chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.8-1782717933#2058
Conversation
… tag to v9.8-1782717933 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
WalkthroughFour Containerfiles update the builder stage base image tag for ChangesBuilder Image Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @red-hat-konflux[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Containerfile.bpfman-agent`:
- Line 4: The bpfman-agent build stage is still pinned to a specific Red Hat
go-toolset revision, which bypasses the intended vendor-managed update flow.
Update the FROM line in the bpfman-agent build stage to use the floating Red Hat
builder tag instead of the explicit revision, keeping the existing stage name
and platform selector intact so the image can receive managed updates
automatically.
In `@Containerfile.bpfman-agent.openshift`:
- Line 6: The builder stage in the Containerfile is pinned to a specific UBI
revision instead of the managed tag. Update the FROM line for the
bpfman-agent-build stage to use the generic
registry.access.redhat.com/ubi9/go-toolset:9.8 tag so it can receive managed
updates, and keep the stage name unchanged.
In `@Containerfile.bpfman-operator`:
- Line 4: The builder stage in Containerfile.bpfman-operator is pinned to a
specific Red Hat image digest/tag, so update the FROM line for the
bpfman-operator-build stage to use the appropriate floating ubi9/go-toolset tag
instead of the fixed 9.8-1782717933 reference, keeping the stage name unchanged
while switching to a Red Hat-managed moving tag.
In `@Containerfile.bpfman-operator.openshift`:
- Line 6: The base image in the bpfman-operator build stage is still
revision-pinned; update the FROM line in Containerfile.bpfman-operator.openshift
to use a floating Red Hat tag instead of the current fixed digest-like tag. Keep
the change localized to the bpfman-operator-build stage and ensure the image
reference follows the existing policy for floating tags so updates continue to
flow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2593aa1d-01d6-4962-9e0e-1da6c34724d2
📒 Files selected for processing (4)
Containerfile.bpfman-agentContainerfile.bpfman-agent.openshiftContainerfile.bpfman-operatorContainerfile.bpfman-operator.openshift
| ARG BUILDPLATFORM | ||
|
|
||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782377916 AS bpfman-agent-build | ||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 AS bpfman-agent-build |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the target file and nearby context.
git ls-files 'Containerfile.bpfman-agent' 'README.md' '**/*Containerfile*' '**/*Dockerfile*' | sed -n '1,200p'
echo '---'
if [ -f Containerfile.bpfman-agent ]; then
nl -ba Containerfile.bpfman-agent | sed -n '1,80p'
fi
echo '---'
# Find any repo guidance about Red Hat image tags or builder images.
rg -n --hidden -S 'floating tag|floating tags|ubi9/go-toolset|registry.access.redhat.com|Containerfile|Dockerfile|Red Hat images' . \
-g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' -g '!**/.git/**'Repository: openshift/bpfman-operator
Length of output: 338
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- Containerfile.bpfman-agent ---'
sed -n '1,40p' Containerfile.bpfman-agent | cat -n
printf '%s\n' '--- Guidance matches ---'
rg -n -S 'floating tags|Red Hat images|registry.access.redhat.com/ubi9/go-toolset|ubi9/go-toolset' README.md .github . -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' -g '!**/.git/**' || trueRepository: openshift/bpfman-operator
Length of output: 3795
Use the floating Red Hat builder tag here. Containerfile.bpfman-agent:4 still pins registry.access.redhat.com/ubi9/go-toolset to a specific revision tag, which bypasses the vendor-managed update flow required for Red Hat images.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.bpfman-agent` at line 4, The bpfman-agent build stage is still
pinned to a specific Red Hat go-toolset revision, which bypasses the intended
vendor-managed update flow. Update the FROM line in the bpfman-agent build stage
to use the floating Red Hat builder tag instead of the explicit revision,
keeping the existing stage name and platform selector intact so the image can
receive managed updates automatically.
Source: Path instructions
| ARG BUILDPLATFORM | ||
|
|
||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782377916 AS bpfman-agent-build | ||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 AS bpfman-agent-build |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== Containerfile.bpfman-agent.openshift (first 40 lines) ==\n'
nl -ba Containerfile.bpfman-agent.openshift | sed -n '1,40p'
printf '\n== Search for ubi9/go-toolset references ==\n'
rg -n "ubi9/go-toolset|registry\.access\.redhat\.com/ubi9/go-toolset|go-toolset" -S .
printf '\n== Search for container image/tag guidance in repo ==\n'
rg -n "floating tags|pin by digest|registry.access.redhat.com|go-toolset" -S README* .github docs . 2>/dev/null || trueRepository: openshift/bpfman-operator
Length of output: 264
🌐 Web query:
Red Hat ubi9/go-toolset floating tag 9.8 registry.access.redhat.com documentation
💡 Result:
The tag 9.8 in registry.access.redhat.com/ubi9/go-toolset is not a traditional mutable floating tag [1][2][3][4]. Instead, Red Hat provides specific versioned tags (such as 9.8) that are regularly updated with new immutable image layers (e.g., 9.8-1780434037) to incorporate security patches and updates [1][3][4]. While users may use the 9.8 tag in their Containerfiles for convenience, it will pull the latest image version currently associated with that specific 9.8 release [3][4]. Because Red Hat frequently pushes updates to these versioned tags, the underlying image content (digest) for the 9.8 tag changes over time [1][3][4]. For production environments where build reproducibility is required, it is highly recommended to pin your image reference to a specific immutable tag (e.g., 9.8-1780434037) or use the image digest (e.g., @sha256:...) to ensure that subsequent builds consistently use the exact same image layers [1][4]. You can verify the latest available versions and digests for UBI-based images by visiting the Red Hat Ecosystem Catalog [5][6].
Citations:
- 1: quay/release-readiness@9c1ae07
- 2: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9 redhat-appstudio/infrastructure#108
- 3: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9.8-1781757851 openshift-pipelines/tektoncd-pruner#805
- 4: konflux-ci/coverport@e72c852
- 5: https://catalog.redhat.com/en/software/containers/ubi9/go-toolset/61e5c00b4ec9945c18787690
- 6: https://catalog.redhat.com/en/software/base-images
Use the managed ubi9/go-toolset:9.8 tag here. Replace the revision-pinned 9.8-1782717933 builder image so this Red Hat base can receive managed updates.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.bpfman-agent.openshift` at line 6, The builder stage in the
Containerfile is pinned to a specific UBI revision instead of the managed tag.
Update the FROM line for the bpfman-agent-build stage to use the generic
registry.access.redhat.com/ubi9/go-toolset:9.8 tag so it can receive managed
updates, and keep the stage name unchanged.
Source: Path instructions
| ARG BUILDPLATFORM | ||
|
|
||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782377916 AS bpfman-operator-build | ||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 AS bpfman-operator-build |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '== file ==\n'
cat -n Containerfile.bpfman-operator | sed -n '1,40p'
printf '\n== related containerfiles ==\n'
git ls-files '*Containerfile*' '*Dockerfile*' | sed -n '1,120p'Repository: openshift/bpfman-operator
Length of output: 2717
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '== ubi9/go-toolset references ==\n'
rg -n 'ubi9/go-toolset|go-toolset' -g 'Containerfile*' -g 'Dockerfile*' .Repository: openshift/bpfman-operator
Length of output: 796
Use a floating Red Hat tag for this builder stage. The registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 pin should be replaced with the appropriate floating tag so this image keeps receiving Red Hat-managed updates.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.bpfman-operator` at line 4, The builder stage in
Containerfile.bpfman-operator is pinned to a specific Red Hat image digest/tag,
so update the FROM line for the bpfman-operator-build stage to use the
appropriate floating ubi9/go-toolset tag instead of the fixed 9.8-1782717933
reference, keeping the stage name unchanged while switching to a Red Hat-managed
moving tag.
Source: Path instructions
| ARG BUILDPLATFORM | ||
|
|
||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782377916 AS bpfman-operator-build | ||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 AS bpfman-operator-build |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Files:\n'
git ls-files '*/Containerfile*' '*/Dockerfile*' | sed -n '1,200p'
printf '\nTarget file excerpt:\n'
nl -ba Containerfile.bpfman-operator.openshift | sed -n '1,40p'
printf '\nRelated Red Hat image usage in repo:\n'
rg -n 'registry\.access\.redhat\.com/ubi9/go-toolset|ubi9/go-toolset|FROM --platform=.*registry\.access\.redhat\.com' -S .Repository: openshift/bpfman-operator
Length of output: 270
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repo root files around policy docs:\n'
git ls-files | rg '(^|/)(README\.md|CONTRIBUTING\.md|docs/|.*policy.*|.*guideline.*|.*container.*)' | sed -n '1,200p'
printf '\nSearch for container guidance text:\n'
rg -n 'floating tags|Red Hat images|build tools in final image|Containerfile|Dockerfile' -S . --glob '!**/node_modules/**' --glob '!**/dist/**' --glob '!**/build/**'Repository: openshift/bpfman-operator
Length of output: 15062
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Containerfiles in repo:\n'
git ls-files | rg '(^|/)(Containerfile|Dockerfile)(\..*)?$' | sort
printf '\nContainerfile.bpfman-operator.openshift (first 30 lines):\n'
sed -n '1,30p' Containerfile.bpfman-operator.openshift | cat -n
printf '\nRelevant OpenShift guidance:\n'
sed -n '1,120p' hack/openshift/README.md | cat -n
printf '\nOther Red Hat image references:\n'
rg -n 'registry\.access\.redhat\.com/.+:[^[:space:]]+' -S Containerfile* hack/openshift README.mdRepository: openshift/bpfman-operator
Length of output: 7517
Use a floating Red Hat tag here. registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 is still revision-pinned; this Containerfile policy calls for floating Red Hat tags so updates continue to flow.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.bpfman-operator.openshift` at line 6, The base image in the
bpfman-operator build stage is still revision-pinned; update the FROM line in
Containerfile.bpfman-operator.openshift to use a floating Red Hat tag instead of
the current fixed digest-like tag. Keep the change localized to the
bpfman-operator-build stage and ensure the image reference follows the existing
policy for floating tags so updates continue to flow.
Source: Path instructions
|
/approve |
openshift-ci
Bot
added
ok-to-test
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: frobware, red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
1 participant
This PR contains the following updates:
9.8-1782377916→9.8-1782717933Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.