Skip to content

chore(deps): Update ubi-minimal base image (v0.7) - #3633

Open
cuipinghuo wants to merge 1 commit into
conforma:release-v0.7from
cuipinghuo:ubi-bump-release-v0.7
Open

chore(deps): Update ubi-minimal base image (v0.7)#3633
cuipinghuo wants to merge 1 commit into
conforma:release-v0.7from
cuipinghuo:ubi-bump-release-v0.7

Conversation

@cuipinghuo

@cuipinghuo cuipinghuo commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

What:

Update the ubi9/ubi-minimal base image pin in Dockerfile and Dockerfile.dist to the latest digest.

Old digest: sha256:c4c285d42941ebb2bd4da878479008e1e4536bb599aad1dbe568f89de9053661
New digest: sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed

Why:

Picks up the refreshed CA trust bundle.

RPM changes

- ca-certificates-2025.2.80_v9.0.305-91.el9.noarch
+ ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.noarch

rpms.lock.yaml was regenerated via hack/update-rpm-lock.sh and is unchanged: the tracked packages (ca-certificates, jq, gzip) already resolve to the latest versions in the UBI CDN repos, so the digest bump produces no lockfile diff (see EC-2122).

Tickets:

Ref: https://redhat.atlassian.net/browse/EC-2343

🤖 Generated with Claude Code

@coderabbitai

coderabbitai Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 01c6e010-8e2d-489e-876b-588962c82872

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@fullsend-ai-review

fullsend-ai-review Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 6:36 PM UTC · Completed 6:47 PM UTC

Commit: 52f7eb8 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.62

@codecov

codecov Bot commented Oct 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag Coverage Δ
generative 69.55% <ø> (ø)
integration 69.55% <ø> (ø)
unit 69.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@fullsend-ai-review fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Oct 23, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Minimal 2-file base-image digest bump; elevated Tier 1 sub-scores for protected paths, CI workflow flag, and zero test ratio are structural artifacts of Dockerfile changes rather than logic risk, keeping the composite at moderate — identical to prior assessment.

Previous run

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Minimal 2-file base-image version bump; elevated Tier 1 sub-scores for protected paths, CI workflow flag, and zero test ratio are structural artifacts of Dockerfile changes rather than logic risk, keeping the composite at moderate.

@fullsend-ai-review

fullsend-ai-review Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Review

Findings

Medium

  • [protected-path] Dockerfile — PR modifies protected paths: Dockerfile and Dockerfile.dist. These are governance/infrastructure files that require human approval. The PR provides sufficient context — it references external ticket EC-2343 and explains the rationale (refreshed CA trust bundle, updated ca-certificates RPM). Human approval is still required for protected-path changes.
Previous run

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJjb21tZW50IiwiZmluZGluZ3MiOltdfQ== -->

Review

Findings

Medium

  • [protected-path] Dockerfile, Dockerfile.dist — This PR modifies protected-path files: Dockerfile and Dockerfile.dist. The PR references Jira ticket EC-2343 and explains the rationale (CA trust bundle refresh via base image digest update). Human approval is always required for protected-path changes, regardless of context.

Labels: PR updates Docker base image digest in Dockerfiles

@fullsend-ai-review fullsend-ai-review Bot added requires-manual-review Review requires human judgment docker Pull requests that update Docker code dependencies Pull requests that update a dependency file labels Oct 23, 2026
simonbaird
simonbaird previously approved these changes Oct 23, 2026
View reviewed changes
joejstuart
joejstuart previously approved these changes Oct 23, 2026
View reviewed changes
robnester-rh
robnester-rh previously approved these changes Oct 23, 2026
View reviewed changes

@robnester-rh robnester-rh left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cuipinghuo
cuipinghuo force-pushed the ubi-bump-release-v0.7 branch from 52f7eb8 to 7671e14 Compare October 23, 2026 20:16
@fullsend-ai-review

fullsend-ai-review Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Started 8:18 PM UTC · Ended 8:24 PM UTC

Commit: 7671e14 · View workflow run →

@cuipinghuo @claude
chore(deps): Update ubi-minimal base image
5710594 
Old digest: sha256:c4c285d42941ebb2bd4da878479008e1e4536bb599aad1dbe568f89de9053661
New digest: sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed

RPM changes:

- ca-certificates-2025.2.80_v9.0.305-91.el9.noarch
+ ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.noarch

rpms.lock.yaml regenerated via hack/update-rpm-lock.sh; no diff (tracked
packages already resolve to latest in the UBI CDN repos).

Ref: https://redhat.atlassian.net/browse/EC-2343

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: cuipinghuo <chuo@redhat.com>
@cuipinghuo
cuipinghuo force-pushed the ubi-bump-release-v0.7 branch from 7671e14 to 5710594 Compare October 23, 2026 20:23
@fullsend-ai-review

fullsend-ai-review Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:26 PM UTC · Completed 8:40 PM UTC

Commit: 5710594 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.00

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@simonbaird simonbaird simonbaird approved these changes
@Acepresso Acepresso Acepresso approved these changes
@joejstuart joejstuart joejstuart left review comments
@robnester-rh robnester-rh robnester-rh left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file docker Pull requests that update Docker code requires-manual-review Review requires human judgment risk/moderate PR risk: moderate size: XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@cuipinghuo @simonbaird @joejstuart @robnester-rh @Acepresso