[robnester-rh]

Update ubi-minimal base image to the digest containing
util-linux-2.37.4-28.el9_9.

Old digest: sha256:dfa0eb04abc59221544e74862432496add1f491f915c9b531880f91affc0e12c
New digest: sha256:ecb40c7bdfa5b0bb71e978c98c7cf56ce38edf1f8fb3561078acbc4b13698c07

RPM changes

- jq-1.6-19.el9_8.2
+ jq-1.6-21.el9_9

Ref: EC-2395

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Three Dockerfiles now pin UBI 9 minimal to a different image digest. The x86_64 jq RPM lock entry now points to version 1.6-21.el9_9, with updated package metadata.

Changes: Dependency Pin Updates

Layer / File(s)	Summary
Update container image digest Dockerfile, Dockerfile.dist, acceptance/kubernetes/kind/acceptance.Dockerfile	The three Dockerfiles use a different pinned UBI 9 minimal image digest.
Update jq RPM lock rpms.lock.yaml	The x86_64 jq entry changes to version 1.6-21.el9_9, with updated URL, size, checksum, EVR, and source RPM.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: simonbaird, acepresso

Merge Risk: Minimal · up to a5466

This updates the base image digest and the jq package lock. No concrete merge-blocking risk was found, and normal CI should confirm the image builds.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the main change: updating the UBI minimal base image dependency.
Description check		The description explains the image digest update, lists the RPM change, and provides reference EC-2395. It does not use the template headings, but it contains the required information.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: bf1d7308-33fa-4c91-bd9c-0ba453fdde50

Commits

Reviewing files that changed from the base of the PR and between 3bc55d6 and a5466ab.

Files selected for processing: 4

• Dockerfile
• Dockerfile.dist
• acceptance/kubernetes/kind/acceptance.Dockerfile
• rpms.lock.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

[qodo-for-conforma]

PR Summary by Qodo

Update pinned UBI minimal base image and x86_64 jq lock

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Pin production and acceptance images to the updated UBI minimal digest.
• Refresh the x86_64 RPM lock entry for jq 1.6-21.el9_9.

Diagram

graph TD
  U["UBI minimal"] --> D["Distribution image"] --> G["Lock generator"] --> L["RPM lock"]
  U --> P["Main image"] & A["Acceptance image"]

Loading

High-Level Assessment

Keep the digest synchronized across the three Dockerfiles and update the corresponding RPM lock metadata. This preserves reproducible base-image references without changing the existing image-build workflow.

Files changed (4) +8 / -8

Other (4) +8 / -8

DockerfilePin the main runtime image to the new UBI digest +1/-1

Pin the main runtime image to the new UBI digest

• Changes the final-stage UBI minimal image digest. The Go build stage and runtime instructions remain unchanged.

Dockerfile

Dockerfile.distPin the distribution runtime image to the new UBI digest +1/-1

Pin the distribution runtime image to the new UBI digest

• Updates the distribution image's final-stage base to the same UBI minimal digest as the main image.

Dockerfile.dist

acceptance.DockerfileAlign the acceptance image with the new UBI digest +1/-1

Align the acceptance image with the new UBI digest

• Updates the kind acceptance-test image's base digest to match the production images.

acceptance/kubernetes/kind/acceptance.Dockerfile

rpms.lock.yamlRefresh the locked x86_64 jq RPM +5/-5

Refresh the locked x86_64 jq RPM

• Replaces the x86_64 jq 1.6-19.el9_8.2 entry with 1.6-21.el9_9, including its URL, size, checksum, and source RPM metadata. Other architecture entries are unchanged.

rpms.lock.yaml

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[fullsend-ai-review]

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Routine UBI base image bump across 4 Dockerfile/lock files; small change size and clean git history keep risk low-moderate, with minor elevation from Dockerfile protected paths, CI_WORKFLOW_CHANGED flag, and zero test file ratio (expected for pure infrastructure dependency updates).

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] Dockerfile, Dockerfile.dist — PR modifies protected files (Dockerfiles under governance). The PR description provides rationale for the change (ubi-minimal base image digest update, Ref: EC-2395). Human approval is always required for protected-path changes, regardless of context.

---

Labels: PR updates Docker base images and RPM dependency versions

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.61% <ø> (ø)
generative	12.22% <ø> (ø)
integration	23.62% <ø> (ø)
unit	72.29% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.