chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.8-1782852234#2061
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (3)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughAll four Containerfiles update the Changesgo-toolset base image tag bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @red-hat-konflux[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Containerfile.bpfman-agent`:
- Line 4: The builder stage image in the Containerfile.bpfman-agent is still
pinned to a specific UBI build, which will keep causing tag churn. Update the
FROM reference for the bpfman-agent-build stage to use the floating Red Hat UBI
9.8 tag instead of the fixed build-specific tag so it inherits Red Hat-managed
updates.
In `@Containerfile.bpfman-agent.openshift`:
- Line 6: The builder stage in the Containerfile is pinned to a specific UBI
build, which conflicts with the Red Hat base-image policy. Update the
bpfman-agent-build FROM image to use the floating 9.8 tag instead of the fixed
9.8-1782736563 release so Red Hat-managed updates can flow automatically.
In `@Containerfile.bpfman-operator`:
- Line 4: The builder stage in the Containerfile is still pinned to a specific
Red Hat build, so update the bpfman-operator build image reference to use the
floating ubi9/go-toolset 9.8 tag instead of the fixed build-specific tag. Keep
the existing build stage name and platform qualifier intact, and adjust only the
image tag so the builder follows Red Hat’s floating-tag policy.
In `@Containerfile.bpfman-operator.openshift`:
- Line 6: The builder stage is pinned to a fixed Red Hat UBI build tag, which
violates the container policy for RH images. Update the FROM line in the
bpfman-operator build stage to use the floating 9.8 tag instead of the versioned
build tag, keeping the existing stage name and platform handling intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: cb83c511-1caf-4578-8600-45e875d14c6e
📒 Files selected for processing (4)
Containerfile.bpfman-agentContainerfile.bpfman-agent.openshiftContainerfile.bpfman-operatorContainerfile.bpfman-operator.openshift
| ARG BUILDPLATFORM | ||
|
|
||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 AS bpfman-agent-build | ||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-agent-build |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Use the floating UBI tag for the builder stage.
Line 4 still pins a Red Hat image to a specific build, so this dependency-bump PR will keep generating tag-churn instead of inheriting Red Hat-managed updates. Switch this to the floating 9.8 tag.
Suggested change
-FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-agent-build
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8 AS bpfman-agent-buildAs per path instructions, Red Hat images: use floating tags (Red Hat manages updates).
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-agent-build | |
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8 AS bpfman-agent-build |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.bpfman-agent` at line 4, The builder stage image in the
Containerfile.bpfman-agent is still pinned to a specific UBI build, which will
keep causing tag churn. Update the FROM reference for the bpfman-agent-build
stage to use the floating Red Hat UBI 9.8 tag instead of the fixed
build-specific tag so it inherits Red Hat-managed updates.
Source: Path instructions
| ARG BUILDPLATFORM | ||
|
|
||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 AS bpfman-agent-build | ||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-agent-build |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Use the floating UBI tag for the builder stage.
Line 6 keeps the Red Hat builder image pinned to a specific build, which conflicts with the container policy and defeats Red Hat-managed base-image updates. Use the floating 9.8 tag here as well.
Suggested change
-FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-agent-build
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8 AS bpfman-agent-buildAs per path instructions, Red Hat images: use floating tags (Red Hat manages updates).
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-agent-build | |
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8 AS bpfman-agent-build |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.bpfman-agent.openshift` at line 6, The builder stage in the
Containerfile is pinned to a specific UBI build, which conflicts with the Red
Hat base-image policy. Update the bpfman-agent-build FROM image to use the
floating 9.8 tag instead of the fixed 9.8-1782736563 release so Red Hat-managed
updates can flow automatically.
Source: Path instructions
| ARG BUILDPLATFORM | ||
|
|
||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 AS bpfman-operator-build | ||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-operator-build |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Use the floating UBI tag for the builder stage.
Line 4 is still pinned to a specific Red Hat build, so this update preserves the policy violation rather than fixing it. Please switch the builder image to the floating 9.8 tag.
Suggested change
-FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-operator-build
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8 AS bpfman-operator-buildAs per path instructions, Red Hat images: use floating tags (Red Hat manages updates).
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-operator-build | |
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8 AS bpfman-operator-build |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.bpfman-operator` at line 4, The builder stage in the
Containerfile is still pinned to a specific Red Hat build, so update the
bpfman-operator build image reference to use the floating ubi9/go-toolset 9.8
tag instead of the fixed build-specific tag. Keep the existing build stage name
and platform qualifier intact, and adjust only the image tag so the builder
follows Red Hat’s floating-tag policy.
Source: Path instructions
| ARG BUILDPLATFORM | ||
|
|
||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 AS bpfman-operator-build | ||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-operator-build |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Use the floating UBI tag for the builder stage.
Line 6 keeps the builder on a fixed Red Hat build tag, which is explicitly disallowed by the container policy for RH images. Switching to the floating 9.8 tag avoids recurring version-bump PRs for managed rebuilds.
Suggested change
-FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-operator-build
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8 AS bpfman-operator-buildAs per path instructions, Red Hat images: use floating tags (Red Hat manages updates).
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS bpfman-operator-build | |
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8 AS bpfman-operator-build |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.bpfman-operator.openshift` at line 6, The builder stage is
pinned to a fixed Red Hat UBI build tag, which violates the container policy for
RH images. Update the FROM line in the bpfman-operator build stage to use the
floating 9.8 tag instead of the versioned build tag, keeping the existing stage
name and platform handling intact.
Source: Path instructions
|
/ok-to-test |
openshift-ci
Bot
added
ok-to-test
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/registry.access.redhat.com-ubi9-go-toolset-9.x
branch
from
fdc8ced to
3e61aae
Compare
openshift-ci
Bot
removed
the
needs-rebase
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Containerfile.bpfman-operator.openshift`:
- Line 10: The verification stage is copying the entire repository, which breaks
the container policy and bloats the layer cache. Update the new stage to copy
only the minimal inputs needed for running ./test/integration/... instead of
using COPY . ., and keep the change localized to the verification stage setup in
the Containerfile.bpfman-operator.openshift.
- Line 11: The `go test -c` step is too broad because `./test/integration/...`
expands to multiple packages, making the single `-o /dev/null` output brittle.
Narrow the invocation in the `RUN` step to one package under the integration
test path, or adjust the `go test` command so each package produced by
`test/integration` and `test/integration/loadimagearchive` writes its binary to
a separate temporary location.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 524395f7-1282-4978-8ee7-f2e642ab3d89
📒 Files selected for processing (4)
Containerfile.bpfman-agentContainerfile.bpfman-agent.openshiftContainerfile.bpfman-operatorContainerfile.bpfman-operator.openshift
✅ Files skipped from review due to trivial changes (1)
- Containerfile.bpfman-agent.openshift
🚧 Files skipped from review as they are similar to previous changes (2)
- Containerfile.bpfman-agent
- Containerfile.bpfman-operator
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782717933 AS verify-test | ||
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS verify-test | ||
| WORKDIR /usr/src/bpfman-operator | ||
| COPY . . |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Avoid copying the full repository into the verification stage.
Line 10 adds COPY . . to a new stage, which violates the container policy and unnecessarily broadens what lands in build layers/cache. Copy only the files and directories needed for ./test/integration/.... As per path instructions, COPY specific files, not entire context.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.bpfman-operator.openshift` at line 10, The verification stage
is copying the entire repository, which breaks the container policy and bloats
the layer cache. Update the new stage to copy only the minimal inputs needed for
running ./test/integration/... instead of using COPY . ., and keep the change
localized to the verification stage setup in the
Containerfile.bpfman-operator.openshift.
Source: Path instructions
| FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:9.8-1782736563 AS verify-test | ||
| WORKDIR /usr/src/bpfman-operator | ||
| COPY . . | ||
| RUN go test -mod vendor -tags=integration_tests -c -o /dev/null ./test/integration/... && touch /tmp/verify-test.done |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Go package directories under test/integration:"
fd -t f -e go . test/integration | xargs -r -n1 dirname | sort -u
echo
count="$(fd -t f -e go . test/integration | xargs -r -n1 dirname | sort -u | wc -l | tr -d ' ')"
echo "Unique package dirs: ${count}"
if [ "${count}" -gt 1 ]; then
echo "WARNING: multiple package directories detected; 'go test -c -o /dev/null ./test/integration/...' is likely fragile."
fiRepository: openshift/bpfman-operator
Length of output: 401
Narrow the go test -c invocation ./test/integration/... expands to both test/integration and test/integration/loadimagearchive, so -c -o /dev/null is brittle here. Restrict it to a single package or write each binary to its own temp directory.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.bpfman-operator.openshift` at line 11, The `go test -c` step is
too broad because `./test/integration/...` expands to multiple packages, making
the single `-o /dev/null` output brittle. Narrow the invocation in the `RUN`
step to one package under the integration test path, or adjust the `go test`
command so each package produced by `test/integration` and
`test/integration/loadimagearchive` writes its binary to a separate temporary
location.
… tag to v9.8-1782852234 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/registry.access.redhat.com-ubi9-go-toolset-9.x
branch
from
3e61aae to
a9b870a
Compare
red-hat-konflux
Bot
changed the title
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: alebedev87, red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
red-hat-konflux
Bot
deleted the
konflux/mintmaker/main/registry.access.redhat.com-ubi9-go-toolset-9.x
branch
1 participant
This PR contains the following updates:
9.8-1782717933→9.8-1782852234Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.
Summary by CodeRabbit