chore(deps): Update ubi-minimal base image (main)

[simonbaird]

Update ubi-minimal base image to latest digest.

Old digest: sha256:17fd831ced9434de0a984d60b3fbe61008308261ba98bbc348d6fbdef05fa7c0
New digest: sha256:48fa5d8cda7fc00d270d8747c3eaa54ae196f0820d8540074a9c8c61d5e3056f

RPM changes

- glibc-2.34-274.el9_8.x86_64
- glibc-common-2.34-274.el9_8.x86_64
- glibc-minimal-langpack-2.34-274.el9_8.x86_64
+ glibc-2.34-275.el9_8.x86_64
+ glibc-common-2.34-275.el9_8.x86_64
+ glibc-minimal-langpack-2.34-275.el9_8.x86_64
- p11-kit-0.26.2-1.el9.x86_64
- p11-kit-trust-0.26.2-1.el9.x86_64
+ p11-kit-0.26.4-1.el9_8.x86_64
+ p11-kit-trust-0.26.4-1.el9_8.x86_64

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 1f0e857d-5604-4cd3-9710-04430f39e0f8

📥 Commits

Reviewing files that changed from the base of the PR and between bb8d479 and 046d46b.

📒 Files selected for processing (3)

• Dockerfile
• Dockerfile.dist
• acceptance/kubernetes/kind/acceptance.Dockerfile

---

📝 Walkthrough

Walkthrough

The pull request updates the pinned UBI9 minimal base image digest in three Dockerfiles. No other Dockerfile behavior or public entity declarations change.

Changes

UBI9 digest updates

Layer / File(s)	Summary
Update pinned image digests Dockerfile, Dockerfile.dist, acceptance/kubernetes/kind/acceptance.Dockerfile	The final image base references use updated pinned UBI9 minimal image digests.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency update to the UBI Minimal base image.
Description check	✅ Passed	The description explains the digest update and lists the affected RPM package versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:26 PM UTC · Completed 7:36 PM UTC
Commit: 87c4a29 · View workflow run →

[qodo-for-conforma]

PR Summary by Qodo

Update UBI9 ubi-minimal base image digest

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Bump UBI9 ubi-minimal base image to the latest pinned digest.
• Keep production, dist, and acceptance-test images aligned on the same UBI digest.
• Pull in upstream RPM updates (glibc and p11-kit) via the new base image.

Diagram

graph TD
  RHR{{"Red Hat Registry"}} --> DF["Dockerfile"] --> IMG["Runtime image"]
  RHR{{"Red Hat Registry"}} --> DFD["Dockerfile.dist"] --> IMG2["Dist runtime image"]
  RHR{{"Red Hat Registry"}} --> ADF["acceptance.Dockerfile"] --> AIMG["Acceptance test image"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Centralize digest via build arg per Dockerfile

• ➕ Reduces repeated manual edits (digest updated in one place per file).
• ➕ Makes automated updates (e.g., CI/renovate) simpler to apply consistently.
• ➖ Still requires touching each Dockerfile unless a shared mechanism exists.
• ➖ Build arg must be carefully propagated in CI/build scripts to avoid drift.

2. Automate base-image digest updates (Renovate/Dependabot + CI)

• ➕ Keeps base images continuously patched with less manual effort.
• ➕ Can enforce consistency across multiple Dockerfiles automatically.
• ➖ Requires tooling/config maintenance and reviewer trust in automation.
• ➖ May increase update churn if not batched or scheduled.

Recommendation: The current approach (pinning by digest) is the right default for reproducible builds and supply-chain integrity. If these digest bumps are frequent, consider adding lightweight automation (Renovate/Dependabot) and/or a shared build-arg convention to keep the three Dockerfiles in sync with less manual work.

Files changed (3) +3 / -3

Other (3) +3 / -3

DockerfileBump final-stage UBI9 ubi-minimal digest +1/-1

Bump final-stage UBI9 ubi-minimal digest

• Updates the final image base from the previous ubi-minimal digest to the new pinned digest. This pulls in the newer UBI layer content (including glibc and p11-kit updates mentioned in the PR description).

Dockerfile

Dockerfile.distAlign dist image base digest with updated UBI9 ubi-minimal +1/-1

Align dist image base digest with updated UBI9 ubi-minimal

• Updates the dist Dockerfile final-stage base image digest to the same new ubi-minimal digest as production. Keeps distribution builds reproducible and consistent with the main runtime image.

Dockerfile.dist

acceptance.DockerfileUpdate acceptance-test image base digest +1/-1

Update acceptance-test image base digest

• Updates the acceptance-test container base image to the new pinned ubi-minimal digest. Ensures acceptance tests run on the same updated OS userland as other images.

acceptance/kubernetes/kind/acceptance.Dockerfile

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — This PR modifies protected infrastructure files that require human approval. No linked issue authorizes changes to these governance/infrastructure paths. The changes are a routine ubi-minimal base image digest bump applied consistently across all three Dockerfiles.
  Remediation: Human approval is required for all protected-path changes, regardless of change complexity.

---

Labels: PR modifies Dockerfiles and updates a base image dependency

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.40% <ø> (-0.01%)	⬇️
generative	16.36% <ø> (ø)
integration	27.58% <ø> (ø)
unit	71.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.