Update registry.redhat.io/ubi9/go-toolset Docker tag to v9.8-1787668499 - #443
Conversation
red-hat-konflux
Bot
added
approved
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review. 📝 WalkthroughSummary by CodeRabbit
WalkthroughThe Dockerfile now uses UBI Go toolset image version ChangesBuilder Image
Merge Risk: 🔵 Low · up to The Dockerfile updates the builder image to another build-specific tag that may remain outside the approved base-image policy; the PR is mergeable with explicit owner awareness or follow-up to approve the reference or document the exception. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 2: Update the Dockerfile builder stage’s FROM reference to an approved
UBI minimal or distroless builder image, replacing the build-specific go-toolset
tag; if that image is required, document the applicable builder-stage exception
instead.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a6eb389c-2124-4a35-b15c-0472ec08a740
📒 Files selected for processing (1)
Dockerfile
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
| @@ -1,5 +1,5 @@ | |||
| # Build the manager binary | |||
| FROM registry.redhat.io/ubi9/go-toolset:9.8-1786495588 AS builder | |||
| FROM registry.redhat.io/ubi9/go-toolset:9.8-1786522985 AS builder | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ref="$(sed -n '2p' Dockerfile)"
printf 'Builder reference: %s\n' "$ref"
if grep -Eq '^FROM registry\.redhat\.io/ubi9/go-toolset:[0-9]+\.[0-9]+-[0-9]+ AS builder$' <<<"$ref"; then
echo "Non-compliant build-specific Red Hat builder tag." >&2
exit 1
fi
if command -v skopeo >/dev/null 2>&1; then
image="$(sed -n '2p' Dockerfile | sed -E 's/^FROM ([^ ]+) AS builder$/\1/')"
skopeo inspect "docker://${image}" >/dev/null
else
echo "Use skopeo or podman to verify the approved image reference." >&2
exit 2
fiRepository: openshift/lightspeed-agentic-operator
Length of output: 310
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- Dockerfile ---'
cat -n Dockerfile
printf '%s\n' '--- Dockerfile-related files ---'
git ls-files | grep -E '(^|/)(Dockerfile|Containerfile)([^/]*)?$' || true
printf '%s\n' '--- Relevant repository policy and image references ---'
rg -n --hidden -S \
'ubi9/go-toolset|catalog\.redhat\.com|registry\.redhat\.io|FROM |floating tag|base image|Dockerfile|Containerfile' \
-g '!vendor/**' -g '!node_modules/**' -g '!dist/**' . | head -300
printf '%s\n' '--- Current change summary ---'
git diff --stat
git diff -- DockerfileRepository: openshift/lightspeed-agentic-operator
Length of output: 9398
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- Container security instructions ---'
sed -n '140,170p' .coderabbit.yaml
printf '%s\n' '--- Dockerfile change metadata ---'
git diff --unified=20 -- Dockerfile
git status --short
git rev-parse HEAD
git rev-parse HEAD^ 2>/dev/null || true
printf '%s\n' '--- Previous and current builder references ---'
printf 'current: '; git show HEAD:Dockerfile | sed -n '2p'
printf 'parent: '; git show HEAD^:Dockerfile 2>/dev/null | sed -n '2p' || true
printf '%s\n' '--- References to builder-stage policy or exceptions ---'
rg -n -i --hidden \
'builder.stage|builder stage|go-toolset|floating tag|floating tags|base image|catalog\.redhat\.com' \
.coderabbit.yaml .ai docs .github 2>/dev/null || trueRepository: openshift/lightspeed-agentic-operator
Length of output: 2486
Use a compliant builder image reference.
registry.redhat.io/ubi9/go-toolset:9.8-1786522985 uses a build-specific tag and is not a UBI minimal or distroless image. Replace it with an approved builder image reference, or document the applicable builder-stage exception.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 2, Update the Dockerfile builder stage’s FROM reference
to an approved UBI minimal or distroless builder image, replacing the
build-specific go-toolset tag; if that image is required, document the
applicable builder-stage exception instead.
Source: Path instructions
160a9c5 to
2123754
Compare
red-hat-konflux
Bot
changed the title
|
New changes are detected. LGTM label has been removed. |
red-hat-konflux
Bot
changed the title
af8280d to
ab3b58e
Compare
red-hat-konflux
Bot
changed the title
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
ab3b58e to
e5f1639
Compare
red-hat-konflux
Bot
changed the title
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@red-hat-konflux[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR contains the following updates:
9.8-1786495588→9.8-1787668499Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.