🚨 Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9 (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi9/go-toolset	stage	major	1.26.3 → 9.8-1784190466

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:25 AM UTC · Completed 2:34 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review — ⚠ Changes Requested

Summary

This automated Renovate PR changes the go-toolset base image tag in Dockerfile.dist from a Go-version-based tag (1.26.3) to a UBI9-release-based tag (9.8-1784190466). While the image is digest-pinned (ensuring the exact image used today is deterministic), the change in tagging scheme introduces correctness and maintainability risks.

---

Findings

🔴 High: Go version tagging scheme change risks build correctness (Dockerfile.dist, line 19)

The tag changes from go-toolset:1.26.3 (tracking the bundled Go version) to go-toolset:9.8-1784190466 (tracking the UBI9 OS release version). This is not a standard version bump — it switches the entire version dimension.

Immediate risk: The project requires Go 1.26.3 (declared in go.mod line 3, and explicitly used in Dockerfile line 19 as golang:1.26.3). It is unclear whether the image at sha256:f99dd8... bundles Go 1.26.3 or a different Go version. If the Go version differs, the build may fail or produce binaries compiled with an unintended toolchain.

Ongoing risk: Future Renovate updates will now track UBI9 release versions (9.8 → 9.9 → ...) rather than Go versions (1.26.3 → 1.26.4 → ...). This means future updates could silently change the Go toolchain version without any indication in the tag, breaking the build or introducing subtle compilation differences.

Remediation:

1. Verify that the image at sha256:f99dd81b20e5971ef9f63a51ac27cf0aa591ff9921d021490548b67fd9b17144 actually bundles Go 1.26.3 (e.g., podman run --rm <image> go version).
2. If it does, reconfigure Renovate to continue tracking Go-version-based tags for this image (e.g., via versioning or packageRules in renovate.json) so future updates stay on the Go version track.
3. If it does not contain Go 1.26.3, reject this update.

🟡 Medium: Build path divergence between Dockerfiles (Dockerfile.dist, line 19)

After this change, the two Dockerfiles track Go versions via different mechanisms:

• Dockerfile uses golang:1.26.3 — explicitly Go-version-pinned
• Dockerfile.dist would use go-toolset:9.8-1784190466 — UBI-release-pinned, Go version opaque

This divergence makes it harder to reason about Go version consistency across the two build paths and increases the risk that they drift apart silently during future dependency updates.

---

Verdict

The tagging scheme change introduces ambiguity about the Go version used in the distribution build. Before merging, please verify the Go version in the new image and consider reconfiguring Renovate to continue tracking Go-version-based tags for go-toolset.

Previous run

Review

Findings

High

• [protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which is under the protected Dockerfile path. The PR has no linked issue and the description (standard Renovate template) does not explain why this protected file needs to be changed. Protected paths (Dockerfiles, CI config, governance files) require human approval regardless of context. While this is a Renovate bot dependency update and renovate.json is configured in the repo, human review is required before merging changes to protected infrastructure files.
  Remediation: A human maintainer should review and approve this Docker base image major version bump (go-toolset:1.26.3 → go-toolset:9.8-1782980183). Verify that the new image tag and digest are correct and that the major version change does not break the build. The version scheme change (from Go-version-based 1.x to UBI-version-based 9.x tagging) should be validated.

---

Labels: PR updates a Docker base image dependency in a Dockerfile.

Previous run (2)

Review

Findings

High

• [api-contract] Dockerfile.dist:19 — The go-toolset image tag is changing from 1.26.3 (a Go-version-based tag that clearly matched the go 1.26.3 directive in go.mod) to 9.8-1782852234 (a UBI platform-release tag). It is not verifiable from the diff alone which Go version ships in the 9.8-1782852234 image. If it ships a Go version other than 1.26.3, compilation may fail or succeed with an unintended toolchain version.
  Remediation: Before merging, verify that the image at go-toolset:9.8-1782852234@sha256:9ef42b... ships Go 1.26.x by inspecting the image metadata (e.g., skopeo inspect or podman run ... go version). If it does not, either (a) find the correct go-toolset tag that provides Go 1.26.3, or (b) update go.mod, Dockerfile, and any CI references to the new Go version simultaneously.

• [protected-path] Dockerfile.dist — This file is under a protected path (Dockerfile). The PR has no linked issue and the description does not explain why this governance/infrastructure file is being changed beyond stating it is an automated dependency update. Human approval is required for all protected-path changes.
  Remediation: Link a justifying issue or have a maintainer explicitly approve this protected-path change.

Low

• [stale-reference] Dockerfile:19 — The non-dist Dockerfile uses docker.io/library/golang:1.26.3 while Dockerfile.dist is moving to go-toolset:9.8-1782852234. These are different base images from different registries with different tagging conventions, managed as separate Renovate dependencies. The only substantive concern is whether both images provide the same Go version.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:21 AM UTC · Completed 2:28 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:17 AM UTC · Completed 2:21 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] correctness

The base image tag changes from Go-version-based (1.26.3) to UBI9-release-based (9.8-1784190466), switching the version dimension entirely. The project requires Go 1.26.3 (go.mod, Dockerfile), but the new tag does not indicate which Go version is bundled. Future Renovate updates will track UBI releases rather than Go versions, risking silent Go toolchain changes.

Suggested fix: Verify the new image contains Go 1.26.3 (e.g., podman run --rm go version). Reconfigure Renovate to track Go-version-based tags for go-toolset via packageRules or versioning settings in renovate.json.

[fullsend-ai-review]

[medium] correctness

After this change, the two Dockerfiles track Go versions differently: Dockerfile uses golang:1.26.3 (explicitly Go-version-pinned), while Dockerfile.dist uses go-toolset:9.8-1784190466 (UBI-release-pinned, Go version opaque). This divergence makes it harder to maintain Go version consistency across build paths.

Suggested fix: Keep Dockerfile.dist on Go-version-based tags (e.g., go-toolset:1.26.3) to maintain parity with Dockerfile.