OCM-00000 | ci: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.4-1782736563#3292
Conversation
red-hat-konflux
Bot
added
the
ok-to-test
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughThree Dockerfiles update the 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Hi @red-hat-konflux[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #3292 +/- ##
=======================================
Coverage 27.02% 27.02%
=======================================
Files 334 334
Lines 36704 36704
=======================================
Hits 9920 9920
Misses 26029 26029
Partials 755 755 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/master/registry.access.redhat.com-ubi9-go-toolset-1.x
branch
from
4bbcb07 to
2a6a25c
Compare
red-hat-konflux
Bot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 1: The builder image version is out of sync with the Go toolchain
declared in go.mod, so update the Dockerfile’s builder stage to match the repo’s
Go version or bump the repository toolchain/CI inputs consistently. Check the
Dockerfile builder FROM line and any related toolchain configuration so the
image tag and declared Go version stay aligned.
In `@images/Dockerfile.e2e`:
- Line 22: The final stage in the Dockerfile is still based on the full
go-toolset image, which should be replaced with a runtime-only base. Update the
image used by the final stage to a UBI minimal or other approved
distroless/runtime image from catalog.redhat.com, and keep only the copied
binaries and runtime utilities there; use the stage name around the final FROM
and the image selection logic as the main points to adjust.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 8044e988-e16b-4daa-bad9-8ef44531dc38
📒 Files selected for processing (3)
Dockerfileimages/Dockerfile.e2eimages/Dockerfile.konflux
| @@ -1,4 +1,4 @@ | |||
| FROM registry.access.redhat.com/ubi9/go-toolset:1.25.8 AS builder | |||
| FROM registry.access.redhat.com/ubi9/go-toolset:1.26.4-1782717933 AS builder | |||
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Toolchain declarations:"
fd -HI '^\.golangciversion$|^go\.mod$|^Dockerfile$' .
echo
if [ -f .golangciversion ]; then
echo ".golangciversion:"
cat .golangciversion
fi
echo
echo "go-toolset references:"
rg -n 'ubi9/go-toolset:' Dockerfile images/Dockerfile.konflux images/Dockerfile.e2e
echo
echo "Recommended validation command:"
echo "make basic-checks"Repository: openshift/rosa
Length of output: 828
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== .golangciversion =="
if [ -f .golangciversion ]; then
cat -n .golangciversion
else
echo "missing"
fi
echo
echo "== go.mod go directive =="
sed -n '1,20p' go.mod | cat -n
echo
echo "== CI/toolchain references =="
rg -n '1\.26\.4|go-toolset|GOLANG|go version|golangciversion|\.golangciversion' .github Makefile .golangciversion go.mod Dockerfile images/Dockerfile.e2e images/Dockerfile.konfluxRepository: openshift/rosa
Length of output: 1829
Align the builder image with the declared Go toolchain. go.mod still says go 1.25.8, so ubi9/go-toolset:1.26.4-1782717933 is out of sync. Update the repo toolchain/CI inputs with this bump, or keep the Dockerfile on 1.25.8.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 1, The builder image version is out of sync with the Go
toolchain declared in go.mod, so update the Dockerfile’s builder stage to match
the repo’s Go version or bump the repository toolchain/CI inputs consistently.
Check the Dockerfile builder FROM line and any related toolchain configuration
so the image tag and declared Go version stay aligned.
Sources: Coding guidelines, Path instructions
| FROM registry.ci.openshift.org/ci/cli-ocm:latest as ocmcli | ||
|
|
||
| FROM registry.access.redhat.com/ubi9/go-toolset:1.25.8 | ||
| FROM registry.access.redhat.com/ubi9/go-toolset:1.26.4-1782717933 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Switch the final stage off go-toolset.
Line 22 keeps the runtime image on the full Go toolchain image even though the rest of this stage only copies prebuilt binaries and installs runtime utilities. That unnecessarily ships compiler/build tooling in the final image and weakens the container security posture.
As per path instructions, "Multi-stage builds; no build tools in final image" and "Base image: UBI minimal or distroless from catalog.redhat.com."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@images/Dockerfile.e2e` at line 22, The final stage in the Dockerfile is still
based on the full go-toolset image, which should be replaced with a runtime-only
base. Update the image used by the final stage to a UBI minimal or other
approved distroless/runtime image from catalog.redhat.com, and keep only the
copied binaries and runtime utilities there; use the stage name around the final
FROM and the image selection logic as the main points to adjust.
Source: Path instructions
…ker tag to v1.26.4-1782736563 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/master/registry.access.redhat.com-ubi9-go-toolset-1.x
branch
from
2a6a25c to
bd184ab
Compare
red-hat-konflux
Bot
changed the title
|
@red-hat-konflux[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: olucasfreitas, red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
red-hat-konflux
Bot
deleted the
konflux/mintmaker/master/registry.access.redhat.com-ubi9-go-toolset-1.x
branch
Merge current master into the revert branch and keep the Dockerfile image tags at 1.25.8 so the branch still restores the pre-#3292 state.
Restore the go-toolset image tags changed in #3292. This returns the build and CI Dockerfiles to their pre-update state.
Restore the go-toolset image tags changed in #3292. This returns the build and CI Dockerfiles to their pre-update state.
1 participant
This PR contains the following updates:
1.25.8→1.26.4-17827365631.25.8→1.26.4-1782736563Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.