Skip to content

🚨 Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9 (main) #3375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
red-hat-konflux wants to merge 1 commit into
base: main
Choose a base branch
from
Open

🚨 Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9 (main) #3375

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile.dist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

## Build

FROM registry.access.redhat.com/ubi9/go-toolset:1.26.7@sha256:685ccca486cc2c82b0818d835abecb1aed7a396e76ba416cfc47c28067f5d365 AS build
FROM registry.access.redhat.com/ubi9/go-toolset:9.9-1794518352@sha256:4053e919374d739ee6b0007e412d89256b0bd065e0bc690c2b3905bbaab6500e AS build

Check failure on line 19 in Dockerfile.dist

View workflow job for this annotation

GitHub Actions / Test 

Containerfile version incompatible, saw 9.9, running with version: 1.26.7

@fullsend-ai-review fullsend-ai-review Bot Nov 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] api-contract

The go-toolset image tag changed from a Go-version-based tag (1.26.7) to a RHEL-version-based tag (9.9-1794518352). The project's go.mod requires go 1.26.7. If the new image does not bundle Go 1.26.x, the build will either fail (if the bundled Go is older than what go.mod requires) or silently produce binaries compiled with an unintended Go version. The digest pin ensures reproducibility but does not guarantee Go version compatibility. This tag scheme change makes the Go version opaque from the Dockerfile alone.

Suggested fix: Verify that the image at sha256:4053e919374d739ee6b0007e412d89256b0bd065e0bc690c2b3905bbaab6500e ships Go 1.26.x (e.g., by running podman run --rm registry.access.redhat.com/ubi9/go-toolset:9.9-1794518352@sha256:4053e919374d739ee6b0007e412d89256b0bd065e0bc690c2b3905bbaab6500e go version). If it ships a different Go version, either update go.mod to match or revert to a tag that bundles Go 1.26.x. Consider adding a build-time check (e.g., RUN go version | grep -q go1.26) to catch future mismatches.


ARG TARGETOS
ARG TARGETARCH
Expand Down
Loading