Update docker image updates to v9.8-1784190466#231
Conversation
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
📝 WalkthroughWalkthroughThe Dockerfile builder stage now uses Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
Risk Score: 0 —
|
| Signal | Detail | Points |
|---|---|---|
| PR size | 2 lines | +0 |
| Sensitive paths | none | +0 |
Computed by hyperfleet-risk-scorer
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 3: Update both Dockerfile stages, including the builder image reference,
to pin their base images with the corresponding immutable `@sha256` digests
instead of tag-only references; preserve the existing image repositories and
stage structure.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 39baf45c-2a44-4e1f-ae29-aa0647e711d5
📒 Files selected for processing (1)
Dockerfile
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual) → reviewed against open PR#304konflux/mintmaker/main/docker-image-updatesinstead of the default branchopenshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual) → reviewed against open PR#257konflux/mintmaker/main/docker-image-updatesinstead of the default branchopenshift-hyperfleet/hyperfleet-broker(manual)
| ARG BASE_IMAGE=registry.access.redhat.com/ubi9-micro:latest | ||
|
|
||
| FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1783931515 AS builder | ||
| FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1784190466 AS builder |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== Dockerfile ==\n'
cat -n Dockerfile
printf '\n== Search for other FROM lines / digest pins ==\n'
rg -n '^FROM |`@sha256`:|ubi9/go-toolset' Dockerfile . || true
printf '\n== Check repo docker ignore ==\n'
if [ -f .dockerignore ]; then cat -n .dockerignore; else echo '.dockerignore missing'; fiRepository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 4298
Pin both base images by digest. Dockerfile:1-3 still relies on tag-only references (ubi9-micro:latest and ubi9/go-toolset:9.8-1784190466), so builds can drift to different image contents without a code change (CWE-494). Use @sha256:... pins for both stages.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 3, Update both Dockerfile stages, including the builder
image reference, to pin their base images with the corresponding immutable
`@sha256` digests instead of tag-only references; preserve the existing image
repositories and stage structure.
Source: Path instructions
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rafabene The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
1 participant
This PR contains the following updates:
9.8-1783931515→9.8-1784190466Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.