Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.10-1794208260 (main) by red-hat-konflux[bot] · Pull Request #3368 · conforma/cli

red-hat-konflux · 2026-06-27T02:00:49Z

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi9/go-toolset	stage	patch	`1.26.7` → `1.26.10-1794208260`

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

fullsend-ai-review · 2026-06-27T02:06:35Z

🤖 Review · ⚠️ Cancelled · Started 2:06 AM UTC · Ended 2:09 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-27T02:12:27Z

🤖 Finished Review · ✅ Success · Started 2:12 AM UTC · Completed 2:18 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-27T02:17:58Z

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which is under the protected path prefix Dockerfile. The PR has no linked issue justifying the change to governance/infrastructure files. Human approval is required for protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the protected path prefix Dockerfile. Protected paths (governance and infrastructure files) require human approval regardless of change size or author. The PR has no linked issue to justify the modification of protected files.
Remediation: Ensure human review and approval for this protected-path change.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which is under the protected path Dockerfile. The PR has no linked issue providing authorization for modifying governance or infrastructure files. Human approval is required for all protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which is under the protected path prefix Dockerfile. The PR has no linked issue providing justification for modifying governance or infrastructure files. Human approval is required for protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (4)

Review

Reason: stale-head

The review agent reviewed commit 29173012d264f43779f04518cf2580961bedda0b but the PR HEAD is now 2ad5c658e92028baddd6dd448dc619e5de3b3de4. This review was discarded to avoid approving unreviewed code.

Previous run (5)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected path Dockerfile. The PR has no linked issue providing justification for modifying this governance/infrastructure file. Human approval is required for protected-path changes.
Remediation: Link an issue that authorizes this change, or obtain explicit human reviewer approval for the protected-path modification.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (6)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the Dockerfile protected path. The PR has no linked issue providing justification for modifying governance or infrastructure files. Human approval is required for all protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (7)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected path Dockerfile. The PR has no linked issue providing justification for modifying governance or infrastructure files. Human approval is always required for protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (8)

Review

Findings

High

[protected-path] Dockerfile.dist — Dockerfile.dist is under a protected path (matches Dockerfile prefix in the governance paths list). The PR has no linked issue providing justification for modifying this governance/infrastructure file. Human approval is required for protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (9)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected path prefix Dockerfile. The PR has no linked issue providing explicit justification for modifying governance or infrastructure files. Human approval is always required for protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (10)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which matches the protected path prefix Dockerfile. The PR has no linked issue providing justification for modifying governance or infrastructure files. Human approval is required for protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (11)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected path prefix Dockerfile. The PR has no linked issue providing justification for modifying this governance/infrastructure file. Human approval is required for all protected-path changes regardless of change size or author.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (12)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which is under the protected path prefix Dockerfile. The PR has no linked issue providing authorization for modifying governance or infrastructure files. Human approval is required for all protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (13)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected path prefix Dockerfile. The PR has no linked issue providing justification for modifying governance or infrastructure files. Human approval is always required for protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (14)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the protected path prefix Dockerfile. The PR has no linked issue providing justification for modifying this governance/infrastructure file. Human approval is always required for protected-path changes.
Remediation: Link this PR to an issue that authorizes the Dockerfile change, or obtain explicit human approval for the protected path modification.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (15)

Review

Findings

Medium

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected-path prefix Dockerfile. The PR description explains the change (Renovate patch bump of registry.access.redhat.com/ubi9/go-toolset from 1.26.7 to 1.26.10-1792592174, with the pinned sha256 digest updated in lock-step) and renovate.json (extending github>conforma/.github//config/renovate/renovate.json) is the standing authorization for this change pattern. Human approval is always required for protected-path changes regardless of context.
Remediation: Confirm the digest matches the published tag for registry.access.redhat.com/ubi9/go-toolset:1.26.10-1792592174 and merge after human review.

Previous run (16)

Review

Findings

Medium

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected-path prefix Dockerfile. The PR description explains the change (Renovate patch bump of registry.access.redhat.com/ubi9/go-toolset from 1.26.7 to 1.26.10-1792592174, with the pinned sha256 digest updated in lock-step) and renovate.json (extending github>conforma/.github//config/renovate/renovate.json) is the standing authorization for this change pattern. Human approval is always required for protected-path changes regardless of context.
Remediation: Confirm the digest matches the published tag for registry.access.redhat.com/ubi9/go-toolset:1.26.10-1792592174 and merge after human review.

Previous run (17)

Looks good to me

Previous run (18)

Looks good to me

Previous run (19)

Looks good to me

Previous run (20)

Looks good to me

Previous run (21)

Looks good to me

Previous run (22)

Looks good to me

Previous run (23)

Looks good to me

Previous run (24)

Review

Findings

Medium

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected path prefix Dockerfile in the active governance list. Human approval is always required for protected-path changes, regardless of context. Authorization for this change is implicit via the Renovate bot workflow (configured in renovate.json, which extends the central conforma/.github Renovate preset to manage base-image updates), but the protected-path gate still applies.
Remediation: Confirm human review of the base image tag/digest transition (1.26.7 → 1.26.7-1791928822, sha256 685ccca... → f9e171e...) before merging.

Info

[scope-authorization-implicit] — Authorization inferred from the mechanical nature of this change: a Renovate bot patch bump of registry.access.redhat.com/ubi9/go-toolset in Dockerfile.dist (value-only tag + digest swap, no code, build-arg, or stage changes). No architectural review required.

Previous run (25)

Looks good to me

Previous run (26)

Looks good to me

Previous run (27)

Review

Findings

Info

[supply-chain] Dockerfile.dist:19 — FROM line retains sha256 digest pinning in the proper tag@sha256: format against the official Red Hat registry (registry.access.redhat.com/ubi9/go-toolset). Tag moves from 1.26.7 to 1.26.7-1791275853 (timestamp-suffixed rebuild of the same upstream version) with digest updated accordingly — consistent with a Red Hat Konflux rebuild, not a Go version bump.
[renovate-authorization] renovate.json — The repository's renovate.json extends the shared conforma config and does not restrict Docker base-image updates; base image bumps authored by red-hat-konflux[bot] are within the inherited Renovate scope.
[protected-path] Dockerfile.dist — Dockerfile.dist matches the protected-path prefix Dockerfile. The PR is an automated Renovate bump with no linked issue; the renovate-authorization finding above cites explicit authorization for this change pattern, so this notice is informational. Human approval is still required for protected-path changes regardless of inferred authorization.

Previous run (28)

Looks good to me

Previous run (29)

Looks good to me

Previous run (30)

Looks good to me

Previous run (31)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected-path prefix Dockerfile. Protected paths (build/governance/infrastructure files) require human approval. The PR has no linked issue documenting authorization for the change, so context is insufficient for auto-approval of a build-critical file. Note: only the tag string changed (1.26.7 → 1.26.7-1789040808); the image digest sha256:685ccca486cc2c82b0818d835abecb1aed7a396e76ba416cfc47c28067f5d365 is unchanged, so the pulled image content is identical.
Remediation: A human reviewer must approve the change to Dockerfile.dist before merging. If this Renovate/MintMaker automated update pattern is pre-authorized (e.g., via renovate.json policy), consider linking the authorizing configuration or an issue in future PRs so the context requirement is satisfied.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (32)

Review

Routine Renovate/MintMaker patch bump of the ubi9/go-toolset base image tag in Dockerfile.dist from 1.26.7 to 1.26.7-1789040808. The pinned sha256 digest (685ccca4...5d365) is unchanged, so the image content pulled by the build is bit-identical to the prior version — this is a metadata-only tag rename.

Findings

Info

[protected-path] Dockerfile.dist — This file matches the Dockerfile prefix in REVIEW_PROTECTED_PATHS, so it counts as a protected-path change requiring human approval. The change has clear authorization evidence: it is authored by the red-hat-konflux MintMaker bot, carries the renovate and dependencies labels, and only appends a Konflux build-id suffix to the tag while leaving the sha256 digest unchanged. Per reconciliation, the finding is downgraded from high to info. Human approval is still required for protected-path changes regardless of authorization evidence.
[provenance-warning] — Prior review context was discarded because PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app (a prior review comment exists but was authored by a different app than expected). This run treats all findings as first-time assessments; no severity anchoring was applied.

Previous run (33)

Review

Findings

Medium

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, whose path matches the Dockerfile prefix in the active protected-paths list, so human approval is required regardless of the change's nature. Context mitigating (but not removing) the requirement: the change is a routine MintMaker/Renovate patch bump of the registry.access.redhat.com/ubi9/go-toolset base image; the repository ships renovate.json (extending github>conforma/.github//config/renovate/renovate.json), which provides standing authorization for automated dependency updates; the author is the trusted red-hat-konflux bot; the digest is pinned; and only the build-stage base image is affected (the final ubi-minimal image is unchanged). Human review is still required to confirm the intended upstream release.

Previous run (34)

Review

Findings

Medium

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected-path prefix Dockerfile in REVIEW_PROTECTED_PATHS. The PR is an automated MintMaker/Renovate patch update of the ubi9/go-toolset base image (1.26.7 → 1.26.7-1789040808) with the corresponding sha256 digest re-pinned, so the rationale is clear from the description. However, human approval is always required for protected-path changes regardless of context — this comment surfaces the classification so a human reviewer can confirm before merge.
Remediation: Human reviewer to confirm the tag/digest bump is acceptable and merge (or dismiss) accordingly. No code change needed.

Previous run (35)

Review

Findings

Medium

[protected-path] Dockerfile.dist — Modifies a file matching the protected path prefix Dockerfile. Human approval is always required for protected-path changes, regardless of context. The change is a Renovate-authored patch bump of the ubi9/go-toolset base image tag (1.26.7 → 1.26.7-1789040808); the repo's renovate.json extends conforma/.github//config/renovate/renovate.json, which establishes the authorization pattern for automated dependency updates, and the PR carries renovate, dependencies, and requires-manual-review labels routing the change for human review.
Remediation: A repository maintainer must confirm the base-image update before merge. If the operator intends Dockerfile to be an exact-match protected path (not a prefix that also captures Dockerfile.dist, Dockerfile.rhtap, etc.), consider tightening REVIEW_PROTECTED_PATHS in the harness configuration.

Info

[provenance-warning] — Prior review context was discarded because provenance validation failed (PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app: the prior review comment was created by a different app than expected, so its authorship cannot be attributed and severity anchoring was skipped). This run was performed as a first-time review.
[sub-agent-failure] — The risk-assessment pre-pass sub-agent failed to return a score (Vertex API error: model claude-sonnet-4-5@20250929 unavailable on this deployment). The composite risk score is unavailable for this run; the review verdict is unaffected because risk assessment is informational.

Previous run (36)

Review

Findings

Medium

[protected-path] Dockerfile.dist — Modifies a file matching the protected path pattern Dockerfile. Human approval is always required for protected-path changes, regardless of context. This PR is a Renovate/MintMaker automated patch update (ubi9/go-toolset:1.26.7 → 1.26.7-1789040808) with a pinned digest, authored by red-hat-konflux[bot]; the requires-manual-review label is already applied. Reviewer confirmation is required before merge.

Previous run (37)

Review

Reason: stale-head

The review agent reviewed commit 21a27d7604d983a52686943b6637ca8998ac74d7 but the PR HEAD is now a540dba84bff81e51bc9ee46acbeeda27fa63a82. This review was discarded to avoid approving unreviewed code.

Previous run (38)

Review

Findings

Medium

[protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which matches the Dockerfile entry in the active protected paths list (REVIEW_PROTECTED_PATHS). Human approval is always required for protected-path changes, regardless of context. The change is an automated Renovate/MintMaker base-image bump by the authorized red-hat-konflux bot (UBI9 go-toolset:1.26.7 → 1.26.7-1789040808) with matching digest update; both the tag and the @sha256: digest were changed together and pinning discipline is preserved. Sub-agent review (correctness, security, style) surfaced no code-level issues. A human reviewer should confirm the new digest corresponds to the intended 1.26.7-1789040808 tag of registry.access.redhat.com/ubi9/go-toolset before merging.
Remediation: Human reviewer: verify the new digest sha256:685ccca486cc2c82b0818d835abecb1aed7a396e76ba416cfc47c28067f5d365 matches the 1.26.7-1789040808 tag (e.g., skopeo inspect docker://registry.access.redhat.com/ubi9/go-toolset:1.26.7-1789040808), then approve.

Previous run (39)

Review

Findings

Medium

[protected-path] Dockerfile.dist:19 — The PR modifies Dockerfile.dist, which matches the protected-path prefix Dockerfile in the governance list. The PR description explains the change (Renovate-managed Docker tag bump for registry.access.redhat.com/ubi9/go-toolset from 1.26.7 to 1.26.7-1788409979, SHA256 digest unchanged), and the repository's renovate.json authorizes this update pattern. Human approval is always required for protected-path changes, regardless of context.
Remediation: Have a human reviewer confirm the Renovate-managed Docker tag update on Dockerfile.dist before merge.

Previous run (40)

Review

Findings

Medium

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which begins with the Dockerfile entry in the active protected-paths list (see REVIEW_PROTECTED_PATHS). Human approval is always required for protected-path changes, regardless of automation. The PR body documents the change (Renovate patch update of registry.access.redhat.com/ubi9/go-toolset from tag 1.26.7 to 1.26.7-1788409979), and the repository authorizes automated dependency updates via renovate.json (which extends github>conforma/.github//config/renovate/renovate.json). The immutable @sha256:... digest on the FROM line is unchanged from the base branch, so Docker will pull identical image bytes; this is a cosmetic tag-string alignment.

Previous run (41)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the protected path prefix Dockerfile. The PR has no linked issue justifying the modification of this governance/infrastructure file. Human approval is always required for protected-path changes, regardless of whether the update is automated.
Remediation: Obtain explicit human approval for this Dockerfile dependency update. Consider linking an issue or adding a justification note to the PR description explaining why this protected file is being modified.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (42)

Review

Findings

Medium

[protected-path] Dockerfile.dist:19 — This file matches the Dockerfile protected path prefix. The PR is an automated Renovate dependency update (bot author: app/red-hat-konflux, label: renovate) updating the ubi9/go-toolset base image from 1.26.3 to 1.26.5-1787668499 with a pinned digest. The change is well-scoped and the digest pin ensures supply chain integrity. However, human approval is always required for changes to protected paths, regardless of context.

Previous run (43)

Review

Findings

Medium

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the protected path prefix Dockerfile. The change is an automated Renovate dependency update (go-toolset 1.26.3 → 1.26.5-1787559109) with digest pinning, and renovate.json in the repository root authorizes this class of automated update. Human approval is always required for protected-path changes, regardless of context.

Previous run (44)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This file matches the protected path prefix Dockerfile. The PR does not link to an issue authorizing changes to governance or infrastructure files. While this is an automated Renovate dependency update (renovate.json configuration present, author is red-hat-konflux[bot], labels include renovate and dependencies), human approval is always required for protected-path changes.
Remediation: Ensure a human reviewer explicitly approves this protected-path change.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (45)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which falls under the protected path prefix Dockerfile. Protected paths require human approval regardless of change content. The PR has no linked issue providing authorization for modifying governance/infrastructure files. The change itself — a Renovate-managed Docker tag bump for ubi9/go-toolset from 1.26.3 to 1.26.5-1787080706 with a pinned digest — is mechanically correct and uses proper digest pinning (@sha256:...), but human review of protected infrastructure files is always required.
Remediation: A maintainer should review and approve this Dockerfile change. No code changes are needed — the version bump with pinned digest is correct.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (46)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the protected path prefix Dockerfile. The PR has no linked issue providing explicit authorization for this infrastructure change. While the change is an automated Renovate dependency update (Docker base image tag bump from 1.26.3 to 1.26.5-1787080706 with pinned digest), human approval is always required for protected-path modifications.
Remediation: A human reviewer must explicitly approve this Dockerfile change.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (47)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This file matches the Dockerfile protected path prefix. The PR modifies a governance/infrastructure file (Dockerfile.dist) but has no linked issue providing authorization for the change. While this is an automated Renovate dependency update (Docker base image tag bump from 1.26.3 to 1.26.5-1786971605 with digest pin), human approval is required for all protected-path changes regardless of the change's nature.
Remediation: A human reviewer with appropriate authority should review and approve this protected-path change.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (48)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the protected path Dockerfile. Protected paths are governance and infrastructure files that require human approval. This PR has no linked issue providing authorization for the change.
Remediation: A maintainer must explicitly approve changes to protected paths. No automated approval is permitted regardless of the change's nature.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (49)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — Protected file Dockerfile.dist is modified (matches protected path prefix Dockerfile). This PR has no linked issue providing authorization for modifying governance/infrastructure files. Human approval is required for all protected-path changes, regardless of whether the change is automated.
Remediation: Link a tracking issue that authorizes this change, or obtain explicit human approval for the protected-path modification.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (50)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This file matches the protected path prefix Dockerfile in the repository's governance configuration. The PR has no linked issue providing authorization for modifying this infrastructure file. While this is a mechanical Renovate dependency update (bumping ubi9/go-toolset from 1.26.3 to 1.26.5-1786522985 with a pinned digest), protected-path changes require explicit human approval.
Remediation: A human reviewer with appropriate permissions should verify and approve this protected-path change. The repository's renovate.json indicates Renovate is configured to manage dependencies in this repository.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (51)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected path prefix Dockerfile. The PR has no linked issue providing justification for modifying governance or infrastructure files. While this appears to be a routine Renovate Docker tag/digest bump (go-toolset 1.26.3 → 1.26.5-1786522985 with digest pinning), human approval is always required for protected-path changes.
Remediation: Obtain explicit human approval for this protected-path modification.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (52)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — Dockerfile.dist is under a protected path (matches Dockerfile prefix in REVIEW_PROTECTED_PATHS). This file is governance/infrastructure and requires human approval. The PR has no linked issue providing authorization for this change.
Remediation: Ensure a human maintainer reviews and approves changes to protected infrastructure files.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (53)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the Dockerfile protected path. Protected paths contain governance and infrastructure files that require human approval regardless of change size or nature. The PR has no linked issue providing authorization for the change.
Remediation: Obtain human review and approval for the Dockerfile change. Consider linking an issue that authorizes the dependency update.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (54)

Review

Findings

Medium

[protected-path] Dockerfile.dist — This file matches the protected path Dockerfile and requires human approval before merging. The PR is an automated Renovate dependency update (go-toolset 1.26.3 → 1.26.5-1786023237) with a clear rationale and digest-pinned base image from the trusted Red Hat UBI9 registry, but protected-path changes always require explicit human sign-off regardless of context.

Previous run (55)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the protected path Dockerfile. Protected paths are governance and infrastructure files that require human approval. No linked issue provides authorization for modifying protected files. The change itself is a routine Renovate-managed Docker base image tag bump (go-toolset 1.26.3 → 1.26.5-1786023237 with updated digest pin), but human approval is required for any protected-path modification.
Remediation: Obtain human reviewer approval for this protected-path change.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (56)

Review

Findings

High

[protected-path] Dockerfile.dist — This file matches the protected path Dockerfile. The PR has no linked issue providing authorization for modifying governance or infrastructure files. While the change is an automated Renovate dependency bump (go-toolset 1.26.3 → 1.26.5-1786023237 with pinned digest), human approval is always required for protected-path changes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (57)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — Dockerfile.dist is a protected infrastructure file (matches protected path pattern Dockerfile). This PR modifies the go-toolset base image tag and digest from 1.26.3 to 1.26.5-1785791459. No linked issue provides authorization for modifying this protected file. While the change is a routine Renovate dependency update and the digest pin is correctly maintained, human approval is always required for protected-path changes.
Remediation: A human maintainer should review and approve this base image update. Consider linking a tracking issue or policy that authorizes automated Renovate updates to Dockerfiles.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (58)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the Dockerfile protected path. The PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. While this is a mechanical Docker base image tag bump (go-toolset 1.26.3 → 1.26.5-1785791459) generated by Renovate, human approval is always required for protected-path changes.
Remediation: A maintainer should review and approve this protected-path change. No code changes are needed.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (59)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which matches the protected path Dockerfile. Protected paths contain governance and infrastructure files that require human approval. The PR has no linked issue justifying the modification. While the change is a routine Renovate-managed Docker tag bump (go-toolset 1.26.3 → 1.26.5-1785791459) with a properly pinned sha256 digest, human review and approval is required for all protected-path changes.
Remediation: A human reviewer with appropriate permissions must approve this change.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (60)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the protected path Dockerfile. Protected paths contain governance and infrastructure files that require human approval. This PR has no linked issue providing justification for modifying the protected file. While the change is an automated Docker tag bump by Renovate (go-toolset 1.26.3 → 1.26.5-1785443561) and the repository has a renovate.json configuration authorizing such updates, human review of infrastructure file changes is still required.
Remediation: A human reviewer with appropriate permissions should verify and approve this Docker base image update.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (61)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the Dockerfile protected path. The change is an automated Renovate Docker tag bump (go-toolset:1.26.3 → go-toolset:1.26.5-1785443561 with updated digest pin), but the PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. Human approval is required for all protected-path changes.
Remediation: A human reviewer should verify this Docker base image update is appropriate and approve the protected-path change.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (62)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — Dockerfile.dist is a protected path (matches Dockerfile prefix). This automated Renovate bot PR updates the go-toolset Docker image tag from 1.26.3 to 1.26.5-1785443561 with an updated sha256 digest pin, but has no linked issue providing explicit authorization for modifying a governance/infrastructure file. The image is pulled from the official Red Hat registry (registry.access.redhat.com) and remains digest-pinned, which is correct for supply chain integrity. Note: renovate.json is configured in the repository (extending github>conforma/.github//config/renovate/renovate.json), providing implicit authorization for Docker image tag management by the MintMaker/Renovate bot.
Remediation: Protected-path changes require human approval regardless of automation source. A maintainer should review and approve this Dockerfile change.

Previous run (63)

Review

Findings

High

[protected-path] Dockerfile.dist — This file matches the protected path Dockerfile and requires human approval. The PR has no linked issue justifying the modification of build infrastructure files. While this is an automated Renovate dependency update (Docker tag bump from 1.26.3 to 1.26.5-1785360201 with digest pin), protected-path changes require explicit authorization via a linked issue regardless of the change's mechanical nature.
Remediation: Link an issue or provide explicit authorization for modifying protected build infrastructure files, or have a human maintainer approve the change directly.

Previous run (64)

Looks good to me — this is a routine Docker base image tag bump by Renovate (go-toolset 1.26.3 → 1.26.5-1785156757). The image reference is properly pinned by SHA256 digest. Dockerfile.dist is a protected path and requires human approval.

Previous run (65)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — Dockerfile.dist is under a protected path (Dockerfile*). This PR modifies a governance/infrastructure file without a linked issue providing explicit authorization. The change is an automated Renovate bot Docker image tag bump (go-toolset 1.26.3 → 1.26.5-1785156757) with digest pinning, which appears legitimate, but human approval is required for all protected-path changes regardless of automation source.
Remediation: Obtain human approval for this protected-path change. Consider linking a tracking issue or policy that authorizes automated Dockerfile updates by Renovate/MintMaker.

Previous run (66)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which matches the protected path Dockerfile. Protected paths cover governance and infrastructure files that require explicit human approval. The PR has no linked issue providing authorization for the change. While the PR description and labels (renovate, dependencies, docker) indicate this is a Renovate-managed Docker base image tag bump (go-toolset 1.26.3 → 1.26.5-1785111405 with updated digest), human review and approval is required for all protected-path changes.
Remediation: A repository maintainer should review and approve this Dockerfile change. No code changes are needed — this is a governance gate, not a code defect. The change itself is a straightforward digest-pinned image tag bump with no functional risk.

Previous run (67)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This file matches a protected path (Dockerfile). The PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. While the change is an automated Renovate Docker tag update (1.26.3 → 1.26.5-1784751462) with proper digest pinning, human approval is always required for protected-path changes.
Remediation: Link an authorizing issue or have a maintainer explicitly approve the change.

Previous run (68)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which falls under the protected path Dockerfile. Protected paths cover governance and infrastructure files that require human approval. The PR has no linked issue justifying the change to this protected path. While this is an automated Renovate Docker tag/digest update (go-toolset 1.26.3 → 1.26.5-1784751462) and the code change itself is sound — the image reference remains properly pinned by digest — human approval is required for all protected-path modifications.
Remediation: Ensure a human reviewer with appropriate authority approves changes to Dockerfile.dist.

Previous run (69)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the Dockerfile protected path. No linked issue authorizes changes to this governance/infrastructure file. While the change is a routine Renovate Docker image tag bump (go-toolset 1.26.3 → 1.26.5-1784751462) with a pinned sha256 digest, human approval is required for all protected-path changes.
Remediation: Obtain human approval for this protected-path change, or link an issue that authorizes the Dockerfile update.

Previous run (70)

Review

Findings

High

[protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which matches the Dockerfile protected path. The PR has no linked issue providing explicit authorization for the change. While the PR is authored by the configured Renovate bot (red-hat-konflux[bot]) and renovate.json exists in the repository authorizing automated dependency updates, human approval is always required for protected-path changes. No correctness or security concerns were identified with the Docker tag update itself (go-toolset:1.26.3 → 1.26.5-1784638038, with pinned SHA256 digest).
Remediation: A human reviewer should verify and approve this Docker base image update.

Previous run (71)

Review

Findings

High

[protected-path] Dockerfile.dist:19 — This file matches the Dockerfile protected path pattern. The PR modifies an infrastructure file that requires human approval. No linked issue authorizes these changes. The repository's renovate.json configuration and the renovate label indicate this is an automated dependency management update (go-toolset 1.26.3 → 1.26.5-1784638038 with pinned digest), but human review is always required for protected-path changes.
Remediation: Ensure a human reviewer approves changes to protected infrastructure files (Dockerfiles). Consider linking a tracking issue or configuring automated authorization for routine Renovate Docker tag updates.

Previous run (72)

Review

No blocking findings. This is a mechanical Renovate dependency update bumping the ubi9/go-toolset base image tag from 1.26.3 to 1.26.5-1784190466 with an updated digest pin in Dockerfile.dist.

Note: Dockerfile.dist matches a protected path (Dockerfile). Changes to protected paths always require human approval. Repository Renovate configuration (renovate.json) authorizes automated Docker tag updates.

fullsend-ai-review · 2026-06-30T02:00:19Z

🤖 Finished Review · ✅ Success · Started 2:00 AM UTC · Completed 2:06 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-30T02:12:10Z

🤖 Finished Review · ✅ Success · Started 2:12 AM UTC · Completed 2:17 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-07-01T02:05:30Z

🤖 Finished Review · ✅ Success · Started 2:05 AM UTC · Completed 2:11 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-07-02T02:04:38Z

🤖 Finished Review · ✅ Success · Started 2:04 AM UTC · Completed 2:09 AM UTC
Commit: 47d3320 · View workflow run →

Superseded by updated review

fullsend-ai-review · 2026-10-02T02:17:34Z

🤖 Finished Review · ❌ Failure (ensuring provider "github-ro": provider create "github-ro" failed: exit status 1 (output: Error: × code: 'Client specified an invalid argument', message: "provider │ credentials are not declared by pr…) · Started 2:17 AM UTC · Completed 2:17 AM UTC

Commit: 7ebcab7 · View workflow run →

Effort: high

fullsend-ai-review · 2026-10-02T02:34:33Z

🤖 Finished Review · ❌ Failure (ensuring provider "vertex-ai": provider create "vertex-ai" failed: exit status 1 (output: Error: × code: 'Client specified an invalid argument', message: "provider │ credentials are not declared by pr…) · Started 2:34 AM UTC · Completed 2:34 AM UTC

Commit: abb6ede · View workflow run →

Effort: high

fullsend-ai-review · 2026-10-07T01:59:31Z

🤖 Finished Review · ❌ Failure (ensuring provider "vertex-ai": provider create "vertex-ai" failed: exit status 1 (output: Error: × code: 'Client specified an invalid argument', message: "provider │ credentials are not declared by pr…) · Started 1:59 AM UTC · Completed 1:59 AM UTC

Commit: 268632c · View workflow run →

Effort: high

fullsend-ai-review · 2026-10-08T02:28:51Z

🤖 Review · ⚠️ Cancelled · Ended 2:28 AM UTC

Commit: 3129a5b · View workflow run →

jsmid1

lgtm

fullsend-ai-review · 2026-10-09T03:01:55Z

🤖 Review · ⚠️ Cancelled · Ended 3:01 AM UTC

Commit: dd5141a · View workflow run →

Acepresso

LGTM

fullsend-ai-review · 2026-10-23T03:00:52Z

🤖 Review · ⚠️ Cancelled · Ended 3:00 AM UTC

Commit: 0b3b2cf · View workflow run →

fullsend-ai-review · 2026-10-26T02:07:13Z

🤖 Review · ⚠️ Cancelled · Ended 2:07 AM UTC

Commit: 9dba14e · View workflow run →

fullsend-ai-review · 2026-11-04T02:22:17Z

🤖 Review · ⚠️ Cancelled · Ended 2:22 AM UTC

Commit: 7cc98fb · View workflow run →

fullsend-ai-review · 2026-11-04T02:31:22Z

🤖 Review · ⚠️ Cancelled · Ended 2:31 AM UTC

Commit: 9753ea8 · View workflow run →

fullsend-ai-review · 2026-11-06T03:24:23Z

🤖 Review · ⚠️ Cancelled · Ended 3:24 AM UTC

Commit: 2917301 · View workflow run →

fullsend-ai-review · 2026-11-06T03:24:24Z

/fs-review

….10-1794208260 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-11-13T01:59:41Z

 ## Build

-FROM registry.access.redhat.com/ubi9/go-toolset:1.26.7@sha256:685ccca486cc2c82b0818d835abecb1aed7a396e76ba416cfc47c28067f5d365 AS build
+FROM registry.access.redhat.com/ubi9/go-toolset:1.26.10-1794208260@sha256:0e3894cea4fc077084245e8aa2befc8a7d91a4f60fbf850f0b5b555cbe62ee26 AS build


[high] protected-path

This PR modifies Dockerfile.dist, which is under the protected path prefix Dockerfile. The PR has no linked issue justifying the change to governance/infrastructure files. Human approval is required for protected-path changes.

Suggested fix: Obtain human reviewer approval for this protected-path change. Renovate bot changes to Dockerfiles are expected when configured via renovate.json, but protected-path policy requires explicit human sign-off.

red-hat-konflux Bot added main renovate labels Jun 27, 2026

red-hat-konflux Bot enabled auto-merge June 27, 2026 02:00

github-actions Bot added the size: XS label Jun 27, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/registry.access.redhat.com-ubi9-go-toolset-1.26.x branch from a1fc84c to 76c8528 Compare June 27, 2026 02:03

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/registry.access.redhat.com-ubi9-go-toolset-1.26.x branch from 76c8528 to 0148438 Compare June 27, 2026 02:08

This comment was marked as outdated.

Sign in to view

fullsend-ai-review Bot added docker Pull requests that update Docker code dependencies Pull requests that update a dependency file labels Jun 27, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/registry.access.redhat.com-ubi9-go-toolset-1.26.x branch from 0148438 to 0a0bd15 Compare June 30, 2026 01:57

red-hat-konflux Bot changed the title ~~Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.3-1782377916 (main)~~ Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.4-1782736563 (main) Jun 30, 2026

This comment was marked as outdated.

Sign in to view

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/registry.access.redhat.com-ubi9-go-toolset-1.26.x branch from 0a0bd15 to a3fb045 Compare June 30, 2026 02:08

This comment was marked as outdated.

Sign in to view

red-hat-konflux Bot changed the title ~~Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.4-1782736563 (main)~~ Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.4-1782852234 (main) Jul 1, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/registry.access.redhat.com-ubi9-go-toolset-1.26.x branch from a3fb045 to 9c2a747 Compare July 1, 2026 02:02

This comment was marked as outdated.

Sign in to view

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/registry.access.redhat.com-ubi9-go-toolset-1.26.x branch from 9c2a747 to 7d0d6a4 Compare July 2, 2026 02:01

red-hat-konflux Bot changed the title ~~Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.4-1782852234 (main)~~ Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.4-1782910875 (main) Jul 2, 2026

Acepresso previously approved these changes Oct 8, 2026

View reviewed changes

jsmid1 previously approved these changes Oct 8, 2026

View reviewed changes

Acepresso previously approved these changes Oct 15, 2026

View reviewed changes

Acepresso previously approved these changes Oct 21, 2026

View reviewed changes

This comment was marked as outdated.

Sign in to view

Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26…

6031fd4

….10-1794208260 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

fullsend-ai-review Bot suggested changes Nov 13, 2026

View reviewed changes

Conversation

red-hat-konflux Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Configuration

Documentation

Uh oh!

fullsend-ai-review Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Findings

High

Review

Findings

High

Review

Findings

High

Review

Findings

High

Review

Review

Findings

High

Review

Findings

High

Review

Findings

High

Review

Findings

High

Review

Findings

High

Review

Findings

High

Review

Findings

High

Review

Findings

High

Review

Findings

High

Review

Findings

High

Review

Findings

Medium

Review

Findings

Medium

Review

Findings

Medium

Info

Review

Findings

Info

Review

Findings

High

Review

Findings

Info

Review

Findings

Medium

Review

red-hat-konflux Bot commented Jun 27, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 27, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 27, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 27, 2026 •

edited

Loading