[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/golang (source)	stage	minor	1.26.7 → 1.27.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:45 AM UTC · Completed 2:52 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected infrastructure file. The PR has no linked issue providing authorization for this change. While this is an automated Renovate dependency update (golang 1.26.7 → 1.27.4 with digest pinning) and the image reference remains properly digest-pinned, human approval is always required for protected-path changes.
  Remediation: Link to an authorizing issue or obtain explicit human approval for this protected-path change.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is a protected path requiring human approval. The PR has no linked issue providing justification for modifying governance or infrastructure files.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (2)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected path. The PR has no linked issue justifying the change to governance/infrastructure files. Human approval is always required for protected-path changes, regardless of context.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (3)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is a protected path requiring human approval. The PR has no linked issue providing authorization for the change. While this appears to be a routine Renovate bot dependency update (golang 1.26.7 → 1.27.3 with updated SHA256 digest), human review and approval is required for all protected-path changes.
  Remediation: Link an issue authorizing this Dockerfile change, or obtain explicit human reviewer approval for the protected-path modification.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (4)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is a protected path requiring human approval. The PR has no linked issue providing justification for modifying governance or infrastructure files. Human review is required for protected-path changes regardless of context.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (5)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected path requiring human approval. The PR has no linked issue providing justification for modifying this governance/infrastructure file. Human review and approval is required regardless of the change's nature.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (6)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is on the active protected-paths list. The PR description explains the change (automated Renovate minor-version bump of docker.io/library/golang from 1.26.7 to 1.27.3, with the digest updated to match), but no linked issue was found authorizing the change to a governance/infrastructure file. Changes to protected paths require explicit human authorization — the automated-bot rationale alone does not substitute for human approval.
  Remediation: Link an issue, ADR, or policy entry that authorizes Renovate to modify Dockerfile (e.g., a dependency-automation policy document), and request explicit human approval before merge.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (7)

Review

Reason: stale-head

The review agent reviewed commit 3b0ec3bc946f4937770cfd41aff3f1fa5dc0d34b but the PR HEAD is now 0d83fd1bfb2d8b62e34cbdd96b05fd4ad734a724. This review was discarded to avoid approving unreviewed code.

Previous run (8)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is on the active protected-paths list (governance/infrastructure). The PR has no linked issue justifying the change, so protected-path context is insufficient. Human approval and explicit authorization are required for governance/infrastructure file changes, regardless of whether the modification itself is a routine Renovate base-image bump.
  Remediation: Link to a tracking issue or add a rationale in the PR body explaining why this governance file is being changed. Note that this is a Renovate/MintMaker automation PR; the maintainers must still approve each Dockerfile change.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (9)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is on the protected paths list for this repository (governance / infrastructure). The PR has no linked issue, so authorization context is insufficient under the protected-path rules. Human reviewer approval is required before this change can land.
  Remediation: A human reviewer must approve this change. If the repository's renovate.json configuration authorizes routine Go base-image updates by red-hat-konflux[bot], note that in review before merging; otherwise link to an authorizing issue.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (10)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is on the active governance/infrastructure protected-paths list, but has no linked issue or ADR authorizing the change. The PR description explains the mechanical content (Renovate minor-version bump of docker.io/library/golang from 1.26.7 to 1.27.2, with a corresponding SHA256 digest), but no tracking issue, ADR, or human-approval reference accompanies the modification to a protected build-infrastructure file.
  Remediation: Link a tracking issue (or ADR / approval reference) authorizing updates to the build Dockerfile, or obtain explicit human-reviewer sign-off before merging.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (11)

Review

Findings

Medium

• [protected-path] Dockerfile — The PR modifies Dockerfile, which is listed as a protected path in REVIEW_PROTECTED_PATHS. Human approval is always required for protected-path changes, regardless of context. The PR body explains the change (Renovate bot bump of docker.io/library/golang from 1.26.7 to 1.27.2) and the repository's renovate.json pre-authorizes Renovate to maintain dependency pins, so context is sufficient — this notice exists to surface the protected-path change to a human reviewer.
  Remediation: A human reviewer must approve this change to the Dockerfile protected path.

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (12)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is on the repository's protected-paths list (governance / infrastructure files that require human approval). The PR has no linked issue to justify the change beyond the Renovate-generated description. Human review is required for every protected-path modification regardless of how routine the change appears.
  Remediation: Confirm a human reviewer has verified the base-image bump (docker.io/library/golang:1.26.7 → 1.27.2, pinned digest sha256:5bc7f572bbaa98885a3a1fd9c0aa76b59e3e14e8628bfc316bbfd0c701e4818c) is a legitimate upstream Go release and matches the Renovate rule set for this repo before merging.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (13)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR is a Renovate-managed golang base image tag bump (1.26.7 → 1.27.1) touching Dockerfile, which is on the protected-paths list. The change itself is mechanical and well-formed: valid pinned sha256: digest, same FROM ... AS build format as the surrounding context, trusted automated author red-hat-konflux[bot] acting through the repo's renovate.json (which extends github>conforma/.github//config/renovate/renovate.json). Regardless of authorization context, human approval is always required for protected-path changes.
  Remediation: Human reviewer confirms the golang 1.27.1 bump is acceptable. Related manifests (Dockerfile.dist, go.mod, .tool-versions) remain on earlier versions and will be updated by separate Renovate PRs on their own cadence — that inconsistency is expected Renovate behavior, not a defect of this PR.

No correctness, security, style, or documentation findings above the configured severity threshold.

Previous run (14)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR is a Renovate-managed golang base image tag bump (1.26.7 → 1.27.1) touching Dockerfile, which is on the protected-paths list. The change itself is mechanical and well-formed (valid sha256: digest, format matches surrounding context, trusted automated author red-hat-konflux[bot] acting through the renovate.json policy). Regardless of authorization context, human approval is always required for protected-path changes.
  Remediation: Human reviewer confirms the golang 1.27.1 bump is acceptable. Related manifests (go.mod, .tool-versions, Dockerfile.dist) remain on 1.26.7 and will be updated by separate Renovate PRs on their own cadence — the inconsistency with those files is expected Renovate behavior, not a defect of this PR.

No correctness, security, style, or documentation findings above the configured severity threshold.

Previous run (15)

Review

Findings

Info

• [protected-path] Dockerfile — This PR modifies a protected path (Dockerfile). Human approval is always required for protected-path changes, regardless of context. Note: intent-coherence identifies this as a mechanical Renovate bot dependency bump (golang 1.26.7 → 1.27.1), and the repo's renovate.json authorizes automated dependency bumps.
• [scope-authorization-implicit] N/A — Authorization inferred from mechanical nature of change (Docker base image version/digest bump by Renovate bot). No architectural review required.
• [provenance-warning] N/A — Prior review context discarded: provenance validation failed (unverifiable-wrong-app). This review treats all findings as first-time assessments; severity anchoring was skipped for this run.

Previous run (16)

Review

Reason: stale-head

The review agent reviewed commit a65a109ba5e1605c4e42ed419edcee2d14f33b90 but the PR HEAD is now 64d307409d15bab965337b0e0d6cae151b152e10. This review was discarded to avoid approving unreviewed code.

Previous run (17)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is on the repository's protected-paths list. Human approval is always required for changes to governance and infrastructure files, regardless of context. The change is a Renovate/MintMaker automated base image bump (docker.io/library/golang:1.26.7 → 1.27.1) with a matching pinned sha256 digest, and the repository's renovate.json authorizes this bot's dependency-update pattern; that authorization does not remove the human-approval requirement for protected paths.

Info

• [provenance-warning] — Prior review context discarded: provenance validation failed (PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app). This review treats all findings as first-time assessments and severity anchoring was skipped for this run.

Previous run (18)

Review

Mechanical Renovate-bot Docker tag bump: docker.io/library/golang:1.26.7
→ 1.27.1 (build stage only), with an updated pinned SHA256 digest. No
functional bugs, security issues, style problems, or intent/coherence
concerns identified. The multi-stage runtime image
(registry.access.redhat.com/ubi9/ubi-minimal) is unchanged.

Not approving because Dockerfile is a governance-protected path — human
review is required by policy regardless of how mechanical the change is.

Findings

Info

• [protected-path] Dockerfile — This PR modifies a governance-protected
  path (Dockerfile is in REVIEW_PROTECTED_PATHS). No issue is linked, so
  under the strict rule this would be raised as high severity, but the
  intent-coherence finding cites the mechanical value-only nature of the
  change as implicit authorization, and the repository's renovate.json
  extends the org-wide Renovate config that authorizes exactly this class
  of dependency update. Severity downgraded to info via orchestrator
  reconciliation. Human approval is still required for protected-path
  changes — this note exists so reviewers understand what is being
  changed and why.
• [scope-authorization-implicit] Authorization inferred from the
  mechanical nature of the change (value-only / digest bump). No
  architectural review required.
• [sub-agent-failure] The challenger sub-agent returned an empty
  adjudicated_findings array (it argued the single info finding was a
  non-actionable meta-note). Per the orchestrator's guard against empty
  challenger results, the pre-challenger finding set was preserved.
• [provenance-warning] Prior review context was discarded because
  provenance validation failed (PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app
  — the prior comment was created by a different app than expected). This
  review treats all findings as first-time assessments; severity anchoring
  was skipped for this run.

Previous run (19)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is listed in this repository's REVIEW_PROTECTED_PATHS (governance / infrastructure). The PR body and this repo's renovate.json (extending github>conforma/.github//config/renovate/renovate.json) supply sufficient context: this is a value-only Renovate base-image bump. Human approval is nevertheless required for any protected-path change, regardless of context.
  Remediation: A human reviewer must approve. Before merge, confirm the new digest sha256:512690a5660563b57d37ecc31129e7f136e831db2aed24a1dbeb8ad7380dc0fa corresponds to docker.io/library/golang:1.27.1 on Docker Hub (Renovate is authoritative for the tag→digest pair; the pin remains the source of trust for the build).

Info

• [scope-authorization-implicit] — Authorization inferred from the mechanical nature of the change (value-only dependency version bump by the Renovate bot). No architectural review required.
• [provenance-warning] — Prior review context was discarded: provenance validation returned unverifiable-wrong-app (a prior review comment exists but was created by a different app than expected). This review treats all findings as first-time assessments; severity anchoring was skipped for this run.

Previous run (20)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is under protected paths. The PR has no linked issue providing explicit authorization for this change. While this appears to be a routine renovate bot dependency update (golang 1.26.3 → 1.27.0 with pinned digest), human approval is always required for changes to protected governance and infrastructure files.
  Remediation: Obtain human reviewer approval for this protected-path change.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (21)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is under a protected path requiring human approval. The PR has no linked issue providing authorization for the change. While the Renovate bot description explains this is a golang base image update from 1.26.3 to 1.27.0, protected-path changes require explicit issue-based authorization.
  Remediation: Link an issue authorizing the Dockerfile change, or obtain explicit human approval for this dependency update.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (22)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is a protected governance/infrastructure file requiring human approval. The PR has no linked issue providing authorization or justification for the change. While this is an automated Renovate dependency update (golang 1.26.3 → 1.27.0), protected-path changes always require explicit human review regardless of the change mechanism.
  Remediation: A human maintainer must review and approve changes to protected files. No automated approval is permitted for governance/infrastructure paths.

---

Labels: PR modifies Dockerfile with a dependency version update

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:56 AM UTC · Completed 3:04 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:05 AM UTC · Completed 3:15 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.14

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:26 AM UTC · Completed 2:33 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.65

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:02 AM UTC · Completed 3:10 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.38

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: eba2503
• Latest commit, not reviewed: 6a1876a

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The Docker build stage now uses the Go 1.27.2 image with a new pinned digest instead of the Go 1.26.7 image.

Changes: Go build image

Layer / File(s)	Summary
Update Go build image Dockerfile	The build stage switches from the pinned Go 1.26.7 image to the pinned Go 1.27.2 image.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: simonbaird, st3penta

Merge Risk: Minimal · previous review eba25

The build image moves to Go 1.27.2 with a valid digest pin. No actionable merge risk is established by this change.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Title check		The title clearly identifies the Docker image and the version update from the changeset.
Description check		The description clearly documents the dependency update and its version change. It does not use the template headings or provide explicit Why and Tickets sections, but the missing sections are non-cri…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 93598ad3-7c7b-4bcb-8f32-b91294214f38

📥 Commits

Reviewing files that changed from the base of the PR and between dba3b61 and eba2503.

📒 Files selected for processing: 1

• Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 8 remain after this review.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:47 AM UTC · Completed 2:51 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.29

Superseded by updated review

[fullsend-ai-review]

/fs-review

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 3:24 AM UTC

Commit: 2a22285 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] protected-path

This PR modifies Dockerfile, which is a protected infrastructure file. The PR has no linked issue providing authorization for this change. While this is an automated Renovate dependency update (golang 1.26.7 to 1.27.4 with digest pinning) and the image reference remains properly digest-pinned, human approval is always required for protected-path changes.

Suggested fix: Link to an authorizing issue or obtain explicit human approval for this protected-path change.