Update registry.redhat.io/ubi9/go-toolset Docker tag to v9.8-1786351949 - #436
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
added
approved
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe Dockerfile updates the builder stage’s ChangesBuilder Image Update
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
2 similar comments
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 2: Update the Dockerfile builder image reference from the build-specific
go-toolset tag to an approved floating Red Hat tag that supports both
linux/amd64 and linux/arm64, while preserving the existing builder stage.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 091ab658-630d-48ad-9985-797a28acf223
📒 Files selected for processing (1)
Dockerfile
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
| @@ -1,5 +1,5 @@ | |||
| # Build the manager binary | |||
| FROM registry.redhat.io/ubi9/go-toolset:9.8-1786023237 AS builder | |||
| FROM registry.redhat.io/ubi9/go-toolset:9.8-1786351949 AS builder | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
image_ref="$(awk '$1 == "FROM" && $(NF-1) == "AS" && $NF == "builder" { print $2; exit }' Dockerfile)"
tag="${image_ref##*:}"
if [[ "$tag" =~ ^9\.[0-9]+-[0-9]+$ ]]; then
echo "Build-specific Red Hat tag is not allowed: $image_ref" >&2
exit 1
fi
manifest="$(mktemp)"
trap 'rm -f "$manifest"' EXIT
skopeo inspect --raw "docker://${image_ref}" > "$manifest"
jq -e '
([.manifests[]?.platform | "\(.os)/\(.architecture)"]) as $platforms
| ($platforms | index("linux/amd64") != null)
and ($platforms | index("linux/arm64") != null)
' "$manifest" >/dev/nullRepository: openshift/lightspeed-agentic-operator
Length of output: 268
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- Dockerfile ---'
cat -n Dockerfile
printf '%s\n' '--- platform references in Tekton files ---'
rg -n -C 3 'platform|architecture|amd64|arm64|x86_64|linux/' .tekton || true
printf '%s\n' '--- image tag references ---'
rg -n -C 2 'ubi9/go-toolset|go-toolset|1786351949|1\.26' . --glob '!vendor/**' || trueRepository: openshift/lightspeed-agentic-operator
Length of output: 14667
🌐 Web query:
registry.redhat.io/ubi9/go-toolset floating tags 1.26 1786351949 multi-architecture manifest
💡 Result:
The string "1.26 1786351949" in the context of the Red Hat UBI 9 go-toolset refers to a specific container image tag [1][2]. Red Hat UBI (Universal Base Image) container tags for toolsets, such as go-toolset, often follow a structured versioning format: {Tool Version}-{Build/Release ID} or {Platform Version}-{Build/Release ID} [1][3][4]. In the tag you provided, "1.26" indicates the version of the Go Toolset, while "1786351949" is a unique identifier associated with that specific build or release of the image [2][5]. Key points regarding these tags: - Tagging Convention: Red Hat images are frequently updated to incorporate security patches and fixes, which are reflected in the trailing numeric build/release identifier [2][6]. While you may see tags based on the tool version (e.g., 1.26.x-BuildID) [1][2], it is also common to see platform-based tags (e.g., 9.8-BuildID) [3][4]. - Registry Usage: These images are available on both registry.access.redhat.com (no authentication required) and registry.redhat.io (authentication required) [7][8]. It is recommended to pull images using their fully qualified names to ensure consistency [9]. - Multi-architecture Manifests: Red Hat typically publishes container images as multi-architecture manifests, allowing a single tag to resolve to the appropriate image architecture (such as amd64 or arm64) for the environment where it is pulled [1]. To verify the exact contents or architecture of a specific tag, you can inspect the image metadata using tools like skopeo or podman: podman inspect registry.redhat.io/ubi9/go-toolset:1.26-1786351949 [8][9] If you are using this in a Dockerfile or deployment configuration, be aware that these long tags are often updated automatically by dependency management tools [2][5][3]. If you require stability, you may prefer using the image digest (e.g., @sha256:...) instead of the mutable tag [10].
Citations:
- 1: https://catalog.redhat.com/software/containers/ubi9/go-toolset/61e5c00b4ec9945c18787690
- 2: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.5-1787080706 redhat-appstudio/infrastructure#111
- 3: 🚨 Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9 (main) conforma/cli#3375
- 4: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9 kubernetes-sigs-agent-sandbox#154
- 5: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.26.4-1782980183 sandboxed-containers-operator#2379
- 6: chore: update UBI9 base images RedHatInsights/entitlements-api-go#939
- 7: https://access.redhat.com/articles/RegistryAuthentication
- 8: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/building_running_and_managing_containers/working-with-container-registries
- 9: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/building_running_and_managing_containers/working-with-container-registries_building-running-and-managing-containers
- 10: https://access.redhat.com/articles/6138332
🏁 Script executed (no clone):
#!/usr/bin/env bash
set -u
image='registry.redhat.io/ubi9/go-toolset:9.8-1786351949'
for candidate in \
'registry.redhat.io/ubi9/go-toolset:1.26' \
'registry.redhat.io/ubi9/go-toolset:1.26.5' \
'registry.redhat.io/ubi9/go-toolset:latest'
do
echo "--- $candidate ---"
if command -v skopeo >/dev/null 2>&1; then
skopeo inspect --raw "docker://$candidate" 2>&1 | jq -c '
if .manifests then
[.manifests[]?.platform | "\(.os)/\(.architecture)"] | unique
else
{single_image: (.architecture // "unknown")}
end
' || true
else
echo 'skopeo is unavailable'
break
fi
done
echo "--- current reference ---"
if command -v skopeo >/dev/null 2>&1; then
skopeo inspect --raw "docker://$image" 2>&1 | jq -c '
if .manifests then
[.manifests[]?.platform | "\(.os)/\(.architecture)"] | unique
else
{single_image: (.architecture // "unknown")}
end
' || true
fi
Length of output: 221
Use an approved floating Red Hat tag.
registry.redhat.io/ubi9/go-toolset:9.8-1786351949 is a build-specific tag and violates the repository requirement for floating Red Hat tags. Replace it with an approved floating tag that supports linux/amd64 and linux/arm64.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 2, Update the Dockerfile builder image reference from the
build-specific go-toolset tag to an approved floating Red Hat tag that supports
both linux/amd64 and linux/arm64, while preserving the existing builder stage.
Sources: Path instructions, MCP tools
|
@red-hat-konflux[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR contains the following updates:
9.8-1786023237→9.8-1786351949Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.