chore(deps): Update ubi-minimal base image (v0.8)

[simonbaird]

Update ubi-minimal base image to latest digest.

Old digest: sha256:17fd831ced9434de0a984d60b3fbe61008308261ba98bbc348d6fbdef05fa7c0
New digest: sha256:48fa5d8cda7fc00d270d8747c3eaa54ae196f0820d8540074a9c8c61d5e3056f

RPM changes

- glibc-2.34-274.el9_8.x86_64
- glibc-common-2.34-274.el9_8.x86_64
- glibc-minimal-langpack-2.34-274.el9_8.x86_64
+ glibc-2.34-275.el9_8.x86_64
+ glibc-common-2.34-275.el9_8.x86_64
+ glibc-minimal-langpack-2.34-275.el9_8.x86_64
- p11-kit-0.26.2-1.el9.x86_64
- p11-kit-trust-0.26.2-1.el9.x86_64
+ p11-kit-0.26.4-1.el9_8.x86_64
+ p11-kit-trust-0.26.4-1.el9_8.x86_64

Ref: https://redhat.atlassian.net/browse/EC-2058

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 668eed36-cd26-462e-89e0-fa66830ca8e7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Update UBI9 ubi-minimal base image digest (v0.8)

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Bump UBI9 ubi-minimal final-stage image to a new pinned digest.
• Align both release and distribution Dockerfiles on the same base image digest.
• Pick up updated core RPMs (glibc, p11-kit) via the refreshed base image.

High-Level Assessment

The following are alternative approaches to this PR:

1. Use a versioned UBI tag (avoid `latest`)

• ➕ Improves clarity/auditability when scanning Dockerfiles
• ➕ Reduces confusion about what 'latest' means at build time
• ➖ Still typically requires digest pinning for full reproducibility
• ➖ May require more frequent tag management across streams

2. Automate base image digest updates (e.g., Renovate/Dependabot for Docker)

• ➕ Reduces manual effort and keeps base images current
• ➕ Can standardize PR metadata and change cadence
• ➖ Introduces bot churn and requires tuning/approvals
• ➖ May need extra policy for CVE-driven vs routine bumps

Recommendation: The current approach (pinning a specific digest) is the safest for reproducible builds. If the team wants clearer semantics, consider pairing the digest with a non-latest tag, but keep digest pinning either way. Automation is worthwhile if these bumps are frequent.

Files changed (2) +2 / -2

Other (2) +2 / -2

DockerfileUpdate ubi-minimal final image digest +1/-1

Update ubi-minimal final image digest

• Updates the final-stage base image reference to the latest UBI9 ubi-minimal digest to pull in updated base RPMs.

Dockerfile

Dockerfile.distMirror ubi-minimal digest bump in dist Dockerfile +1/-1

Mirror ubi-minimal digest bump in dist Dockerfile

• Applies the same UBI9 ubi-minimal digest update to keep distribution builds consistent with the main Dockerfile.

Dockerfile.dist

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:24 PM UTC · Completed 7:31 PM UTC
Commit: 87c4a29 · View workflow run →

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — Protected infrastructure files modified without a linked issue. Both Dockerfiles update the ubi9/ubi-minimal base image digest (a routine RPM patch update: glibc 2.34-274→275, p11-kit 0.26.2→0.26.4). Human approval is required for all protected-path changes regardless of context.

---

Labels: PR modifies Dockerfiles with a base image dependency update

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.86% <ø> (ø)
generative	18.14% <ø> (ø)
integration	26.99% <ø> (ø)
unit	68.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 11:30 AM UTC · Completed 11:38 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3453 — chore(deps): Update ubi-minimal base image (v0.8)

Workflow went well. No new proposals — all identified improvement areas are already tracked in existing issues.

Timeline

1. Aug 3, 19:23 UTC — simonbaird (human) opens PR with a 2-line Dockerfile digest bump (ubi9/ubi-minimal SHA update) across Dockerfile and Dockerfile.dist.
2. Aug 3, 19:24–19:31 UTC — Review agent (run 30845562809) dispatches 3 sub-agents (correctness, security, style-conventions). All find zero code issues. Style-conventions sub-agent fails once due to claude-sonnet-4-6@default model unavailability, succeeds on retry.
3. Aug 3, 19:31 UTC — Review agent submits CHANGES_REQUESTED with a single HIGH [protected-path] finding: Dockerfiles modified without a linked GitHub issue. The agent's own reasoning notes this "feels overly strict for a legitimate maintenance task" but follows the policy as written.
4. Aug 4, 00:27 UTC — joejstuart (human) approves the PR.
5. Aug 4, 11:28 UTC — simonbaird responds to the protected-path finding by adding a Jira link (EC-2058) to the PR description.
6. Aug 4, 11:29 UTC — PR merged.

What went well

• Correct code assessment: All three sub-agents correctly identified zero quality issues on this mechanical change, matching the human reviewer's assessment.
• Graceful retry: The model unavailability for the style-conventions sub-agent was handled transparently — the agent retried and succeeded.
• Reasonable cost: $1.28 and ~7 minutes for a review of a trivial PR.

Improvement areas (all already tracked)

• Protected-path severity on human-authored PRs: The HIGH finding and CHANGES_REQUESTED review on a human-authored digest bump added friction without value. Already tracked in fullsend-ai/fullsend#1551 (downgrade for human-authored PRs) and #3675 (allow agent approval for FROM-line-only Dockerfile changes with digest pinning). This PR provides another data point supporting those proposals.
• External issue tracker recognition: The PR referenced Jira ticket EC-2058, but the protected-path policy only recognizes GitHub issue links. Already tracked in fullsend-ai/fullsend#2076 (recognize external tracker references) and #2268 (Jira support).
• Model availability fallback: The claude-sonnet-4-6@default transient failure is covered by fullsend-ai/fullsend#1771 and fullsend-ai/agents#379.