Update docker.io/library/golang Docker tag to v1.26.4 (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change	Pending
docker.io/library/golang	stage	patch	1.26.3 → 1.26.4	1.26.5

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:08 AM UTC · Completed 1:15 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review — ✅ Approve

Scope: Automated patch version bump of the docker.io/library/golang Docker base image from 1.26.3 to 1.26.4 in Dockerfile.

Analysis

Dimension	Assessment
Correctness	Single-line base image tag bump. Go patch versions are backward compatible; building with Go 1.26.4 while go.mod specifies go 1.26.3 is fully supported. No logic changes.
Security	Patch updates typically include security and bug fixes — this update is beneficial.
Intent & coherence	Properly scoped automated Renovate update. Other version references (go.mod, .tool-versions, Dockerfile.dist) use different package managers or images (ubi9/go-toolset) and are managed by separate Renovate rules. No consistency issue.
Style	Matches existing Dockerfile conventions (full docker.io/library/ prefix, tag-only versioning).
Documentation	No documentation changes required.
Cross-repo contracts	Not applicable — no API or schema changes.

Notes

• The Dockerfile is the only file referencing docker.io/library/golang — no other files were missed.
• Dockerfile.dist uses a different base image (ubi9/go-toolset) with its own digest pin, managed separately.
• The go.mod files specify the Go language version directive, not the Docker image version — these are independently managed and the slight version difference is expected and safe.

No findings. Safe to merge.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run

Review of #3372 — Update docker.io/library/golang Docker tag to v1.26.5

Verdict: ✅ Approve

Summary

This is an automated patch version bump of the Go Docker build image from 1.26.3 to 1.26.5, generated by MintMaker/Renovate. The change modifies a single line in the Dockerfile.

Dimensions reviewed

Dimension	Findings
Correctness	✅ No issues — patch bump is compatible with go.mod minimum version (go 1.26.3 ≤ 1.26.5)
Security	✅ No issues — no secrets, injection vectors, auth/permission changes
Intent & coherence	✅ Mechanical dependency update; authorization implicit
Style & conventions	✅ Change follows existing Dockerfile patterns
Documentation currency	✅ No documentation references the Go version
Cross-repo contracts	✅ No exported interfaces or API surfaces modified

Notes

• The Go version in go.mod (1.26.3) is a minimum version directive and is compatible with the updated Docker image (1.26.5). Renovate typically updates these independently.
• The build stage uses a tag without a digest pin, while the final stage (ubi9/ubi-minimal) is digest-pinned. This is a pre-existing pattern, not introduced by this PR.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (2)

Review

Outcome: Approve

This PR is an automated Renovate/MintMaker dependency update that bumps the Go build image in Dockerfile from golang:1.26.3 to golang:1.26.5 (patch version).

Dimensions evaluated

Dimension	Result
Correctness	✅ No concerns — patch bump is backward-compatible with go.mod go 1.26.3 directive
Security	✅ No concerns — no secrets, injection vectors, or permission changes
Intent & coherence	✅ Mechanical dependency update, authorization implicit
Style & conventions	✅ Change follows existing Dockerfile patterns
Documentation currency	✅ No staleness — no new symbols, flags, or behavioral changes
Cross-repo contracts	⏭ Skipped — no exported interfaces modified

No findings at or above the reporting threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (3)

Review

Outcome: Approve

Summary

Mechanical patch-version bump of the Go build image from golang:1.26.3 to golang:1.26.4 in Dockerfile, generated by MintMaker/Renovate. The change is a single-line value substitution that follows the existing pattern. No logic, security, API, or documentation concerns.

Findings

Severity	Category	File	Description
low	version-consistency	Dockerfile:19	The Dockerfile is bumped to golang:1.26.4, while Dockerfile.dist still uses go-toolset:1.26.3, and go.mod / .tool-versions also reference 1.26.3. For a Go patch release this is benign — go.mod's go directive is a minimum-version floor, and Renovate manages each dependency independently. No action needed on this PR; the other files will be updated by their own Renovate PRs.

Dimensions evaluated

• Correctness: No logic, edge-case, or test-integrity concerns. The only observation is the expected cross-file version skew noted above.
• Security: No secrets, injection patterns, permission changes, or supply-chain concerns introduced. The mutable tag (no digest pin) on the golang build image is a pre-existing pattern not introduced by this PR.
• Intent & coherence: Mechanical dependency bump by an automated bot. Authorization is implicit from the change's nature.
• Style & conventions: Value-only change follows existing Dockerfile pattern exactly.
• Documentation currency: No documentation impact.
• Cross-repo contracts: No exported interfaces or APIs modified.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

---

Labels: PR already has appropriate labels (dependencies, docker, renovate); adding go label since this is a Go compiler version bump.

Previous run (4)

Review of #3372 — Update docker.io/library/golang Docker tag to v1.26.4

Verdict: Approve ✅

Summary

This is a routine Renovate-automated patch version bump of the Go build image in Dockerfile, from golang:1.26.3 to golang:1.26.4. The change is a single-line tag update — no code, logic, or configuration changes.

Analysis

Dimension	Result
Correctness	✅ Tag format is consistent. Single-line change with no behavioral impact.
Security	✅ Go patch releases typically include security fixes — this is a positive change.
Intent & scope	✅ Appropriately scoped to Dockerfile only. Dockerfile.dist uses a different base image (ubi9/go-toolset) from a different registry and is managed separately.
Style/conventions	✅ Follows existing Renovate update patterns in this repo.
Documentation	✅ No documentation changes needed.

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (5)

Review — #3372

Verdict: ✅ Approve

Summary

This is a single-line, automated patch version bump of the Go build image in Dockerfile from golang:1.26.3 to golang:1.26.4, generated by MintMaker/Renovate. The change is mechanically correct and introduces no logic, security, style, or documentation concerns.

Dimension Results

Dimension	Result	Notes
Correctness	✅ Pass (2 low)	Version skew with other Go version references is expected with separate Renovate rules
Security	✅ Pass	No secrets, injection vectors, or permission changes
Intent & Coherence	✅ Pass	Mechanical dependency bump; authorization implicit
Style & Conventions	✅ Pass	Value-only change follows existing pattern
Documentation	✅ Pass	No public symbols or behavioral changes
Cross-repo Contracts	⏭ Skipped	No exported interfaces modified

Low-severity Observations

1. Go version skew — Dockerfile.dist (Dockerfile, line 19): This PR bumps Dockerfile to Go 1.26.4 while Dockerfile.dist still uses ubi9/go-toolset:1.26.3 (pinned by digest). These are different base images managed by separate Renovate rules, so the temporary skew is expected and will resolve when the go-toolset:1.26.4 image is published and picked up.

2. Go version skew — go.mod / .tool-versions (Dockerfile, line 19): Several files (.tool-versions, go.mod, tools/go.mod, tools/kubectl/go.mod, acceptance/go.mod) still reference Go 1.26.3. These are managed independently and the patch-level discrepancy is benign for Go's compatibility guarantees.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (6)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected infrastructure file requiring human approval. The PR has no linked issue providing authorization for the change. While the PR is a Renovate-managed patch bump of the Go base image (1.26.3 → 1.26.4), protected-path changes always require explicit human review and approval regardless of the change's nature.
  Remediation: A human reviewer with infrastructure approval authority should verify and approve this Dockerfile change.

Previous run (7)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is a protected path requiring human approval. The PR is an automated Renovate dependency update (golang 1.26.3 → 1.26.4) with a clear rationale in the PR body, but human review is always required for changes to governance and infrastructure files regardless of context.

---

Labels: PR modifies the Dockerfile to bump a dependency version.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:39 AM UTC · Completed 1:44 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:49 AM UTC · Completed 1:54 AM UTC
Commit: 7c8ccca · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:39 AM UTC · Completed 1:42 AM UTC
Commit: 8f05d87 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:33 AM UTC · Completed 1:38 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:36 AM UTC · Completed 1:41 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:31 AM UTC · Completed 1:36 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:23 AM UTC · Completed 1:27 AM UTC
Commit: 87c4a29 · View workflow run →