Update docker image updates to v9.8-1784190466

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi9/go-toolset	stage	patch	9.8-1783931515 → 9.8-1784190466

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign jsell-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Walkthrough

The Dockerfile builder stage now uses registry.access.redhat.com/ubi9/go-toolset:9.8-1784190466 instead of 9.8-1783931515. No other Dockerfile instructions or build/runtime wiring changed.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: ciaranroche

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	Modified file is only Dockerfile; no Go log statements with token/password/credential/secret were added. CWE-532 not triggered.
No Hardcoded Secrets	✅ Passed	Dockerfile only updates a base-image tag; no hardcoded secrets, creds-in-URL, or long base64 strings were found. CWE-798 not present.
No Weak Cryptography	✅ Passed	Diff only bumps a Docker base-image tag; no md5/des/rc4/SHA1-for-security, ECB, custom crypto, or secret compares were added (CWE-327/CWE-208).
No Injection Vectors	✅ Passed	Dockerfile only bumps a Go toolset base-image tag; no CWE-89/78/79/502 sink patterns or user-controlled input paths are present.
No Privileged Containers	✅ Passed	No new privileged settings were introduced; builder-stage root is justified, and runtime stays non-root (no CWE-250/CWE-269 issue).
No Pii Or Sensitive Data In Logs	✅ Passed	Only the Dockerfile base-image tag changed; no logging sinks or log content were touched, so no PII/session/body exposure risk (CWE-532) here.
Title check	✅ Passed	The title matches the main change, updating the go-toolset image tag.
Description check	✅ Passed	The description accurately describes the dependency update and automation context.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/docker-image-updates

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch konflux/mintmaker/main/docker-image-updates

---

_{Comment @coderabbitai help to get the list of available commands.}

[hyperfleet-ci-bot]

Risk Score: 0 — risk/low

Signal	Detail	Points
PR size	2 lines	+0
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Line 3: Update both Dockerfile stages, including the builder image reference,
to pin their base images with the corresponding immutable `@sha256` digests
instead of tag-only references; preserve the existing image repositories and
stage structure.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 39baf45c-2a44-4e1f-ae29-aa0647e711d5

📥 Commits

Reviewing files that changed from the base of the PR and between 9872189 and 66d84cd.

📒 Files selected for processing (1)

• Dockerfile

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual) → reviewed against open PR #304 konflux/mintmaker/main/docker-image-updates instead of the default branch
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against open PR #257 konflux/mintmaker/main/docker-image-updates instead of the default branch
• openshift-hyperfleet/hyperfleet-broker (manual)

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== Dockerfile ==\n'
cat -n Dockerfile

printf '\n== Search for other FROM lines / digest pins ==\n'
rg -n '^FROM |`@sha256`:|ubi9/go-toolset' Dockerfile . || true

printf '\n== Check repo docker ignore ==\n'
if [ -f .dockerignore ]; then cat -n .dockerignore; else echo '.dockerignore missing'; fi

Repository: openshift-hyperfleet/hyperfleet-sentinel

Length of output: 4298

---

Pin both base images by digest. Dockerfile:1-3 still relies on tag-only references (ubi9-micro:latest and ubi9/go-toolset:9.8-1784190466), so builds can drift to different image contents without a code change (CWE-494). Use @sha256:... pins for both stages.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 3, Update both Dockerfile stages, including the builder
image reference, to pin their base images with the corresponding immutable
`@sha256` digests instead of tag-only references; preserve the existing image
repositories and stage structure.

Source: Path instructions