Update docker.io/library/golang Docker tag to v1.27.1 (release-v0.7)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/golang (source)	stage	minor	1.26.7 → 1.27.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: feedb26b-589e-4da6-ba82-c54107946eff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:40 AM UTC · Completed 2:46 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.77

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Single-line Renovate minor bump of the golang base image in a protected, security-sensitive Dockerfile with a clean recent history and no fix/revert churn.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies a file under a protected path (Dockerfile). Protected paths are governance and infrastructure files that always require explicit human approval, regardless of the PR's origin. The PR body provides sufficient context for the change (Renovate-managed minor version bump docker.io/library/golang:1.26.7 → 1.27.1 on the release-v0.7 branch), but human approval is still required for protected-path changes.
  Remediation: A human maintainer must review and approve this base-image bump before merge. Confirm that (a) golang:1.27.1 is the intended target on the release-v0.7 release branch (a Go minor version bump on a release branch may introduce runtime/compiler behavior changes beyond a patch update), and (b) the change is consistent with the repo's Renovate configuration for release branches.

Info

• [provenance-warning] — Prior review context was discarded: provenance validation failed with PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app (a prior review comment exists but was created by a different app than expected, so its authorship cannot be trusted). This review treats all findings as first-time assessments — severity anchoring was skipped for this run.
• [dependency-update] Dockerfile:19 — Renovate classifies 1.26.7 → 1.27.1 as a minor Docker tag update, but for the docker.io/library/golang image this crosses a Go minor version boundary (1.26.x → 1.27.x), which per Go's release policy can include new language features, standard-library additions, compiler/runtime behavior changes, and toolchain updates — not just patch-level fixes. On a release branch (release-v0.7), reviewers may prefer to restrict base-image updates to same-minor patch bumps unless an intentional Go minor upgrade is planned.

Previous run

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is in the protected paths list (governance/infrastructure). Human approval is always required for protected-path changes, regardless of automation. Context is sufficient: the PR body describes a Renovate-generated minor version bump of the golang build-stage base image (1.26.7 → 1.27.0), and renovate.json at the repo root extends the org-wide Renovate config (github>conforma/.github//config/renovate/renovate.json) that authorizes automated Docker tag updates.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:08 AM UTC · Completed 2:13 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.09

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] protected-path

This PR modifies Dockerfile, which is listed in REVIEW_PROTECTED_PATHS. The PR body provides sufficient context (Renovate-generated minor Docker tag bump 1.26.7 → 1.27.1 for docker.io/library/golang on release-v0.7), but human approval is always required for protected-path changes regardless of context.

Suggested fix: A human maintainer must review and approve this base-image bump. Confirm that golang:1.27.1 is the intended target on the release-v0.7 release branch and that the change is consistent with the repo's Renovate configuration for release branches.