Bump ubi9/ubi-minimal from 9.8-1780378819 to 1780379098 in /build#644
Bump ubi9/ubi-minimal from 9.8-1780378819 to 1780379098 in /build#644dependabot[bot] wants to merge 1 commit into
Conversation
Bumps ubi9/ubi-minimal from 9.8-1780378819 to 1780379098. --- updated-dependencies: - dependency-name: ubi9/ubi-minimal dependency-version: '1780379098' dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
area/dependency
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
WalkthroughThis PR updates the runtime base image references in two Docker build configurations. The final stage base image ChangesBase image updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@dependabot[bot]: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #644 +/- ##
=======================================
Coverage 54.27% 54.27%
=======================================
Files 123 123
Lines 6204 6204
=======================================
Hits 3367 3367
Misses 2631 2631
Partials 206 206 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
build/Dockerfile.olm-registry (1)
7-7:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy liftSame UBI minimal tag format issue applies here.
This Dockerfile has the same tag format concern as
build/Dockerfileat line 11. The tag1780379098appears to be missing the UBI version prefix and should follow the format{{.Labels.version}}-{{.Labels.release}}.Given the FIPS context noted in the comment at line 6 ("ubi-micro does not work for clusters with fips enabled unless we make OpenSSL available"), selecting the correct UBI version is particularly critical for this OLM registry image to ensure OpenSSL compatibility with FIPS-enabled clusters.
Please verify using the same verification script provided for
build/Dockerfileline 11.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/Dockerfile.olm-registry` at line 7, The FROM image tag on the OLM registry Dockerfile uses a raw numeric tag ("1780379098") instead of the templated UBI version-release format; update the FROM line for registry.access.redhat.com/ubi9/ubi-minimal to use the same templated tag pattern ({{.Labels.version}}-{{.Labels.release}}) used in the other Dockerfile so the UBI version is explicit and compatible with FIPS/OpenSSL requirements, and re-run the same verification script used for the other Dockerfile to confirm the tag format and FIPS-related image choice are correct.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@build/Dockerfile`:
- Line 11: The pinned UBI image tag
"registry.access.redhat.com/ubi9/ubi-minimal:1780379098" is release-only and
must be changed to the boilerplate-compatible versioned tag; update the FROM
line so the tag follows the boilerplate pattern (UBI version plus release) e.g.
"registry.access.redhat.com/ubi9/ubi-minimal:<UBI-version>-<release>" so it
matches the boilerplate’s expected "{{.Labels.version}}-{{.Labels.release}}"
format used by the openshift/golang-osd-operator updater; make the same change
in the other Dockerfile that pins the same image.
---
Duplicate comments:
In `@build/Dockerfile.olm-registry`:
- Line 7: The FROM image tag on the OLM registry Dockerfile uses a raw numeric
tag ("1780379098") instead of the templated UBI version-release format; update
the FROM line for registry.access.redhat.com/ubi9/ubi-minimal to use the same
templated tag pattern ({{.Labels.version}}-{{.Labels.release}}) used in the
other Dockerfile so the UBI version is explicit and compatible with FIPS/OpenSSL
requirements, and re-run the same verification script used for the other
Dockerfile to confirm the tag format and FIPS-related image choice are correct.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: dac2df12-d45c-4203-8f90-cb05263ba659
📒 Files selected for processing (2)
build/Dockerfilebuild/Dockerfile.olm-registry
|
|
||
| #### | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1780378819 | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:1780379098 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify the UBI minimal tag format and check for valid tags
echo "=== Checking if tag 1780379098 exists and its labels ==="
skopeo inspect --override-os linux --override-arch amd64 docker://registry.access.redhat.com/ubi9/ubi-minimal:1780379098 --format "Tag: {{.Name}}:{{.Tag}}\nVersion: {{.Labels.version}}\nRelease: {{.Labels.release}}\nExpected format: {{.Labels.version}}-{{.Labels.release}}" 2>&1 || echo "Tag may not exist or be accessible"
echo ""
echo "=== Checking what the boilerplate update script would generate ==="
skopeo inspect --override-os linux --override-arch amd64 docker://registry.access.redhat.com/ubi9/ubi-minimal --format "Recommended tag: {{.Name}}:{{.Labels.version}}-{{.Labels.release}}"
echo ""
echo "=== Inspecting boilerplate image to determine expected UBI version ==="
skopeo inspect docker://quay.io/redhat-services-prod/openshift/boilerplate:image-v8.3.6 --format "Boilerplate labels: {{.Labels}}" 2>&1 | grep -i ubi || echo "Could not determine UBI version from boilerplate"Repository: openshift/managed-upgrade-operator
Length of output: 467
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Find Dockerfiles using ubi-minimal tags ==="
fd -a "Dockerfile*" . | cat
echo
rg -n --hidden --no-ignore -S "ubi9/ubi-minimal:" . || true
echo
echo "=== Inspect build/Dockerfile ==="
ls -la build/Dockerfile || true
sed -n '1,80p' build/Dockerfile || true
echo
echo "=== Search for boilerplate guidance / tag construction contract ==="
rg -n --hidden --no-ignore -S "Labels\.version|Labels\.release|ubi version|ubi-minimal|version\-\{\{\.Labels\.version\}\}" . || true
rg -n --hidden --no-ignore -S "update:95-103|golang-osd-operator/update" . || true
echo
echo "=== Locate the specific boilerplate update script snippet mentioned ==="
# Try to find files matching the hinted path fragments
fd -a "update" boilerplate . --type f || true
fd -a "*golang-osd-operator*" boilerplate . --type f || true
fd -a "update" . --type f -S || trueRepository: openshift/managed-upgrade-operator
Length of output: 4069
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Show boilerplate/openshift/golang-osd-operator/update around 85-115 ==="
sed -n '80,130p' boilerplate/openshift/golang-osd-operator/update | cat -n
echo
echo "=== Search for ubi-minimal tags with only :<digits> (no 9.x- prefix) ==="
rg -n --hidden --no-ignore -S "ubi9/ubi-minimal:[0-9]{6,}" . || true
echo
echo "=== Search for ubi-minimal tags with version-release format (e.g., 9.*-*) ==="
rg -n --hidden --no-ignore -S "ubi9/ubi-minimal:9\\.[0-9]+-" . || true
echo
echo "=== Inspect build/Dockerfile.olm-registry too ==="
sed -n '1,60p' build/Dockerfile.olm-registry | cat -n
echo
echo "=== Inspect CLAUDE.md line with container base ==="
sed -n '1,40p' CLAUDE.md | cat -nRepository: openshift/managed-upgrade-operator
Length of output: 6770
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Search for ubi9/ubi-minimal tags across repo ==="
rg -n --hidden --no-ignore -S "ubi9/ubi-minimal:" . || true
echo
echo "=== Search for the specific tag 1780379098 ==="
rg -n --hidden --no-ignore -S "1780379098" . || true
echo
echo "=== Inspect boilerplate/openshift/golang-osd-operator/update.cfg (if present) ==="
ls -ლა boilerplate/openshift/golang-osd-operator/update.cfg 2>/dev/null || true
sed -n '1,200p' boilerplate/openshift/golang-osd-operator/update.cfg 2>/dev/null || true
echo
echo "=== Inspect boilerplate/openshift/golang-osd-operator/Dockerfile template (if present) ==="
fd -a "Dockerfile*.template*" boilerplate/openshift/golang-osd-operator . || true
fd -a "Dockerfile*" boilerplate/openshift/golang-osd-operator . || true
for f in $(fd -a "Dockerfile*" boilerplate/openshift/golang-osd-operator .); do
echo "--- $f"
sed -n '1,120p' "$f" | cat -n
done 2>/dev/null || trueRepository: openshift/managed-upgrade-operator
Length of output: 6616
Fix UBI minimal tag pinning to match boilerplate’s expected {{.Labels.version}}-{{.Labels.release}} format
boilerplate/openshift/golang-osd-operator/update replaces UBI tags using {{.Name}}:{{.Labels.version}}-{{.Labels.release}}, but build/Dockerfile and build/Dockerfile.olm-registry pin registry.access.redhat.com/ubi9/ubi-minimal:1780379098 (release-only, missing the UBI version component). Update these Dockerfiles to the versioned 9.x-<release> tag produced by the boilerplate update logic so the UBI version matches the boilerplate base image.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@build/Dockerfile` at line 11, The pinned UBI image tag
"registry.access.redhat.com/ubi9/ubi-minimal:1780379098" is release-only and
must be changed to the boilerplate-compatible versioned tag; update the FROM
line so the tag follows the boilerplate pattern (UBI version plus release) e.g.
"registry.access.redhat.com/ubi9/ubi-minimal:<UBI-version>-<release>" so it
matches the boilerplate’s expected "{{.Labels.version}}-{{.Labels.release}}"
format used by the openshift/golang-osd-operator updater; make the same change
in the other Dockerfile that pins the same image.
Source: Coding guidelines
|
Superseded by #652. |
dependabot
Bot
deleted the
dependabot/docker/build/ubi9/ubi-minimal-1780379098
branch
1 participant
Bumps ubi9/ubi-minimal from 9.8-1780378819 to 1780379098.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit