[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi9/go-toolset	stage	major	1.26.7 → 9.9-1794518352

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:25 AM UTC · Completed 2:34 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [api-contract] Dockerfile.dist:19 — The go-toolset image tag changed from a Go-version-based tag (1.26.7) to a RHEL-version-based tag (9.9-1794518352). The project's go.mod requires go 1.26.7. If the new image does not bundle Go 1.26.x, the build will either fail (if the bundled Go is older than what go.mod requires) or silently produce binaries compiled with an unintended Go version. The digest pin ensures reproducibility but does not guarantee Go version compatibility. This tag scheme change makes the Go version opaque from the Dockerfile alone.
  Remediation: Verify that the image at sha256:4053e919374d739ee6b0007e412d89256b0bd065e0bc690c2b3905bbaab6500e ships Go 1.26.x (e.g., by running podman run --rm registry.access.redhat.com/ubi9/go-toolset:9.9-1794518352@sha256:4053e919374d739ee6b0007e412d89256b0bd065e0bc690c2b3905bbaab6500e go version). If it ships a different Go version, either update go.mod to match or revert to a tag that bundles Go 1.26.x. Consider adding a build-time check (e.g., RUN go version | grep -q 'go1.26') to catch future mismatches.

• [protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which falls under the protected path prefix Dockerfile. The PR has no linked issue providing justification for modifying governance or infrastructure files. Human approval is required for protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W3sic2V2ZXJpdHkiOiJoaWdoIiwiY2F0ZWdvcnkiOiJhcGktY29udHJhY3QiLCJmaWxlIjoiRG9ja2VyZmlsZS5kaXN0IiwibGluZSI6MTl9XX0= -->

Previous run

Review

Findings

High

• [api-contract] Dockerfile.dist:19 — The go-toolset image tag changes from Go-version-based tagging (1.26.3) to UBI-release-based tagging (9.8-1786023237). The tag 9.8 refers to the RHEL 9.8 OS minor release, not the Go version. It is not possible to determine from the tag alone which Go version is bundled in this image. If the bundled Go version does not satisfy the go 1.26.3 directive in go.mod, the build will fail. Additionally, this tag scheme change means future Renovate updates will track UBI OS releases (9.8 → 9.9 → ...) rather than Go versions (1.26.3 → 1.26.4 → ...), risking silent Go toolchain changes on subsequent updates.
  Remediation: Verify the Go version bundled in the image at sha256:5d26ff5606bd6590930e7cfc202b510e3fe2c7a7a1720860f444ab49c45128cb (e.g., via podman run --rm <image> go version). If the Go version is compatible, reconfigure Renovate (via packageRules or versioning in renovate.json) to continue tracking Go-version-based tags for this image, preventing future updates from silently changing the Go toolchain.

• [protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which is under the protected Dockerfile path. The PR has no linked issue providing authorization for the change. Human approval is required for all protected-path changes regardless of context.

Low

• [stale-reference] Dockerfile.dist:19 — After this change, Dockerfile uses golang:1.26.3 (explicitly Go-version-pinned) while Dockerfile.dist uses go-toolset:9.8-1786023237 (UBI-release-pinned, Go version opaque). These are intentionally different base images from different registries, but both should provide the same Go version for consistent build behavior. This concern is covered by the api-contract finding above.

Info

• [sub-agent-failure] The style-conventions sub-agent was unavailable due to model deployment configuration. This is a mechanical Docker tag update which would trigger the sub-agent's early exit criteria, so no style findings are expected.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review — ⚠ Changes Requested

Summary

This automated Renovate PR changes the go-toolset base image tag in Dockerfile.dist from a Go-version-based tag (1.26.3) to a UBI9-release-based tag (9.8-1784190466). While the image is digest-pinned (ensuring the exact image used today is deterministic), the change in tagging scheme introduces correctness and maintainability risks.

---

Findings

🔴 High: Go version tagging scheme change risks build correctness (Dockerfile.dist, line 19)

The tag changes from go-toolset:1.26.3 (tracking the bundled Go version) to go-toolset:9.8-1784190466 (tracking the UBI9 OS release version). This is not a standard version bump — it switches the entire version dimension.

Immediate risk: The project requires Go 1.26.3 (declared in go.mod line 3, and explicitly used in Dockerfile line 19 as golang:1.26.3). It is unclear whether the image at sha256:f99dd8... bundles Go 1.26.3 or a different Go version. If the Go version differs, the build may fail or produce binaries compiled with an unintended toolchain.

Ongoing risk: Future Renovate updates will now track UBI9 release versions (9.8 → 9.9 → ...) rather than Go versions (1.26.3 → 1.26.4 → ...). This means future updates could silently change the Go toolchain version without any indication in the tag, breaking the build or introducing subtle compilation differences.

Remediation:

1. Verify that the image at sha256:f99dd81b20e5971ef9f63a51ac27cf0aa591ff9921d021490548b67fd9b17144 actually bundles Go 1.26.3 (e.g., podman run --rm <image> go version).
2. If it does, reconfigure Renovate to continue tracking Go-version-based tags for this image (e.g., via versioning or packageRules in renovate.json) so future updates stay on the Go version track.
3. If it does not contain Go 1.26.3, reject this update.

🟡 Medium: Build path divergence between Dockerfiles (Dockerfile.dist, line 19)

After this change, the two Dockerfiles track Go versions via different mechanisms:

• Dockerfile uses golang:1.26.3 — explicitly Go-version-pinned
• Dockerfile.dist would use go-toolset:9.8-1784190466 — UBI-release-pinned, Go version opaque

This divergence makes it harder to reason about Go version consistency across the two build paths and increases the risk that they drift apart silently during future dependency updates.

---

Verdict

The tagging scheme change introduces ambiguity about the Go version used in the distribution build. Before merging, please verify the Go version in the new image and consider reconfiguring Renovate to continue tracking Go-version-based tags for go-toolset.

Previous run (3)

Review

Findings

High

• [protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which is under the protected Dockerfile path. The PR has no linked issue and the description (standard Renovate template) does not explain why this protected file needs to be changed. Protected paths (Dockerfiles, CI config, governance files) require human approval regardless of context. While this is a Renovate bot dependency update and renovate.json is configured in the repo, human review is required before merging changes to protected infrastructure files.
  Remediation: A human maintainer should review and approve this Docker base image major version bump (go-toolset:1.26.3 → go-toolset:9.8-1782980183). Verify that the new image tag and digest are correct and that the major version change does not break the build. The version scheme change (from Go-version-based 1.x to UBI-version-based 9.x tagging) should be validated.

---

Labels: PR updates a Docker base image dependency in a Dockerfile.

Previous run (4)

Review

Findings

High

• [api-contract] Dockerfile.dist:19 — The go-toolset image tag is changing from 1.26.3 (a Go-version-based tag that clearly matched the go 1.26.3 directive in go.mod) to 9.8-1782852234 (a UBI platform-release tag). It is not verifiable from the diff alone which Go version ships in the 9.8-1782852234 image. If it ships a Go version other than 1.26.3, compilation may fail or succeed with an unintended toolchain version.
  Remediation: Before merging, verify that the image at go-toolset:9.8-1782852234@sha256:9ef42b... ships Go 1.26.x by inspecting the image metadata (e.g., skopeo inspect or podman run ... go version). If it does not, either (a) find the correct go-toolset tag that provides Go 1.26.3, or (b) update go.mod, Dockerfile, and any CI references to the new Go version simultaneously.

• [protected-path] Dockerfile.dist — This file is under a protected path (Dockerfile). The PR has no linked issue and the description does not explain why this governance/infrastructure file is being changed beyond stating it is an automated dependency update. Human approval is required for all protected-path changes.
  Remediation: Link a justifying issue or have a maintainer explicitly approve this protected-path change.

Low

• [stale-reference] Dockerfile:19 — The non-dist Dockerfile uses docker.io/library/golang:1.26.3 while Dockerfile.dist is moving to go-toolset:9.8-1782852234. These are different base images from different registries with different tagging conventions, managed as separate Renovate dependencies. The only substantive concern is whether both images provide the same Go version.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:21 AM UTC · Completed 2:28 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:17 AM UTC · Completed 2:21 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 5:36 PM UTC · Completed 5:47 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3375 — Renovate go-toolset major version bump (autoclosed)

Timeline

• 2026-07-01: MintMaker/Renovate bot opened PR #3375 to update the go-toolset Docker tag in Dockerfile.dist from 1.26.3 (Go-version-based) to 9.8-1782852234 (UBI-release-based). A single-line change.
• 2026-07-01: Review agent ran and requested changes with two high-severity findings: the Go version in the new image was unverifiable, and Dockerfile.dist is a protected path.
• 2026-07-03: Renovate rebased the PR. Review agent ran again and requested changes, this time finding only the protected-path issue.
• 2026-07-19: Renovate updated the PR (new tag 9.8-1784190466). Review agent ran a third time and requested changes with improved findings: the tag dimension switch risks silent Go toolchain changes, and the two Dockerfiles now track Go versions via incompatible schemes.
• PR was autoclosed without ever receiving human review or being merged.

Assessment

Review quality was good. The review agent correctly identified a genuine correctness risk — the tagging scheme change means future Renovate updates would track UBI OS releases instead of Go versions, risking silent toolchain drift. The suggested remediation (verify Go version in the image, reconfigure Renovate to track Go-version-based tags) was actionable and appropriate. The third review was the most comprehensive and well-structured, showing improvement over iterations.

The core inefficiency is well-documented. Three review agent runs on a bot PR that no human ever engaged with, followed by a retro agent run on the autoclosed result, consumed resources without driving any outcome. This is the same pattern identified across multiple prior retros.

No new proposals — existing issues cover all findings

Every improvement opportunity surfaced by this PR is already tracked by open issues:

• conforma/cli #3420: Skip fullsend agent dispatch for MintMaker/Renovate dependency PRs. This PR provides additional evidence — 3 review runs over 34 days on a bot PR with zero human engagement.
• fullsend-ai/fullsend #4596: Avoid full re-reviews when Renovate rebases without content changes. The semantic change was identical across all 3 rebases, but each triggered a full review.
• fullsend-ai/fullsend #5817: Consolidate 22+ overlapping "skip dispatch" issues. The sheer volume of open issues (#5067, #4154, Dep bump v0.7 #3221, chore(deps): update rhtap references (main) #1371, #5295, #5360, #4293, etc.) indicates this is a known platform-level gap awaiting a unified design.
• fullsend-ai/agents #257 / #368: Pre-review early exit for bot-authored dependency PRs.
• fullsend-ai/fullsend #3015: Screen Renovate PRs with major version bumps for breaking changes — this PR is a case where review did add value by catching a major version tagging scheme change, suggesting a nuanced approach (skip trivial bot PRs, still review major bumps) rather than blanket skip.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:47 AM UTC · Completed 2:58 AM UTC

Commit: 87c4a29 · View workflow run →

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The Docker build stage now uses the pinned ubi9/go-toolset:9.9-1794518352 image instead of ubi9/go-toolset:1.26.7.

Changes: Build image

Layer / File(s)	Summary
Update build-stage image Dockerfile.dist	The build stage uses the pinned ubi9/go-toolset:9.9-1794518352 image with a new pinned digest.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: simonbaird, acepresso, st3penta

Merge Risk: Minimal · up to db7ab

This updates the build-stage base image to a newer pinned UBI Go toolset. No concrete defect is established. The build should still be checked in CI, since the new tag no longer encodes a Go version.

Pre-merge checks: 3 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Description check		The description follows the spirit of the template's What/Why/Tickets structure in a limited way. It is an automated Renovate update that explains the image change in a table, with schedule, automerge…	Add a 'What' section that states the change: the build stage in Dockerfile.dist now uses ubi9/go-toolset:9.9-1794518352 instead of 1.26.7. Add a 'Why' section that gives the reason for the major version update. Add a 'Tickets' section with …

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title says the registry.access.redhat.com/ubi9/go-toolset Docker tag is updated to v9 on main. The change in the changeset updates the Dockerfile.dist build stage image from ubi9/go-toolset:1.26.7…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title says the registry.access.redhat.com/ubi9/go-toolset Docker tag is updated to v9 on main. The change in the changeset updates the Dockerfile.dist build stage image from ubi9/go-toolset:1.26.7 to ubi9/go-toolset:9.9-1794518352. The title matches the main change. It contains a leading emoji, which the guidelines discourage, but the title is otherwise specific and accurate.

Full details: Description check

Explanation

The description follows the spirit of the template's What/Why/Tickets structure in a limited way. It is an automated Renovate update that explains the image change in a table, with schedule, automerge, and rebase settings. It does not include the 'What' or 'Why' sections in the template format, and the Tickets section is missing. The change itself is clear. The description states the package, the type, and the version change, but it gives no rationale beyond the automated update and no linked ticket.

Resolution

Add a 'What' section that states the change: the build stage in Dockerfile.dist now uses ubi9/go-toolset:9.9-1794518352 instead of 1.26.7. Add a 'Why' section that gives the reason for the major version update. Add a 'Tickets' section with a linked Jira issue, or state that none exists.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: b4978ecb-4af0-4563-8238-b00a38355cba

Commits

Reviewing files that changed from the base of the PR and between d688683 and db7abb8.

Files selected for processing: 1

• Dockerfile.dist

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 7 remain after this review.

[fullsend-ai-review]

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Bot-authored single-line Dockerfile tag update with minimal change surface, but one protected-path hit and a file with notably high author diversity and churn rate over the past 30-90 days nudge the score to moderate.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] api-contract

The go-toolset image tag changed from a Go-version-based tag (1.26.7) to a RHEL-version-based tag (9.9-1794518352). The project's go.mod requires go 1.26.7. If the new image does not bundle Go 1.26.x, the build will either fail (if the bundled Go is older than what go.mod requires) or silently produce binaries compiled with an unintended Go version. The digest pin ensures reproducibility but does not guarantee Go version compatibility. This tag scheme change makes the Go version opaque from the Dockerfile alone.

Suggested fix: Verify that the image at sha256:4053e919374d739ee6b0007e412d89256b0bd065e0bc690c2b3905bbaab6500e ships Go 1.26.x (e.g., by running podman run --rm registry.access.redhat.com/ubi9/go-toolset:9.9-1794518352@sha256:4053e919374d739ee6b0007e412d89256b0bd065e0bc690c2b3905bbaab6500e go version). If it ships a different Go version, either update go.mod to match or revert to a tag that bundles Go 1.26.x. Consider adding a build-time check (e.g., RUN go version | grep -q go1.26) to catch future mismatches.