Update docker image updates to v1.26.4-1782717933#258
Update docker image updates to v1.26.4-1782717933#258red-hat-konflux-kflux-prd-rh02[bot] wants to merge 1 commit into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR. I'm waiting for a openshift-hyperfleet member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe Dockerfile builder stage base image tag changes from Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Supply chain note (CWE-829, CWE-494): This is a mutable tag bump in a CI/CD build surface. Verify the new Red Hat image tag maps to the expected digest in the Red Hat catalog, and prefer 🚥 Pre-merge checks | ✅ 10 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 3: The builder stage base image is still referenced by a mutable tag, so
update the FROM line in the Dockerfile to use an immutable digest-pinned
reference instead of
registry.access.redhat.com/ubi9/go-toolset:1.26.3-1782377916. Keep the builder
stage name the same, but replace the tag with the corresponding `@sha256`: digest
so the toolchain used by the builder cannot change unexpectedly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 89083f0b-4898-40e7-a35c-970849f15a2f
📒 Files selected for processing (1)
Dockerfile
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual)
| ARG BASE_IMAGE=registry.access.redhat.com/ubi9-micro:latest | ||
|
|
||
| FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3-1781757851 AS builder | ||
| FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3-1782377916 AS builder |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Dockerfile =="
cat -n Dockerfile
echo
echo "== tekton refs =="
rg -n "Dockerfile|go-toolset|ubi9/go-toolset|buildah|kaniko" .tekton .github . 2>/dev/null | head -n 200Repository: openshift-hyperfleet/hyperfleet-api
Length of output: 6385
Pin the builder base image by digest.
registry.access.redhat.com/ubi9/go-toolset:1.26.3-1782377916 is still mutable, so a tag retarget can change the toolchain used to compile this binary under the same commit (CWE-494). Replace it with an immutable @sha256: reference.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 3, The builder stage base image is still referenced by a
mutable tag, so update the FROM line in the Dockerfile to use an immutable
digest-pinned reference instead of
registry.access.redhat.com/ubi9/go-toolset:1.26.3-1782377916. Keep the builder
stage name the same, but replace the tag with the corresponding `@sha256`: digest
so the toolchain used by the builder cannot change unexpectedly.
Source: Path instructions
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
red-hat-konflux-kflux-prd-rh02
Bot
force-pushed
the
konflux/mintmaker/main/docker-image-updates
branch
from
959295f to
db27fba
Compare
red-hat-konflux-kflux-prd-rh02
Bot
changed the title
This PR contains the following updates:
1.26.3-1781757851→1.26.4-1782717933Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.