chore(deps): Update ubi-minimal base image (v0.7)

[simonbaird]

Update ubi-minimal base image to latest digest.

Old digest: sha256:17fd831ced9434de0a984d60b3fbe61008308261ba98bbc348d6fbdef05fa7c0
New digest: sha256:48fa5d8cda7fc00d270d8747c3eaa54ae196f0820d8540074a9c8c61d5e3056f

RPM changes

- glibc-2.34-274.el9_8.x86_64
- glibc-common-2.34-274.el9_8.x86_64
- glibc-minimal-langpack-2.34-274.el9_8.x86_64
+ glibc-2.34-275.el9_8.x86_64
+ glibc-common-2.34-275.el9_8.x86_64
+ glibc-minimal-langpack-2.34-275.el9_8.x86_64
- p11-kit-0.26.2-1.el9.x86_64
- p11-kit-trust-0.26.2-1.el9.x86_64
+ p11-kit-0.26.4-1.el9_8.x86_64
+ p11-kit-trust-0.26.4-1.el9_8.x86_64

Ref: https://redhat.atlassian.net/browse/EC-2058

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 1edac221-6ee6-4750-8b14-55c764310394

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:23 PM UTC · Completed 7:31 PM UTC
Commit: 87c4a29 · View workflow run →

[qodo-for-conforma]

PR Summary by Qodo

Update UBI9 ubi-minimal base image digest (v0.7)

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Bump UBI9 ubi-minimal base image digest for the final runtime image.
• Pull in updated base RPMs (glibc, p11-kit) via the new UBI digest.

Diagram

graph TD
  src["Source repo"] --> df["Dockerfile(s)"] --> build["Build stage"] --> script["build.sh"] --> artifacts["Built binaries"] --> final["Runtime image"]
  build --> goimg[("Go builder image")]
  final --> ubi[("UBI minimal digest")]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Automate base-image digest bumps (Renovate/Dependabot)

• ➕ Reduces manual maintenance and keeps CVE/RPM updates flowing regularly
• ➕ Can enforce policies like digest pinning + PR cadence
• ➖ Requires repo/tooling setup and initial tuning to avoid noisy PRs

2. Pin to a non-"latest" UBI tag (e.g., ubi-minimal:9.x) plus digest

• ➕ Clearer intent than combining :latest with a digest
• ➕ May ease human tracking of major/minor base transitions
• ➖ Still requires digest updates for reproducibility; tag adds limited value if digest is present

Recommendation: The current approach (digest pin update in both Dockerfiles) is the right default for reproducibility and supply-chain integrity. Consider a follow-up to automate digest bumps; optionally drop the ":latest" suffix or switch to a versioned tag for clarity (while still pinning by digest).

Files changed (2) +2 / -2

Other (2) +2 / -2

DockerfileBump UBI9 ubi-minimal final-stage digest +1/-1

Bump UBI9 ubi-minimal final-stage digest

• Updates the final-stage base image reference to the new pinned ubi-minimal digest to pick up upstream RPM/security updates.

Dockerfile

Dockerfile.distBump UBI9 ubi-minimal final-stage digest (dist image) +1/-1

Bump UBI9 ubi-minimal final-stage digest (dist image)

• Mirrors the Dockerfile final-stage base image digest update in the distribution Dockerfile variant.

Dockerfile.dist

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	69.55% <ø> (ø)
integration	69.55% <ø> (ø)
unit	69.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — This PR modifies protected infrastructure files (Dockerfile, Dockerfile.dist) without a linked issue providing authorization for the change. Protected-path changes require human approval regardless of context. The PR description explains the change (base image digest update with RPM version bumps) but lacks a linked issue to establish authorization.
  Remediation: Link this PR to an issue authorizing the base image update, or obtain explicit human maintainer approval for these protected-path changes.

---

Labels: PR updates Docker base image digest in Dockerfile and Dockerfile.dist

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 11:27 AM UTC · Completed 11:41 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3452 — UBI base image digest bump

Workflow timeline:

1. PR opened (2026-08-03 19:22 UTC) — trivial 2-line change updating ubi9/ubi-minimal base image digest in Dockerfile and Dockerfile.dist
2. Review agent dispatched (run 30845503928)
3. Review agent submitted CHANGES_REQUESTED (19:31 UTC) with a single [high] protected-path finding — Dockerfiles modified without a linked GitHub issue
4. Human reviewer joejstuart APPROVED (2026-08-04 00:26 UTC) without comments
5. PR merged (11:26 UTC)

Assessment: The review agent's finding was a false positive that added friction to a routine, mechanically-safe change. The PR body did reference a Jira ticket (Ref: https://redhat.atlassian.net/browse/EC-2058), but the agent only recognizes GitHub issue links. The correctness and security sub-agents correctly found no issues. The style-conventions sub-agent failed due to claude-sonnet-4-5@20250929 being unavailable on the Vertex deployment.

No new proposals filed. All improvement areas are already tracked by existing open issues:

• Jira reference recognition — fullsend-ai/fullsend#2076 directly covers the agent failing to recognize *.atlassian.net/browse/* URLs as valid authorization. This PR provides additional evidence: the conforma/cli PR template explicitly asks for Jira links in its Tickets: section, confirming Jira is the primary issue tracker.
• Protected-path severity for digest-only Dockerfile changes — Multiple issues cover this: #3061, #3675, #3910, #3239. This PR is another data point: a sha256 digest substitution on a FROM line is mechanically verifiable as safe and does not warrant CHANGES_REQUESTED.
• Model fallback for sub-agents — fullsend-ai/fullsend#1771 and fullsend-ai/agents#379 track the style-conventions sub-agent failure due to model unavailability.
• Skip/fast-path dispatch for dependency PRs — conforma/cli#3420 and fullsend-ai/fullsend#5360 cover skipping agent dispatch for this class of PR.

Autonomy observation: The review agent's correctness and security sub-agents correctly found no issues, matching the human reviewer's assessment. The only delta was the false-positive protected-path finding. Resolving #2076 (Jira recognition) and any of #3061/#3675/#3910 (digest-only Dockerfile exemption) would eliminate the agent-human verdict mismatch for this class of change entirely. The autonomy analysis found this pattern repeating on every UBI bump across 3 release branches (~6+ false-positive CHANGES_REQUESTED per month).