chore(marketplace): build MinIO with fixed Go toolchain

.github/workflows/sbom.yml

@@ -0,0 +1,40 @@
+name: SBOM & Vulnerability Scan
+
+on:
+  push:
+    branches: ["release/*"]
+  pull_request:
+    branches: ["release/*"]
+  workflow_dispatch:
+
+jobs:
+  sbom:
+    name: Generate SBOM and scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build image
+        run: |
+          docker build -t minio:marketplace -f Dockerfile.marketplace .
+
+      - name: Generate SBOM (Syft)
+        uses: anchore/sbom-action@v0
+        with:
+          image: minio:marketplace
+          format: cyclonedx-json
+          output-file: sbom.cdx.json
+
+      - name: Scan vulnerabilities (Grype)
+        uses: anchore/scan-action@v6
+        with:
+          image: minio:marketplace
+          fail-build: false
+          output-format: table
+
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-minio
+          path: sbom.cdx.json
+          retention-days: 90

Dockerfile.marketplace

@@ -0,0 +1,37 @@
+FROM golang:1.25.9-alpine AS build
+
+ARG RELEASE_VERSION=2025-10-15T17-29-55Z
+ARG COMMIT_ID=9e49d5e7a648f00e26f2246f4dc28e6b07f8c84a
+ARG SHORT_COMMIT_ID=9e49d5e7a648
+
+ENV CGO_ENABLED=0 \
+    GOTOOLCHAIN=local \
+    MINIO_RELEASE=RELEASE
+
+WORKDIR /src
+COPY . .
+
+RUN set -eux; \
+    ldflags="-s -w"; \
+    ldflags="${ldflags} -X github.com/minio/minio/cmd.Version=${RELEASE_VERSION}"; \
+    ldflags="${ldflags} -X github.com/minio/minio/cmd.CopyrightYear=2025"; \
+    ldflags="${ldflags} -X github.com/minio/minio/cmd.ReleaseTag=RELEASE.${RELEASE_VERSION}"; \
+    ldflags="${ldflags} -X github.com/minio/minio/cmd.CommitID=${COMMIT_ID}"; \
+    ldflags="${ldflags} -X github.com/minio/minio/cmd.ShortCommitID=${SHORT_COMMIT_ID}"; \
+    ldflags="${ldflags} -X github.com/minio/minio/cmd.GOPATH=/go"; \
+    ldflags="${ldflags} -X github.com/minio/minio/cmd.GOROOT=/usr/local/go"; \
+    GOOS=linux GOARCH=amd64 go build -tags kqueue -trimpath --ldflags "${ldflags}" -o /out/minio .
+
+FROM alpine:3.23
+
+RUN apk add --no-cache ca-certificates && \
+    chmod -R 777 /usr/bin
+
+COPY --from=build /out/minio /usr/bin/minio
+COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
+
+EXPOSE 9000
+VOLUME ["/data"]
+
+ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
+CMD ["minio"]

go.mod

@@ -2,7 +2,7 @@ module github.com/minio/minio
 
 go 1.24.0
 
-toolchain go1.24.8
+toolchain go1.25.9
 
 // Install tools using 'go install tool'.
 tool (