🚨 Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9 (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi9/go-toolset	stage	major	1.26.3 → 9.8-1786023237

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:25 AM UTC · Completed 2:34 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [api-contract] Dockerfile.dist:19 — The go-toolset image tag changes from Go-version-based tagging (1.26.3) to UBI-release-based tagging (9.8-1786023237). The tag 9.8 refers to the RHEL 9.8 OS minor release, not the Go version. It is not possible to determine from the tag alone which Go version is bundled in this image. If the bundled Go version does not satisfy the go 1.26.3 directive in go.mod, the build will fail. Additionally, this tag scheme change means future Renovate updates will track UBI OS releases (9.8 → 9.9 → ...) rather than Go versions (1.26.3 → 1.26.4 → ...), risking silent Go toolchain changes on subsequent updates.
  Remediation: Verify the Go version bundled in the image at sha256:5d26ff5606bd6590930e7cfc202b510e3fe2c7a7a1720860f444ab49c45128cb (e.g., via podman run --rm <image> go version). If the Go version is compatible, reconfigure Renovate (via packageRules or versioning in renovate.json) to continue tracking Go-version-based tags for this image, preventing future updates from silently changing the Go toolchain.

• [protected-path] Dockerfile.dist — This PR modifies Dockerfile.dist, which is under the protected Dockerfile path. The PR has no linked issue providing authorization for the change. Human approval is required for all protected-path changes regardless of context.

Low

• [stale-reference] Dockerfile.dist:19 — After this change, Dockerfile uses golang:1.26.3 (explicitly Go-version-pinned) while Dockerfile.dist uses go-toolset:9.8-1786023237 (UBI-release-pinned, Go version opaque). These are intentionally different base images from different registries, but both should provide the same Go version for consistent build behavior. This concern is covered by the api-contract finding above.

Info

• [sub-agent-failure] The style-conventions sub-agent was unavailable due to model deployment configuration. This is a mechanical Docker tag update which would trigger the sub-agent's early exit criteria, so no style findings are expected.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review — ⚠ Changes Requested

Summary

This automated Renovate PR changes the go-toolset base image tag in Dockerfile.dist from a Go-version-based tag (1.26.3) to a UBI9-release-based tag (9.8-1784190466). While the image is digest-pinned (ensuring the exact image used today is deterministic), the change in tagging scheme introduces correctness and maintainability risks.

---

Findings

🔴 High: Go version tagging scheme change risks build correctness (Dockerfile.dist, line 19)

The tag changes from go-toolset:1.26.3 (tracking the bundled Go version) to go-toolset:9.8-1784190466 (tracking the UBI9 OS release version). This is not a standard version bump — it switches the entire version dimension.

Immediate risk: The project requires Go 1.26.3 (declared in go.mod line 3, and explicitly used in Dockerfile line 19 as golang:1.26.3). It is unclear whether the image at sha256:f99dd8... bundles Go 1.26.3 or a different Go version. If the Go version differs, the build may fail or produce binaries compiled with an unintended toolchain.

Ongoing risk: Future Renovate updates will now track UBI9 release versions (9.8 → 9.9 → ...) rather than Go versions (1.26.3 → 1.26.4 → ...). This means future updates could silently change the Go toolchain version without any indication in the tag, breaking the build or introducing subtle compilation differences.

Remediation:

1. Verify that the image at sha256:f99dd81b20e5971ef9f63a51ac27cf0aa591ff9921d021490548b67fd9b17144 actually bundles Go 1.26.3 (e.g., podman run --rm <image> go version).
2. If it does, reconfigure Renovate to continue tracking Go-version-based tags for this image (e.g., via versioning or packageRules in renovate.json) so future updates stay on the Go version track.
3. If it does not contain Go 1.26.3, reject this update.

🟡 Medium: Build path divergence between Dockerfiles (Dockerfile.dist, line 19)

After this change, the two Dockerfiles track Go versions via different mechanisms:

• Dockerfile uses golang:1.26.3 — explicitly Go-version-pinned
• Dockerfile.dist would use go-toolset:9.8-1784190466 — UBI-release-pinned, Go version opaque

This divergence makes it harder to reason about Go version consistency across the two build paths and increases the risk that they drift apart silently during future dependency updates.

---

Verdict

The tagging scheme change introduces ambiguity about the Go version used in the distribution build. Before merging, please verify the Go version in the new image and consider reconfiguring Renovate to continue tracking Go-version-based tags for go-toolset.

Previous run (2)

Review

Findings

High

• [protected-path] Dockerfile.dist:19 — This PR modifies Dockerfile.dist, which is under the protected Dockerfile path. The PR has no linked issue and the description (standard Renovate template) does not explain why this protected file needs to be changed. Protected paths (Dockerfiles, CI config, governance files) require human approval regardless of context. While this is a Renovate bot dependency update and renovate.json is configured in the repo, human review is required before merging changes to protected infrastructure files.
  Remediation: A human maintainer should review and approve this Docker base image major version bump (go-toolset:1.26.3 → go-toolset:9.8-1782980183). Verify that the new image tag and digest are correct and that the major version change does not break the build. The version scheme change (from Go-version-based 1.x to UBI-version-based 9.x tagging) should be validated.

---

Labels: PR updates a Docker base image dependency in a Dockerfile.

Previous run (3)

Review

Findings

High

• [api-contract] Dockerfile.dist:19 — The go-toolset image tag is changing from 1.26.3 (a Go-version-based tag that clearly matched the go 1.26.3 directive in go.mod) to 9.8-1782852234 (a UBI platform-release tag). It is not verifiable from the diff alone which Go version ships in the 9.8-1782852234 image. If it ships a Go version other than 1.26.3, compilation may fail or succeed with an unintended toolchain version.
  Remediation: Before merging, verify that the image at go-toolset:9.8-1782852234@sha256:9ef42b... ships Go 1.26.x by inspecting the image metadata (e.g., skopeo inspect or podman run ... go version). If it does not, either (a) find the correct go-toolset tag that provides Go 1.26.3, or (b) update go.mod, Dockerfile, and any CI references to the new Go version simultaneously.

• [protected-path] Dockerfile.dist — This file is under a protected path (Dockerfile). The PR has no linked issue and the description does not explain why this governance/infrastructure file is being changed beyond stating it is an automated dependency update. Human approval is required for all protected-path changes.
  Remediation: Link a justifying issue or have a maintainer explicitly approve this protected-path change.

Low

• [stale-reference] Dockerfile:19 — The non-dist Dockerfile uses docker.io/library/golang:1.26.3 while Dockerfile.dist is moving to go-toolset:9.8-1782852234. These are different base images from different registries with different tagging conventions, managed as separate Renovate dependencies. The only substantive concern is whether both images provide the same Go version.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:21 AM UTC · Completed 2:28 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:17 AM UTC · Completed 2:21 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 5:36 PM UTC · Completed 5:47 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3375 — Renovate go-toolset major version bump (autoclosed)

Timeline

• 2026-07-01: MintMaker/Renovate bot opened PR #3375 to update the go-toolset Docker tag in Dockerfile.dist from 1.26.3 (Go-version-based) to 9.8-1782852234 (UBI-release-based). A single-line change.
• 2026-07-01: Review agent ran and requested changes with two high-severity findings: the Go version in the new image was unverifiable, and Dockerfile.dist is a protected path.
• 2026-07-03: Renovate rebased the PR. Review agent ran again and requested changes, this time finding only the protected-path issue.
• 2026-07-19: Renovate updated the PR (new tag 9.8-1784190466). Review agent ran a third time and requested changes with improved findings: the tag dimension switch risks silent Go toolchain changes, and the two Dockerfiles now track Go versions via incompatible schemes.
• PR was autoclosed without ever receiving human review or being merged.

Assessment

Review quality was good. The review agent correctly identified a genuine correctness risk — the tagging scheme change means future Renovate updates would track UBI OS releases instead of Go versions, risking silent toolchain drift. The suggested remediation (verify Go version in the image, reconfigure Renovate to track Go-version-based tags) was actionable and appropriate. The third review was the most comprehensive and well-structured, showing improvement over iterations.

The core inefficiency is well-documented. Three review agent runs on a bot PR that no human ever engaged with, followed by a retro agent run on the autoclosed result, consumed resources without driving any outcome. This is the same pattern identified across multiple prior retros.

No new proposals — existing issues cover all findings

Every improvement opportunity surfaced by this PR is already tracked by open issues:

• conforma/cli #3420: Skip fullsend agent dispatch for MintMaker/Renovate dependency PRs. This PR provides additional evidence — 3 review runs over 34 days on a bot PR with zero human engagement.
• fullsend-ai/fullsend #4596: Avoid full re-reviews when Renovate rebases without content changes. The semantic change was identical across all 3 rebases, but each triggered a full review.
• fullsend-ai/fullsend #5817: Consolidate 22+ overlapping "skip dispatch" issues. The sheer volume of open issues (#5067, #4154, Dep bump v0.7 #3221, chore(deps): update rhtap references (main) #1371, #5295, #5360, #4293, etc.) indicates this is a known platform-level gap awaiting a unified design.
• fullsend-ai/agents #257 / #368: Pre-review early exit for bot-authored dependency PRs.
• fullsend-ai/fullsend #3015: Screen Renovate PRs with major version bumps for breaking changes — this PR is a case where review did add value by catching a major version tagging scheme change, suggesting a nuanced approach (skip trivial bot PRs, still review major bumps) rather than blanket skip.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:47 AM UTC · Completed 2:58 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] api-contract

The go-toolset image tag changes from Go-version-based tagging (1.26.3) to UBI-release-based tagging (9.8-1786023237). The tag 9.8 refers to the RHEL 9.8 OS minor release, not the Go version. It is not possible to determine from the tag alone which Go version is bundled in this image. If the bundled Go version does not satisfy the go 1.26.3 directive in go.mod, the build will fail. Additionally, this tag scheme change means future Renovate updates will track UBI OS releases rather than Go versions, risking silent Go toolchain changes on subsequent updates.

Suggested fix: Verify the Go version bundled in the image (e.g., via podman run --rm go version). If compatible, reconfigure Renovate to continue tracking Go-version-based tags for this image.

[fullsend-ai-review]

[low] stale-reference

After this change, Dockerfile uses golang:1.26.3 (explicitly Go-version-pinned) while Dockerfile.dist uses go-toolset:9.8-1786023237 (UBI-release-pinned, Go version opaque). These are intentionally different base images from different registries, but both should provide the same Go version for consistent build behavior.