chore(deps): update quay.io/konflux-ci/oras:latest docker digest to 1cc659b

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/oras	stage	digest	c4fb02d → 1cc659b

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:39 AM UTC · Completed 5:46 AM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] Dockerfile — Dockerfile is a protected governance/infrastructure file. This automated Renovate digest update (quay.io/konflux-ci/oras SHA256 pin rotation from c4fb02d → 4d290ab) is a mechanical change from the red-hat-konflux[bot] account. The image reference remains properly pinned by digest, and the change is consistent with standard MintMaker/Renovate dependency management. Human approval is always required for protected-path modifications regardless of the change's nature or authorship.

Previous run

Review — PR #1199

Verdict: ✅ Approve

Summary

Routine automated dependency update by MintMaker (Renovate). Updates the Docker digest pin for the quay.io/konflux-ci/oras:latest base image in Dockerfile from sha256:c4fb02d... to sha256:5618474.... Single-line, value-only change with no behavioral, API, or architectural impact.

Dimension results

Dimension	Result
Correctness	✅ No issues — digest swap does not affect build logic or stage aliasing
Security	✅ No issues — image uses digest pinning (supply-chain best practice), sourced from trusted Konflux CI registry
Intent & coherence	✅ Mechanical change — scope authorization implicit
Style & conventions	✅ No issues — follows existing digest-pinned FROM pattern
Documentation currency	✅ No updates needed
Cross-repo contracts	⏭ Skipped — no exported interfaces modified

Findings

No findings at or above the reporting threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (2)

Review

Outcome: Approve

Summary

This is an automated MintMaker/Renovate dependency update that bumps the pinned SHA256 digest for the quay.io/konflux-ci/oras:latest container image in the Dockerfile.

Change: c4fb02d... → 6b8e8b3... (digest-only update, no tag change)

Analysis

Dimension	Finding
Correctness	Single-line digest pin update. Image reference format (image:tag@sha256:digest) is valid. No logic changes.
Security	Image remains pinned by digest — supply-chain best practice preserved. Source is the trusted quay.io/konflux-ci registry.
Intent & scope	Change matches the PR title and Renovate bot description. Appropriately scoped to a single dependency bump.
Style	No code changes; existing Dockerfile conventions maintained.
Documentation	No documentation impact.
Cross-repo contracts	No API, schema, or interface changes.

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (3)

Review

Findings

High

• [protected-path] Dockerfile:31 — Dockerfile is a protected infrastructure file requiring human approval. This automated digest bump for quay.io/konflux-ci/oras:latest (by red-hat-konflux[bot]) modifies a protected path but has no linked issue authorizing the change. While the change is mechanical and low-risk, protected-path modifications require explicit authorization via a linked issue per repository governance policy.
  Remediation: Link an authorizing issue or obtain explicit human approval for this protected-path change.

---

Labels: Trivial single-line automated digest bump requiring minimal review effort.

Previous run (4)

Review

Findings

High

• [protected-path] Dockerfile:31 — This PR modifies Dockerfile, which is a protected infrastructure file requiring human approval. The PR has no linked issue justifying the change. While this is an automated dependency digest update (oras image c4fb02d → 0095a20) from MintMaker/Renovate and the change itself is mechanically safe, human review is always required for protected-path changes.
  Remediation: A human maintainer should review and approve this Dockerfile change directly. No code changes are needed — the digest update is correct.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:44 AM UTC · Completed 1:49 AM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:51 AM UTC · Completed 4:55 AM UTC
Commit: 58b0710 · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:15 PM UTC · Completed 9:20 PM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:47 AM UTC · Completed 5:56 AM UTC
Commit: 58b0710 · View workflow run →