Skip to content

chore(deps): Update ubi-minimal base image (main) - #3632

Open
cuipinghuo wants to merge 1 commit into
conforma:mainfrom
cuipinghuo:ubi-ca-bundle-bump
Open

chore(deps): Update ubi-minimal base image (main)#3632
cuipinghuo wants to merge 1 commit into
conforma:mainfrom
cuipinghuo:ubi-ca-bundle-bump

Conversation

@cuipinghuo

@cuipinghuo cuipinghuo commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What:

Update the ubi9/ubi-minimal base image pin in Dockerfile, Dockerfile.dist, and acceptance/kubernetes/kind/acceptance.Dockerfile to the latest digest.

Old digest: sha256:c4c285d42941ebb2bd4da878479008e1e4536bb599aad1dbe568f89de9053661
New digest: sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed

Why:

Picks up the refreshed CA trust bundle.

RPM changes

- ca-certificates-2025.2.80_v9.0.305-91.el9.noarch
+ ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.noarch

rpms.lock.yaml was regenerated via hack/update-rpm-lock.sh and is unchanged: the tracked packages (ca-certificates, jq, gzip) already resolve to the latest versions in the UBI CDN repos, so the digest bump produces no lockfile diff (see EC-2122).

Tickets:

Ref: https://redhat.atlassian.net/browse/EC-2343

🤖 Generated with Claude Code

@cuipinghuo
cuipinghuo requested a review from a team as a code owner October 23, 2026 18:26
@coderabbitai

coderabbitai Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 4959fbba-1b99-4edc-91d1-e7181e7e9f70
📥 Commits

Reviewing files that changed from the base of the PR and between fae6e24 and bb1c8c1.

📒 Files selected for processing: 3
  • Dockerfile
  • Dockerfile.dist
  • acceptance/kubernetes/kind/acceptance.Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The production, distribution, and Kubernetes acceptance Dockerfiles now pin the UBI 9 minimal image to a new digest. The image repository and tag remain unchanged.

Changes: UBI 9 Image Pins

Layer / File(s) Summary
Update base image pins
Dockerfile, Dockerfile.dist, acceptance/kubernetes/kind/acceptance.Dockerfile		 All three Dockerfiles use digest 2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed for the UBI 9 minimal image.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: st3penta, simonbaird

Merge Risk: ⚪ Minimal · up to bb1c8

The image pin updates are consistent across the three Dockerfiles and introduce no identified merge-blocking risk.

Pre-merge checks: Passed 5
Check name Status Explanation
Title check Passed The title clearly identifies the UBI minimal base image update and uses concise dependency-update wording.
Description check Passed The description includes the required What, Why, and Tickets sections. It identifies all changed files, both digests, the CA trust bundle update, RPM details, lockfile status, and ticket EC-2343.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR

Comment @coderabbitai help to get the list of available commands.

@fullsend-ai-review

fullsend-ai-review Bot commented Oct 23, 2026

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Ended 6:37 PM UTC

Commit: de95305 · View workflow run →

@cuipinghuo cuipinghuo changed the title Bump UBI base image digest for ca-certificates and openssl updates chore(deps): Update ubi-minimal base image (main) Oct 23, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Oct 23, 2026

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Ended 6:46 PM UTC

Commit: fae6e24 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Oct 23, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring applied: Tier 1 signals are identical to prior assessment (3 Dockerfiles, 6 lines, small blast radius, protected-path and CI-workflow signals elevated but no logic or dependency changes); Tier 2 confirms mild multi-author contention (3 authors) with no regression or fix/revert patterns; composite remains 2 (moderate).

Previous run

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Routine base-image digest bump across 3 Dockerfiles (6 lines total); protected-path and CI-workflow signals score high because Dockerfiles gate build infrastructure, but the change carries no logic, dependency, or source modifications and git history shows no regression patterns, keeping the composite at moderate.

@fullsend-ai-review

fullsend-ai-review Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Looks good to me

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run

Looks good to me

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

  • Dockerfile
  • Dockerfile.dist

Labels: PR updates Docker base image digest across Dockerfiles

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

@fullsend-ai-review fullsend-ai-review Bot added requires-manual-review Review requires human judgment docker Pull requests that update Docker code dependencies Pull requests that update a dependency file labels Oct 23, 2026
@codecov

codecov Bot commented Oct 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag Coverage Δ
acceptance 54.61% <ø> (ø)
generative 12.22% <ø> (ø)
integration 23.62% <ø> (ø)
unit 72.29% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

robnester-rh
robnester-rh approved these changes Oct 23, 2026
View reviewed changes

@robnester-rh robnester-rh left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cuipinghuo @claude
chore(deps): Update ubi-minimal base image
bb1c8c1 
Old digest: sha256:c4c285d42941ebb2bd4da878479008e1e4536bb599aad1dbe568f89de9053661
New digest: sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed

RPM changes:

- ca-certificates-2025.2.80_v9.0.305-91.el9.noarch
+ ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.noarch

rpms.lock.yaml regenerated via hack/update-rpm-lock.sh; no diff (tracked
packages already resolve to latest in the UBI CDN repos).

Ref: https://redhat.atlassian.net/browse/EC-2343

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: cuipinghuo <chuo@redhat.com>
@simonbaird

simonbaird commented Oct 23, 2026

Copy link
Copy Markdown
Member

Impacted by https://redhat-internal.slack.com/archives/C04PZ7H0VA8/p1792784557567379 I think.

@simonbaird

simonbaird commented Oct 23, 2026

Copy link
Copy Markdown
Member

/retest

@red-hat-konflux

red-hat-konflux Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.

@simonbaird

simonbaird commented Oct 24, 2026

Copy link
Copy Markdown
Member

/test

1 similar comment
@simonbaird

simonbaird commented Oct 24, 2026

Copy link
Copy Markdown
Member

/test

@simonbaird

simonbaird commented Oct 24, 2026

Copy link
Copy Markdown
Member

/retest Red Hat Konflux / ec-main-enterprise-contract / cli-main

@simonbaird

simonbaird commented Oct 24, 2026

Copy link
Copy Markdown
Member

Seems like the ec check is stuck. I was hoping I could retry it without redoing the build pipeline, but not sure I know how.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@simonbaird simonbaird simonbaird approved these changes
@joejstuart joejstuart joejstuart approved these changes
@robnester-rh robnester-rh robnester-rh approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file docker Pull requests that update Docker code requires-manual-review Review requires human judgment risk/moderate PR risk: moderate size: XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@cuipinghuo @simonbaird @joejstuart @robnester-rh