chore(deps): update registry.access.redhat.com/ubi9/ubi-minimal:latest docker digest to 7fbeae1 main - #440
Conversation
red-hat-konflux
Bot
added
approved
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
1 similar comment
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 12 included reviews per hour; 8 remain after this review. WalkthroughThe pull request updates the pinned UBI image digests in the runtime and bundle Dockerfiles. Build and runtime instructions remain unchanged. ChangesContainer Image Updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to This PR only updates the UBI9 minimal base-image digest in the Dockerfiles; no actionable merge-blocking risk remains, so it is merge-ready after normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.) Full details: Stable And Deterministic Test NamesExplanation PASS. The pull request changes only the pinned UBI9 minimal image digest in Full details: Test Structure And QualityExplanation PASS: The pull request changes only the UBI image digest in Full details: Microshift Test CompatibilityExplanation PASS: The pull request changes only the pinned UBI9 image digest in Dockerfile and bundle.Dockerfile. The parent-to-HEAD diff contains no new Ginkgo e2e tests, OpenShift API references, namespaces, or MicroShift feature assumptions. The custom check is therefore not applicable. Full details: Single Node Openshift (Sno) Test CompatibilityExplanation PASS: The pull request changes only the pinned UBI9 minimal image digest in Full details: Topology-Aware Scheduling CompatibilityExplanation PASS: The pull request changes only the pinned UBI9 image digest in Full details: Ote Binary Stdout ContractExplanation PASS: The pull request changes only the pinned UBI9 minimal image digest in Full details: Ipv6 And Disconnected Network Test CompatibilityExplanation PASS. The pull request changes only the pinned UBI9 image digest in Full details: No-Weak-CryptoExplanation PASS. The pull request changes only the pinned UBI9 image digest in Full details: Container-PrivilegesExplanation PASS. The PR changes only the UBI9 image digest in Full details: No-Sensitive-Data-In-LogsExplanation PASS: The commit changes only the UBI9 image digest in ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 7: Replace the digest-pinned Red Hat base image reference with the
floating registry.access.redhat.com/ubi9/ubi-minimal:latest tag in Dockerfile
lines 7-7 and bundle.Dockerfile lines 22-22; both container definitions require
the same unpinned image reference.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2c0d546e-86f8-4c72-8ac9-9424c7476c06
📒 Files selected for processing (2)
Dockerfilebundle.Dockerfile
| RUN make build --warn-undefined-variables | ||
|
|
||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:48fa5d8cda7fc00d270d8747c3eaa54ae196f0820d8540074a9c8c61d5e3056f | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7c372902c8d211db2d25c8277ba534a73b92742a334874dced829a63b0f21221 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for file in Dockerfile bundle.Dockerfile; do
if rg -n '^FROM\s+registry\.access\.redhat\.com/ubi9/ubi-minimal:[^[:space:]]+@sha256:' "$file"; then
echo "$file still pins a Red Hat UBI image digest" >&2
exit 1
fi
doneRepository: openshift/jobset-operator
Length of output: 342
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for file in Dockerfile bundle.Dockerfile; do
echo "== $file =="
rg -n '^FROM[[:space:]]+' "$file"
done
python3 - <<'PY'
from pathlib import Path
import re
pattern = re.compile(
r"^FROM\s+registry\.access\.redhat\.com/ubi9/ubi-minimal:(\S+)$"
)
for name in ("Dockerfile", "bundle.Dockerfile"):
text = Path(name).read_text().splitlines()
matches = [(i + 1, line) for i, line in enumerate(text) if pattern.match(line)]
print(f"{name}:")
for line_no, line in matches:
print(f" line {line_no}: {'digest-pinned' if '`@sha256`:' in line else 'tag-only'}")
PYRepository: openshift/jobset-operator
Length of output: 719
Use floating Red Hat image tags in both container definitions.
Remove @sha256:... from Dockerfile#L7 and bundle.Dockerfile#L22. Use registry.access.redhat.com/ubi9/ubi-minimal:latest.
📍 Affects 2 files
Dockerfile#L7-L7(this comment)bundle.Dockerfile#L22-L22
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 7, Replace the digest-pinned Red Hat base image reference
with the floating registry.access.redhat.com/ubi9/ubi-minimal:latest tag in
Dockerfile lines 7-7 and bundle.Dockerfile lines 22-22; both container
definitions require the same unpinned image reference.
Source: Path instructions
76fefcc to
7cbf787
Compare
red-hat-konflux
Bot
changed the title
|
New changes are detected. LGTM label has been removed. |
7cbf787 to
16d1201
Compare
…t docker digest to 7fbeae1 main Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
16d1201 to
721e4d4
Compare
red-hat-konflux
Bot
changed the title
|
@red-hat-konflux[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR contains the following updates:
48fa5d8→7fbeae1Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.