before). The binary imports neither framework nor the deploy-side library, so its graph is small: 6 direct + 9 indirect requires. Same pattern as framework/leak/cmd.
• Dockerfile: COPY go.mod go.sum → go mod download → COPY sources → go build -mod=readonly. No sed, no tidy. The dependency layer is cached again.
• The library module's go.mod/go.sum shrink: it no longer requires grpc, cloudevents, chipingress or protobuf (only the binary used them).
• chiprouter/.changeset/v1.0.5.md: one added bullet.

No change to router behavior: main.go/main_test.go are untouched.

Verification

• cmd/chip-router module: gofmt clean, go vet clean, go test -race -count=20 ok, golangci-lint (repo config) 0 issues.
• Parent module: go build ./... && go vet ./... ok; go mod tidy leaves both modules unchanged (idempotent).
• Hermeticity: with an empty module cache and GOFLAGS=-mod=readonly, go build exits 0 and go.mod/go.sum stay byte-identical, so the checked-in files are sufficient.
• Replayed the Dockerfile's layer sequence (only go.mod+go.sum present → go mod download → sources → go build -mod=readonly, linux/amd64, fresh cache) in a clean directory: exit 0 for each step.

Not verified

• A real docker build: the Docker daemon was not running where this was prepared. The COPY cmd/chip-router/... paths assume the module dir as the build context (as in chainlink's docker_ctx = "framework/components/chiprouter"). Please run docker build -f framework/components/chiprouter/Dockerfile framework/components/chiprouter once before merging.
• api-diff may report the cmd/chip-router package as removed from the chiprouter module (it moved into its own module); nothing imports a package main.

[github-actions]

⚠️ API Diff Results - github.com/smartcontractkit/chainlink-testing-framework/framework/components/chiprouter/cmd/chip-router

⚠️ Breaking Changes (1)

package github (1)

• com/smartcontractkit/chainlink-testing-framework/framework/components/chiprouter/cmd/chip-router — 🗑️ Removed

✅ Compatible Changes (1)

package github (1)

• com/smartcontractkit/chainlink-testing-framework/framework/components/chiprouter/cmd/chip-router — ➕ Added

---

📄 View full apidiff report

[github-actions]

⚠️ API Diff Results - github.com/smartcontractkit/chainlink-testing-framework/framework/components/chiprouter

⚠️ Breaking Changes (1)

package github (1)

• com/smartcontractkit/chainlink-testing-framework/framework/components/chiprouter/cmd/chip-router — 🗑️ Removed

---

📄 View full apidiff report

[pkcll]

Folded into #2877 as commit a711014 (same change, cherry-picked onto its branch so the sed/go mod tidy Dockerfile step never lands on main). Closing this PR as redundant.