Run tooling race contract with a pinned compiler image

Authored-By: Codex (GPT-6) <noreply@openai.com>

.gitea/workflows/private-modules.yaml

@@ -11,4 +11,4 @@ jobs:
       - name: Canonical export and native offline boundaries
         run: |
           python3 -m unittest discover -s tests
-          CGO_ENABLED=1 GO111MODULE=off GOTOOLCHAIN=local GOFLAGS= go test -race ./tools/private-modules
+          docker build --network none --file tests/private-modules.Dockerfile tools/private-modules

README.md

@@ -96,6 +96,20 @@ input for public bases.
 |---|---|
 | `tag` | Numeric tag assigned (= `github.run_number`). |
 
+## Private module contract validation
+
+The private-module contract workflow runs its Go race tests in the digest-pinned
+standard Go compiler image in `tests/private-modules.Dockerfile`. The Fritzlab
+runner doesn't provide GCC. Only `tools/private-modules` enters that build context;
+the test runs with networking and module downloads disabled. The public compiler
+image must already be cached or obtainable through the existing image pull path.
+This check doesn't publish an image or change runner configuration.
+
+```sh
+python3 -m unittest discover -s tests
+docker build --network none --file tests/private-modules.Dockerfile tools/private-modules
+```
+
 ## Smoke test patterns
 
 Override entrypoint for a binary that expects no args:

tests/private-modules.Dockerfile

@@ -0,0 +1,7 @@
+FROM golang:1.27.0-trixie@sha256:df98008ecd2b0ecc9f0a94d1b07e3564a9c92b555369b33d9b5f60d0765b2db7
+WORKDIR /contract
+# The runner intentionally needn't provide a C compiler for this race check.
+# The build context contains only the canonical Go tooling, without Git state.
+COPY *.go ./
+ENV CGO_ENABLED=1 GO111MODULE=off GOTOOLCHAIN=local GOFLAGS= GOPROXY=off GOSUMDB=off
+RUN go test -race -count=1 ./