chore(deps): Update ubi-minimal base image (main)

[simonbaird]

Update ubi-minimal base image to latest digest.

Old digest: sha256:48fa5d8cda7fc00d270d8747c3eaa54ae196f0820d8540074a9c8c61d5e3056f
New digest: sha256:dd334afa72444fa46238fcf9e6bd399245adf746378735348cf84b9dfdca38f1

RPM changes

- gnutls-3.8.10-4.el9_8.x86_64
+ gnutls-3.8.10-8.el9_8.x86_64
- libgcrypt-1.10.0-11.el9.x86_64
+ libgcrypt-1.10.0-13.el9_8.x86_64

Ref: https://redhat.atlassian.net/browse/EC-2076

[coderabbitai]

📝 Walkthrough

Walkthrough

The change updates pinned UBI minimal base image digests in the production, distribution, and Kubernetes acceptance Dockerfiles. Build steps, copied binaries, user configuration, and entrypoints remain unchanged.

Changes

Container base images

Layer / File(s)	Summary
Update pinned image digests Dockerfile, Dockerfile.dist, acceptance/kubernetes/kind/acceptance.Dockerfile	The final image stages use updated pinned UBI minimal image digests. Acceptance image configuration also uses the updated digest.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the dependency update to the UBI Minimal base image.
Description check	✅ Passed	The description explains the image update, lists RPM changes, and links the related ticket, covering the template requirements.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:58 PM UTC · Completed 2:07 PM UTC
Commit: 87c4a29 · View workflow run →

[qodo-for-conforma]

PR Summary by Qodo

Update UBI9 ubi-minimal base image digest across Docker build targets

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Bump UBI9 ubi-minimal base image to the latest pinned digest.
• Apply the same digest update to production, dist, and acceptance Dockerfiles.
• Pull in updated RPMs from the refreshed base image (gnutls, libgcrypt).

Diagram

graph TD
  B["Container build"] --> D1["Dockerfile"] --> R{{"Red Hat registry"}}
  B --> D2["Dockerfile.dist"] --> R
  B --> D3["acceptance.Dockerfile"] --> R

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Centralize the base image digest

• ➕ Single source of truth for the digest across all Dockerfiles
• ➕ Reduces risk of future drift between production/dist/acceptance images
• ➖ Dockerfiles don't support true includes; may require templating, build args, or generation step
• ➖ Adds a bit of build/release process complexity

2. Automate digest bumps (e.g., Renovate/Dependabot for Docker)

• ➕ Regular, low-touch security/patch updates
• ➕ Consistent PR formatting and cadence
• ➖ Additional bot configuration and noise if update frequency is high
• ➖ Still requires human validation for runtime compatibility

Recommendation: The PR’s direct pinned-digest update is the simplest and safest immediate approach. If these bumps are frequent, consider centralizing the digest (or using an update bot) to avoid keeping multiple Dockerfiles in sync by hand.

Files changed (3) +3 / -3

Other (3) +3 / -3

DockerfileBump ubi9/ubi-minimal pinned digest for final image stage +1/-1

Bump ubi9/ubi-minimal pinned digest for final image stage

• Updates the final-stage base image reference to a new UBI9 ubi-minimal digest. This pulls in the latest base-layer security and RPM updates while keeping the image pinned for reproducibility.

Dockerfile

Dockerfile.distAlign dist image with new ubi9/ubi-minimal digest +1/-1

Align dist image with new ubi9/ubi-minimal digest

• Updates the dist Dockerfile to use the same new pinned ubi-minimal digest as the primary build. Keeps production and distribution images consistent.

Dockerfile.dist

acceptance.DockerfileUpdate acceptance test base image digest +1/-1

Update acceptance test base image digest

• Moves the acceptance-test container base image to the new UBI9 ubi-minimal digest. Ensures the test environment tracks the same updated OS layer as the primary image family.

acceptance/kubernetes/kind/acceptance.Dockerfile

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — This PR modifies protected governance/infrastructure files (Dockerfile and Dockerfile.dist). The PR has no linked issue providing authorization context for these changes. Protected-path changes always require human approval.
  Remediation: Link a tracking issue or provide explicit justification for the protected-path changes. A human reviewer must approve changes to Dockerfiles.

---

Labels: PR modifies Dockerfiles and updates base image dependency

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.41% <ø> (+<0.01%)	⬆️
generative	16.36% <ø> (ø)
integration	27.58% <ø> (ø)
unit	71.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[robnester-rh]

LGTM

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 8:15 PM UTC · Completed 8:26 PM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3469 — chore(deps): Update ubi-minimal base image

What happened

PR #3469 was a trivial, human-authored dependency update by simonbaird: a single base image digest bump across 3 Dockerfiles (3 lines changed), pulling in updated gnutls and libgcrypt RPM security patches. The PR referenced an external Jira ticket (EC-2076) but had no linked GitHub issue.

Timeline:

• Aug 6, 13:57 UTC — PR opened
• Aug 6, 14:07 UTC — Review agent (run 31108452255) submitted CHANGES_REQUESTED with a single HIGH-severity [protected-path] finding: Dockerfiles are protected infrastructure files and no linked GitHub issue was found
• Aug 7, 20:14 UTC — Human reviewer (robnester-rh) approved with "LGTM", overriding the agent's finding
• Aug 7, 20:14 UTC — PR merged (~30 hours after the agent review)

Assessment

The review agent behaved correctly per its current rules: it identified the Dockerfile changes as protected paths, noted the absence of a linked GitHub issue, and flagged accordingly. It even acknowledged internally that the change was "mechanical" and "low-risk" but could not approve because the protected-path policy doesn't distinguish mechanical digest bumps from substantive governance changes. The agent dispatched correctness, style, and security sub-agents — all found zero issues.

The human override was appropriate. This is a textbook false positive: a zero-risk mechanical change blocked by an overly rigid policy gate, adding ~30 hours of latency.

Existing issue coverage

All improvement themes from this retro are already extensively covered by open issues in fullsend-ai/fullsend. No new proposals are warranted. This retro adds evidence for these existing issues:

• #2076 — Review agent should recognize external issue tracker references (e.g., Jira URLs) as valid authorization. This PR referenced Jira ticket EC-2076 but the agent treated it as having no linked issue.
• #4387 — Allow conditional protected-path exceptions for trusted version-only dependency bumps. This PR is another instance of a zero-risk digest bump blocked by the protected-path gate.
• #5370 — Protected-path policy should distinguish mechanical version bumps from governance changes. The agent's own sub-agents confirmed zero findings, yet the policy forced CHANGES_REQUESTED.
• #1551 — Downgrade protected-path severity for human-authored PRs. Unlike many similar cases that involve bot PRs, this was human-authored — existing proposals focused on bot-authored exemptions would not cover it.
• #5817 — Meta-issue noting 22+ overlapping "skip agent dispatch" issues need consolidation, which would help address the systemic pattern this retro illustrates.

Workflow quality

The workflow operated as designed — no failures, no wasted agent runs, no unnecessary re-reviews. The review agent ran once (~9 minutes), correctly classified the change, and deferred to human judgment. The only improvement opportunity is in the policy layer (protected-path rules), which is already being tracked upstream.