Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.5-1784032128 (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi9/go-toolset	stage	patch	1.26.3 → 1.26.5-1784032128

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 2:06 AM UTC · Ended 2:09 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:12 AM UTC · Completed 2:18 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review

Outcome: Approve

Summary

Automated patch-level update of the Go toolset Docker base image in Dockerfile.dist from registry.access.redhat.com/ubi9/go-toolset:1.26.3 to 1.26.5-1784032128, with the corresponding SHA256 digest updated. This is a standard MintMaker/Renovate dependency bump.

Analysis

Dimension	Assessment
Correctness	✅ Clean single-line change. Tag and digest both updated correctly. FROM syntax (image:tag@digest) is valid and matches existing Dockerfile conventions. No build logic altered.
Security	✅ Patch version bump (1.26.3 → 1.26.5) from the official Red Hat UBI9 registry. Digest pin is present, ensuring reproducible builds and preventing tag mutation attacks. Patch updates typically include security fixes.
Intent & coherence	✅ Automated dependency update from the project's configured MintMaker/Renovate workflow. Change scope is appropriate — single dependency, single file. PR description accurately reflects the code change.
Style & conventions	✅ Follows existing FROM line format and Dockerfile patterns.
Documentation	✅ No documentation impact from a base image version bump.
Cross-repo contracts	✅ No API, schema, or interface changes.

Notes

• The non-dist Dockerfile uses docker.io/library/golang:1.26.3 (upstream Go image for local development) while Dockerfile.dist will now use ubi9/go-toolset:1.26.5-1784032128 (Red Hat image for distribution builds). These are different images from different registries, managed independently — the minor version skew within Go 1.26.x is expected and acceptable.
• No findings above the severity threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile.dist

Previous run

Review — ✅ Approve

Scope: Automated dependency update — registry.access.redhat.com/ubi9/go-toolset Docker base image tag bump from 1.26.3 to 1.26.5-1784032128 in Dockerfile.dist.

Analysis

Dimension	Assessment
Correctness	✅ Single-line change updates both the image tag and its pinned digest. The FROM ... AS build instruction format is preserved. This image is used only in the multi-stage build stage — the runtime image (ubi9/ubi-minimal) is unaffected. The project's go.mod specifies go 1.26.3 as the minimum version; building with Go 1.26.5 is fully compatible.
Security	✅ Digest pinning (@sha256:b471d69d...) is maintained, preventing tag-based supply chain attacks. The patch-level Go version bump (1.26.3 → 1.26.5) likely includes security fixes. Source is the official Red Hat container registry.
Intent & coherence	✅ Standard automated Renovate/MintMaker dependency update, appropriately scoped to a single image. The separate Dockerfile (for local dev) uses docker.io/library/golang:1.26.3 — this is a different image from a different registry with its own update cycle, so the version difference is expected.
Style & conventions	✅ Follows existing tag@sha256:digest convention used throughout the project's Dockerfiles.
Documentation	✅ No documentation changes needed for a base image version bump.
Cross-repo contracts	✅ Build-time only change. No APIs, schemas, or interfaces affected.

Verdict

Clean automated patch-level dependency update with digest pinning preserved. No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile.dist

Previous run (2)

Review

Outcome: Approve ✅

Summary

Automated Docker base image patch version bump for the build stage in Dockerfile.dist. Updates registry.access.redhat.com/ubi9/go-toolset from 1.26.3 to 1.26.5-1784032128 with updated SHA-256 digest pin.

Reviewed dimensions

Dimension	Result
Correctness	✅ No issues — FROM line syntactically valid, digest well-formed (64-char hex), no other files reference this image tag
Security	✅ No issues — trusted Red Hat registry, image pinned by digest, build-stage only (not in runtime image), no secrets or permissions changed
Intent & coherence	✅ Mechanical change — authorization implicit from automated Renovate/MintMaker bot; no architectural impact
Style & conventions	✅ No issues — follows existing image:tag@sha256:digest AS stage pattern
Documentation	✅ No issues — no docs reference the go-toolset version
Cross-repo contracts	⏭ Skipped — no exported interfaces modified

Notes

• The image is used only in the build stage (AS build); the runtime image (ubi9/ubi-minimal) is unchanged
• Both tag and digest are updated together, maintaining supply chain integrity
• This is a Go patch version bump (1.26.3 → 1.26.5) within the same minor series

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile.dist

Previous run (3)

Review — approve

Scope: Docker base image version bump (Dockerfile.dist)

Summary

This PR updates the ubi9/go-toolset build-stage base image in Dockerfile.dist from 1.26.3 to 1.26.5-1783931515, with an updated pinned digest. This is an automated Renovate/MintMaker patch-level dependency update.

Reviewed dimensions

Dimension	Result
Correctness	✅ Go 1.26.5 is backward-compatible with the go 1.26.3 directive in go.mod. Patch releases carry Go's compatibility guarantee.
Security	✅ Image reference is properly pinned by @sha256: digest. No secrets, permission changes, or injection patterns. Source registry (registry.access.redhat.com) is unchanged and trusted.
Intent & coherence	✅ Mechanical change — authorization inferred from automated bot origin and value-only nature.
Style & conventions	✅ FROM line follows the existing tag@sha256:digest pattern.
Documentation	✅ N/A — no code or API changes requiring doc updates.
Cross-repo contracts	✅ N/A — no exported interfaces modified.

No findings above the reporting threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile.dist

Previous run (4)

Review

Outcome: approve

Summary

This is an automated Docker base image tag+digest bump in Dockerfile.dist, updating the Red Hat UBI9 Go toolset build image from 1.26.3 to 1.26.5-1783931515 with an updated SHA256 digest. The change was generated by MintMaker/Renovate (red-hat-konflux[bot]).

Analysis

Correctness — The Dockerfile syntax is valid. The FROM directive maintains the correct tag@sha256:digest pinning format. The SHA256 digest is a well-formed 64-character hex string. Go patch releases are backward compatible, so building with go-toolset 1.26.5 against go 1.26.3 module directives is safe.

Security — No concerns. The image source (registry.access.redhat.com) is Red Hat's official public container registry. The image is properly digest-pinned, preventing tag-based image substitution attacks. The build image is only used in the multi-stage build's build stage — only compiled binaries are copied into the final runtime image, limiting blast radius. No secrets, injection patterns, or permission changes are present.

Intent & Coherence — Authorization is implicit from the mechanical nature of this change (automated dependency version bump). No architectural review required.

Style & Conventions — The changed value follows the same registry/image:tag@sha256:digest pattern as the surrounding context. No deviations.

No findings at or above the reporting threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile.dist

Previous run (5)

Review

Outcome: approve

Summary

Automated Docker base image version bump for the build stage in Dockerfile.dist. The Go toolset image is updated from 1.26.3 to 1.26.5-1783931515 with an updated SHA256 digest pin. This is a mechanical, value-only change generated by the Renovate/MintMaker bot.

Analysis

Dimension	Result
Correctness	✅ Valid FROM syntax, proper SHA256 digest format (64 hex chars), Go 1.26.5 is backward-compatible with 1.26.3
Security	✅ Trusted registry (registry.access.redhat.com), digest-pinned, no permission/secrets changes
Intent & coherence	✅ Mechanical dependency update — authorization implicit from nature of change
Style & conventions	✅ Follows existing image:tag@sha256:digest pattern
Documentation	✅ No docs reference the go-toolset version — no staleness
Cross-repo contracts	⏭ Skipped — no exported interfaces modified

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile.dist

Previous run (6)

Review

Outcome: Approve ✅

Summary

This is an automated Renovate dependency update that bumps the ubi9/go-toolset Docker base image in Dockerfile.dist from 1.26.3 to 1.26.4-1783628461, with an updated digest pin.

Analysis

Dimension	Assessment
Correctness	✅ Single-line tag+digest update. No logic, build script, or configuration changes.
Security	✅ Image remains digest-pinned (@sha256:9748bb...) from Red Hat's official registry (registry.access.redhat.com). Supply chain integrity is preserved.
Compatibility	✅ go.mod specifies go 1.26.3. The Go 1.26.4 toolset is backward-compatible for building 1.26.3-targeting modules — Go's patch-level compatibility guarantees apply.
Scope	✅ Only Dockerfile.dist (the distribution/production Dockerfile) is modified. The development Dockerfile uses a separate docker.io/library/golang image and is not affected.
Documentation	✅ No documentation changes needed for a build image version bump.
Cross-repo contracts	✅ No API, schema, or interface changes.

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile.dist

Previous run (7)

Review

Verdict: ✅ Approve

This is a routine, bot-generated Docker base image tag and digest bump in Dockerfile.dist:

• Image: registry.access.redhat.com/ubi9/go-toolset
• Tag: 1.26.3 → 1.26.4-1783628461
• Digest: Updated from sha256:17c888d... → sha256:9748bb0b...

Analysis

Dimension	Result
Correctness	✅ No issues. The tag update is consistent with the file structure. The separate Dockerfile uses a different base image (docker.io/library/golang:1.26.3) and is not affected by this change.
Security	✅ No issues. Digest pinning is preserved, ensuring image immutability. No secrets, injection patterns, or permission changes.
Intent & coherence	✅ Mechanical change by Renovate bot — scope authorization is implicit.
Style & conventions	✅ Follows existing FROM image:tag@sha256:digest AS stage pattern.
Documentation	✅ No documentation impact — no public API, CLI, or behavioral changes.
Cross-repo contracts	⏭ Skipped — no exported interfaces modified.

No findings at or above the reporting threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile.dist

Previous run (8)

Review — Approve

PR: #3368 — Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.4-1783442369 (main)

Summary

This is an automated MintMaker/Renovate PR that updates the go-toolset base image in Dockerfile.dist from 1.26.3 to 1.26.4-1783442369. The change is a single-line patch-level version bump with the sha256 digest pin properly updated alongside the tag.

Analysis

Dimension	Result
Correctness	✅ Both tag and digest updated together — the standard pattern for digest-pinned images. Go 1.26.4 is a patch release, backward compatible with the go 1.26.3 directive in go.mod.
Security	✅ Digest pinning is maintained, ensuring reproducible builds. Patch updates to the Go toolset typically include security fixes. Image sourced from Red Hat's official registry.
Intent & coherence	✅ Standard automated dependency update from the configured MintMaker bot. Scope is minimal and appropriate.
Style & conventions	✅ The FROM image:tag@sha256:digest format is consistent with the existing Dockerfile pattern.
Documentation	✅ No documentation impact — build-time dependency only.
Cross-repo contracts	✅ No API, schema, or interface changes.

Notes

• Dockerfile (local dev) uses docker.io/library/golang:1.26.3 — a different image managed by a separate Renovate rule. No inconsistency.
• The requires-manual-review label indicates this repo's policy expects human sign-off on dependency updates.

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile.dist

Previous run (9)

Review of #3368

Verdict: ✅ Approve

Summary

Automated Renovate bot update of the ubi9/go-toolset Docker base image in Dockerfile.dist from 1.26.3 to 1.26.4-1783442369 with updated SHA256 digest pinning. This is a mechanical, value-only dependency bump.

Dimensions reviewed

Dimension	Result
Correctness	✅ No findings — tag and digest properly updated together; Go 1.26.4 toolchain is backward-compatible with the project's go 1.26.3 module directive
Security	✅ No findings — digest pinning maintained, no secrets or permission changes
Intent & coherence	✅ Mechanical change — scope authorization implicit from automated dependency update
Style & conventions	✅ No findings — FROM line follows same tag@sha256:digest pattern
Documentation currency	✅ No findings — no behavioral changes requiring doc updates
Cross-repo contracts	⏭ Skipped — no exported interfaces or API surface modified

No findings above the reporting threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile.dist

Previous run (10)

Review

Findings

High

• [protected-path] Dockerfile.dist:19 — This file is under a protected path (Dockerfile). The PR modifies a governance/infrastructure file but has no linked issue justifying the change. While this is an automated Renovate dependency update (go-toolset 1.26.3 → 1.26.4-1782980183 with pinned digest), protected-path changes always require human approval regardless of the change's nature.
  Remediation: A human maintainer must review and approve this protected-path change. Consider linking a tracking issue or policy that authorizes automated Dockerfile base image updates to streamline future Renovate PRs.

Previous run (11)

Review

Findings

High

• [protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which falls under the Dockerfile protected path. The PR has no linked issue providing authorization for the change. While the PR is an automated Renovate/MintMaker dependency update (Docker tag bump from 1.26.3 to 1.26.4-1782980183 with updated digest), and renovate.json is configured in the repository, human approval is always required for protected-path changes.
  Remediation: A maintainer should review and approve this Dockerfile change. No code changes are needed — this is a governance gate, not a code defect.

Previous run (12)

Review

Findings

High

• [protected-path] Dockerfile.dist:19 — This file matches the Dockerfile protected path. The PR modifies a governance/infrastructure file but has no linked issue justifying the change. While the PR is a Renovate-managed Docker image tag bump (go-toolset 1.26.3 → 1.26.4-1782910875) with a pinned digest, human approval is always required for protected-path changes.
  Remediation: Obtain explicit human approval for this Dockerfile change. Consider linking a tracking issue that authorizes Renovate-managed Dockerfile updates.

Previous run (13)

Review

Findings

Medium

• [protected-path] Dockerfile.dist — This file matches a protected path (Dockerfile). The PR is an automated Renovate dependency update bumping the ubi9/go-toolset base image from 1.26.3 to 1.26.4-1782910875 with an updated digest pin. The rationale is clear from the PR description and labels. Human approval is always required for protected-path changes, regardless of context.

Previous run (14)

Review

Findings

High

• [protected-path] Dockerfile.dist:19 — Dockerfile.dist is under the protected path Dockerfile. This PR has no linked issue justifying the modification of governance/infrastructure files. Protected-path changes always require human reviewer approval regardless of the nature of the change.
  Remediation: Link an authorizing issue or obtain explicit human reviewer approval for this protected-path change.

Previous run (15)

Review

Findings

High

• [protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which falls under the Dockerfile protected path. The PR has no linked issue providing authorization for modifying governance/infrastructure files. Human approval is required for all protected-path changes.
  Remediation: Link an issue that authorizes this Dockerfile change, or obtain explicit human maintainer approval.

Previous run (16)

Review

Findings

High

• [protected-path] Dockerfile.dist:19 — This file matches the Dockerfile protected path. The PR modifies a governance/infrastructure file (Dockerfile.dist) but has no linked issue providing authorization or justification for the change. While this is an automated dependency version bump from MintMaker/Renovate, protected-path changes always require human approval regardless of the change's nature.
  Remediation: A maintainer should review and approve this protected-path change. No code changes are needed — this finding is a governance gate, not a code quality issue.

Previous run (17)

Review

Findings

High

• [protected-path] Dockerfile.dist — This file falls under the Dockerfile protected path. The PR has no linked issue providing authorization for changes to governance/infrastructure files. While the change itself is a trivial Docker tag update (1.26.3 → 1.26.3-1782377916) with an unchanged image digest, human approval is always required for protected-path modifications.
  Remediation: Obtain explicit human maintainer approval for this Dockerfile change.

---

Labels: PR modifies a Dockerfile (build infrastructure) and is a dependency version bump

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:00 AM UTC · Completed 2:06 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:12 AM UTC · Completed 2:17 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:05 AM UTC · Completed 2:11 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:04 AM UTC · Completed 2:09 AM UTC
Commit: 47d3320 · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:12 AM UTC · Completed 2:16 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:52 AM UTC · Completed 1:57 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:59 AM UTC · Completed 2:05 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:08 AM UTC · Completed 2:14 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:39 AM UTC · Completed 1:43 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:47 AM UTC · Completed 1:50 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:52 AM UTC · Completed 1:56 AM UTC
Commit: 87c4a29 · View workflow run →