Update registry.redhat.io/ubi9/go-toolset Docker tag to v9.8-1786522985 - #443
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
added
approved
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe Dockerfile now uses UBI Go toolset image version ChangesBuilder Image
Mergeability Score: 🟡 Moderate · up to This PR changes the builder image to a build-specific reference that is not approved under the stated image requirements. Merging without replacing it or documenting an exception could leave the build out of compliance, so owner resolution is needed before merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 2: Update the Dockerfile builder stage’s FROM reference to an approved
UBI minimal or distroless builder image, replacing the build-specific go-toolset
tag; if that image is required, document the applicable builder-stage exception
instead.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a6eb389c-2124-4a35-b15c-0472ec08a740
📒 Files selected for processing (1)
Dockerfile
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
| @@ -1,5 +1,5 @@ | |||
| # Build the manager binary | |||
| FROM registry.redhat.io/ubi9/go-toolset:9.8-1786495588 AS builder | |||
| FROM registry.redhat.io/ubi9/go-toolset:9.8-1786522985 AS builder | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ref="$(sed -n '2p' Dockerfile)"
printf 'Builder reference: %s\n' "$ref"
if grep -Eq '^FROM registry\.redhat\.io/ubi9/go-toolset:[0-9]+\.[0-9]+-[0-9]+ AS builder$' <<<"$ref"; then
echo "Non-compliant build-specific Red Hat builder tag." >&2
exit 1
fi
if command -v skopeo >/dev/null 2>&1; then
image="$(sed -n '2p' Dockerfile | sed -E 's/^FROM ([^ ]+) AS builder$/\1/')"
skopeo inspect "docker://${image}" >/dev/null
else
echo "Use skopeo or podman to verify the approved image reference." >&2
exit 2
fiRepository: openshift/lightspeed-agentic-operator
Length of output: 310
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- Dockerfile ---'
cat -n Dockerfile
printf '%s\n' '--- Dockerfile-related files ---'
git ls-files | grep -E '(^|/)(Dockerfile|Containerfile)([^/]*)?$' || true
printf '%s\n' '--- Relevant repository policy and image references ---'
rg -n --hidden -S \
'ubi9/go-toolset|catalog\.redhat\.com|registry\.redhat\.io|FROM |floating tag|base image|Dockerfile|Containerfile' \
-g '!vendor/**' -g '!node_modules/**' -g '!dist/**' . | head -300
printf '%s\n' '--- Current change summary ---'
git diff --stat
git diff -- DockerfileRepository: openshift/lightspeed-agentic-operator
Length of output: 9398
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- Container security instructions ---'
sed -n '140,170p' .coderabbit.yaml
printf '%s\n' '--- Dockerfile change metadata ---'
git diff --unified=20 -- Dockerfile
git status --short
git rev-parse HEAD
git rev-parse HEAD^ 2>/dev/null || true
printf '%s\n' '--- Previous and current builder references ---'
printf 'current: '; git show HEAD:Dockerfile | sed -n '2p'
printf 'parent: '; git show HEAD^:Dockerfile 2>/dev/null | sed -n '2p' || true
printf '%s\n' '--- References to builder-stage policy or exceptions ---'
rg -n -i --hidden \
'builder.stage|builder stage|go-toolset|floating tag|floating tags|base image|catalog\.redhat\.com' \
.coderabbit.yaml .ai docs .github 2>/dev/null || trueRepository: openshift/lightspeed-agentic-operator
Length of output: 2486
Use a compliant builder image reference.
registry.redhat.io/ubi9/go-toolset:9.8-1786522985 uses a build-specific tag and is not a UBI minimal or distroless image. Replace it with an approved builder image reference, or document the applicable builder-stage exception.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 2, Update the Dockerfile builder stage’s FROM reference
to an approved UBI minimal or distroless builder image, replacing the
build-specific go-toolset tag; if that image is required, document the
applicable builder-stage exception instead.
Source: Path instructions
|
@red-hat-konflux[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR contains the following updates:
9.8-1786495588→9.8-1786522985Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.