Update docker image updates to v9.8-1784190466#304
Update docker image updates to v9.8-1784190466#304red-hat-konflux-kflux-prd-rh02[bot] wants to merge 1 commit into
Conversation
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
📝 WalkthroughWalkthroughThe Dockerfile builder stage image changed from Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
Risk Score: 0 —
|
| Signal | Detail | Points |
|---|---|---|
| PR size | 2 lines | +0 |
| Sensitive paths | none | +0 |
Computed by hyperfleet-risk-scorer
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 3: Pin the Dockerfile base images used by the builder stage and runtime
stage to immutable digests instead of mutable tags, including replacing
ubi9/go-toolset:9.8-1784190466 and ubi9-micro:latest with their corresponding
sha256 digests while preserving the existing stage structure.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: da8f95cb-d08f-4662-9b64-d809417a2b9f
📒 Files selected for processing (1)
Dockerfile
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual) → reviewed against open PR#231konflux/mintmaker/main/docker-image-updatesinstead of the default branchopenshift-hyperfleet/hyperfleet-adapter(manual) → reviewed against open PR#257konflux/mintmaker/main/docker-image-updatesinstead of the default branchopenshift-hyperfleet/hyperfleet-broker(manual)
| ARG BASE_IMAGE=registry.access.redhat.com/ubi9-micro:latest | ||
|
|
||
| FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1783931515 AS builder | ||
| FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1784190466 AS builder |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
skopeo inspect docker://registry.access.redhat.com/ubi9/go-toolset:9.8-1784190466 \
| jq -r '.Digest'Repository: openshift-hyperfleet/hyperfleet-api
Length of output: 213
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- Dockerfile ---\n'
cat -n Dockerfile
printf '\n--- refs to go-toolset ---\n'
rg -n 'ubi9/go-toolset|FROM ' DockerfileRepository: openshift-hyperfleet/hyperfleet-api
Length of output: 264
🏁 Script executed (no clone):
#!/bin/bash
set -euo pipefail
image='registry.access.redhat.com/ubi9/go-toolset:9.8-1784190466'
printf 'Attempting registry v2 HEAD...\n'
curl -fsSI -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
"https://${image%%:*}/v2/${image#*/v2/}" >/tmp/registry_head.out 2>/tmp/registry_head.err || true
printf '\nHEAD stdout/stderr summary:\n'
sed -n '1,40p' /tmp/registry_head.out 2>/dev/null || true
sed -n '1,80p' /tmp/registry_head.err 2>/dev/null || true
Length of output: 429
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,40p' Dockerfile | cat -nRepository: openshift-hyperfleet/hyperfleet-api
Length of output: 1759
Pin the base images by digest (CWE-494). ubi9/go-toolset:9.8-1784190466 and ubi9-micro:latest are mutable tags; a registry retag can silently change the build toolchain or runtime image.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 3, Pin the Dockerfile base images used by the builder
stage and runtime stage to immutable digests instead of mutable tags, including
replacing ubi9/go-toolset:9.8-1784190466 and ubi9-micro:latest with their
corresponding sha256 digests while preserving the existing stage structure.
Source: Path instructions
This PR contains the following updates:
9.8-1783931515→9.8-1784190466Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.