chore(deps): Update ubi-minimal base image (v0.8)

[simonbaird]

Update ubi-minimal base image to latest digest.

Old digest: sha256:48fa5d8cda7fc00d270d8747c3eaa54ae196f0820d8540074a9c8c61d5e3056f
New digest: sha256:dd334afa72444fa46238fcf9e6bd399245adf746378735348cf84b9dfdca38f1

RPM changes

- gnutls-3.8.10-4.el9_8.x86_64
+ gnutls-3.8.10-8.el9_8.x86_64
- libgcrypt-1.10.0-11.el9.x86_64
+ libgcrypt-1.10.0-13.el9_8.x86_64

Ref: https://redhat.atlassian.net/browse/EC-2076

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 8220890a-ed47-4b34-b1ce-db1323cb6ea2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:58 PM UTC · Completed 2:13 PM UTC
Commit: 87c4a29 · View workflow run →

[qodo-for-conforma]

PR Summary by Qodo

Bump UBI9 ubi-minimal base image digest to v0.8

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Update UBI9 ubi-minimal base image digest for the final runtime stage.
• Keep Dockerfile and Dockerfile.dist in sync with the same pinned digest.
• Pull in updated underlying RPMs (gnutls, libgcrypt) via the new base image.

Diagram

graph TD
  A["CI / docker build"] --> B["Dockerfile"] --> D{{"Red Hat registry"}} --> E["Final image"]
  A --> C["Dockerfile.dist"] --> D

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Centralize base image digest via ARG/template

• ➕ Avoid duplicating the digest across Dockerfile variants
• ➕ Reduces risk of Dockerfile vs Dockerfile.dist drifting
• ➖ Slightly more indirection in the Docker build definitions
• ➖ May require tooling changes if Dockerfile.dist is generated/consumed externally

2. Pin a versioned UBI tag (not :latest) plus digest

• ➕ Prevents accidental jumps in the underlying base across major/minor UBI updates
• ➕ Keeps supply-chain pinning benefits of digest locking
• ➖ Requires periodic tag review when intentionally moving UBI versions
• ➖ May be less flexible if you intentionally want tracking behavior

3. Automate base image updates (Renovate/Dependabot for Docker)

• ➕ Reduces manual effort and keeps security fixes flowing regularly
• ➕ Can standardize PR format, testing, and approval flow
• ➖ Adds automation configuration/maintenance overhead
• ➖ May increase PR volume without good grouping rules

Recommendation: The current approach (pinning the exact ubi-minimal digest) is the right baseline for reproducibility and supply-chain control. Consider (a) avoiding the :latest tag in favor of a versioned UBI tag + digest, and (b) centralizing the digest to prevent the two Dockerfiles from drifting over time.

Files changed (2) +2 / -2

Other (2) +2 / -2

DockerfileUpdate ubi9/ubi-minimal pinned digest for final stage +1/-1

Update ubi9/ubi-minimal pinned digest for final stage

• Replaces the final-stage base image reference with a new ubi9/ubi-minimal digest. This pulls in newer underlying OS/RPM content while preserving reproducibility via digest pinning.

Dockerfile

Dockerfile.distMirror ubi9/ubi-minimal pinned digest update in dist Dockerfile +1/-1

Mirror ubi9/ubi-minimal pinned digest update in dist Dockerfile

• Applies the same ubi9/ubi-minimal digest bump to the distribution Dockerfile variant to keep builds consistent across targets.

Dockerfile.dist

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — Both Dockerfiles are protected infrastructure files requiring human approval. This PR updates the ubi9/ubi-minimal base image digest (bringing in gnutls 3.8.10-8 and libgcrypt 1.10.0-13 security patches), which is a routine and beneficial change. However, no linked issue provides authorization for modifying these protected paths. Human review and approval is always required for protected-path changes.
  Remediation: Obtain explicit human approval for this protected-path change, or link an authorizing issue.

---

Labels: PR modifies Dockerfiles (base image digest update) and is a dependency bump

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.86% <ø> (ø)
generative	18.14% <ø> (ø)
integration	26.99% <ø> (ø)
unit	68.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[robnester-rh]

LGTM

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 8:15 PM UTC · Completed 8:28 PM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3468 — Update ubi-minimal base image (v0.8)

Timeline

1. 2026-08-06 13:56 UTC — Simon Baird opens PR #3468, a 2-file, 2-line change updating the ubi9/ubi-minimal base image digest in Dockerfile and Dockerfile.dist for security patches (gnutls, libgcrypt). The PR body references Jira ticket EC-2076.
2. 2026-08-06 14:13 UTC — The fullsend review agent completes (run 31108399246) with CHANGES_REQUESTED — a single HIGH severity protected-path finding. The agent acknowledged the change was "routine and beneficial" but was structurally prevented from approving by three-layer enforcement (skill instructions, schema validation, post-script). Cost: $1.65.
3. 2026-08-07 20:14 UTC — Human reviewer (robnester-rh) approves with "LGTM". PR merged ~30 hours after the review agent's blocking verdict.

Analysis

The review agent's CHANGES_REQUESTED verdict was a false positive that added friction without value. The agent's own analysis concluded the change was beneficial, and the human reviewer approved without reservations. The severity escalated from MEDIUM to HIGH because GITHUB_ISSUE_URL was empty — the PR referenced Jira ticket EC-2076, but the review agent only recognizes GitHub issue links. At MEDIUM severity, the verdict would have been comment (non-blocking) rather than request-changes (blocking on GitHub). This distinction matters: CHANGES_REQUESTED shows as a blocking red X in merge requirements, while COMMENTED does not.

Existing issue evidence

The broader protected-path over-triggering on mechanical Dockerfile changes is extensively covered by existing issues. This retro provides additional evidence for:

• Refine protected-path policy to allow agent approval for FROM-line-only Dockerfile changes with digest pinning fullsend-ai/fullsend#3675 — "Refine protected-path policy to allow agent approval for FROM-line-only Dockerfile changes with digest pinning" — PR chore(deps): Update ubi-minimal base image (v0.8) #3468 is exactly this pattern: a FROM-line digest swap for security patches.
• Expand protected-path agent-approval exemption to cover single-ARG version bumps in Dockerfiles fullsend-ai/fullsend#3910 — "Expand protected-path agent-approval exemption to cover single-ARG version bumps in Dockerfiles" — same class of mechanical change.
• Review agent should consider PR title when assessing context completeness for protected-path findings fullsend-ai/agents#614 — "Review agent should consider PR title when assessing context completeness for protected-path findings" — the PR title (chore(deps): Update ubi-minimal base image) provided clear context that was not weighed.
• Review agent should use a lightweight path when it classifies a change as trivial/mechanical fullsend-ai/agents#301 — "Review agent should use a lightweight path when it classifies a change as trivial/mechanical" — this 2-line digest swap ran the full multi-agent review pipeline at $1.65.

One novel gap was identified and is proposed below.

Proposals filed

• Review agent should recognize external issue tracker references as authorization context for protected-path severity (in fullsend-ai/agents)