build(mcp): vendorer les deps → build hermétique (fix 403 proxy.golang.org)

.github/workflows/ci.yml

@@ -16,5 +16,6 @@ jobs:
           go-version-file: go.mod
       - run: go build ./...
       - run: go vet ./...
-      - run: test -z "$(gofmt -l .)"
+      # gofmt only our code — vendor/ is third-party and not ours to format.
+      - run: test -z "$(gofmt -l cmd internal)"
       - run: go test ./...

Dockerfile

@@ -1,12 +1,13 @@
 # footics-mcp — multi-stage build → tiny static binary (same pattern as footics-api).
+# Deps are VENDORED (vendor/), so the build is hermetic: no module proxy, no
+# network — reproducible on any box/CI (proxy.golang.org has 403'd transitive
+# deps from some IPs; vendoring sidesteps it entirely). GOFLAGS pins vendor mode.
 
 # ---- build ----
 FROM golang:1.25 AS build
 WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
 COPY . .
-ENV CGO_ENABLED=0 GOOS=linux
+ENV CGO_ENABLED=0 GOOS=linux GOFLAGS=-mod=vendor GOPROXY=off
 RUN go build -trimpath -ldflags="-s -w" -o /mcp ./cmd/mcp
 
 # ---- runtime ----