chore(deps): Update ubi-minimal base image (v0.7)

[simonbaird]

Update ubi-minimal base image to latest digest.

Old digest: sha256:48fa5d8cda7fc00d270d8747c3eaa54ae196f0820d8540074a9c8c61d5e3056f
New digest: sha256:dd334afa72444fa46238fcf9e6bd399245adf746378735348cf84b9dfdca38f1

RPM changes

- gnutls-3.8.10-4.el9_8.x86_64
+ gnutls-3.8.10-8.el9_8.x86_64
- libgcrypt-1.10.0-11.el9.x86_64
+ libgcrypt-1.10.0-13.el9_8.x86_64

Ref: https://redhat.atlassian.net/browse/EC-2076

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 82576520-a74c-4164-b49b-88b57b6c066b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:52 PM UTC · Completed 1:58 PM UTC
Commit: 87c4a29 · View workflow run →

[qodo-for-conforma]

PR Summary by Qodo

Update UBI9 ubi-minimal base image digest (v0.7)

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Bump UBI9 ubi-minimal base image to a new pinned digest for reproducible builds.
• Refresh RPM lock metadata to match the new base image package set.
• Record SRPM source URLs/checksums for locked RPMs across supported architectures.

Diagram

graph TD
  CI["CI / Docker build"] --> BUILD["build.sh"] --> DF["Dockerfile(s)"] --> UBI{{"UBI9 ubi-minimal (digest)"}} --> IMG["Final image"]
  BUILD --> LOCK["rpms.lock.yaml"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Track only the floating tag (no digest pin)

• ➕ No manual digest bump PRs
• ➕ Automatically picks up upstream security fixes
• ➖ Builds become non-reproducible over time
• ➖ Harder to audit exactly what changed between builds

2. Automate digest updates (Renovate/Dependabot + policy gates)

• ➕ Keeps digest pinning while reducing manual churn
• ➕ Can enforce scheduled updates and security-only rules
• ➖ Requires bot configuration/maintenance
• ➖ May increase PR volume without batching

Recommendation: Keeping the base image pinned by digest (as done here) is the right default for reproducibility and auditability. Consider adding automated digest bumping (with batching and CI gates) if these updates are frequent to reduce ongoing manual effort without giving up deterministic builds.

Files changed (3) +59 / -5

Other (3) +59 / -5

DockerfileBump ubi9/ubi-minimal base image digest +1/-1

Bump ubi9/ubi-minimal base image digest

• Updates the final-stage base image reference from the previous UBI9 ubi-minimal digest to the new pinned digest to pick up the latest published image contents while preserving reproducibility.

Dockerfile

Dockerfile.distAlign dist Dockerfile base image digest with updated UBI +1/-1

Align dist Dockerfile base image digest with updated UBI

• Mirrors the same UBI9 ubi-minimal digest bump in the distribution Dockerfile so both build paths target the same base image contents.

Dockerfile.dist

rpms.lock.yamlRegenerate RPM lock sources/provenance for all arches +57/-3

Regenerate RPM lock sources/provenance for all arches

• Replaces empty source sections with explicit SRPM source URLs, repo IDs, sizes, and checksums for locked packages (e.g., jq) across aarch64/ppc64le/x86_64, reflecting the refreshed base image package set.

rpms.lock.yaml

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — This PR modifies protected infrastructure files without a linked issue providing authorization. While the change is a routine base image digest bump with security-relevant RPM updates (gnutls 3.8.10-4→3.8.10-8, libgcrypt 1.10.0-11→1.10.0-13), human approval is always required for protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — This PR modifies protected infrastructure files (Dockerfile and Dockerfile.dist). The PR has no linked issue providing authorization for these changes. The changes themselves are a routine UBI base image digest bump (sha256:48fa5d8c → sha256:dd334afa) with corresponding RPM lock file updates adding source RPM entries. Human approval is always required for protected-path changes, regardless of the change's nature.
  Remediation: Link this PR to an issue that authorizes the Dockerfile changes, or obtain explicit human approval.

---

Labels: PR updates Docker base image digest and RPM lock file (dependency update to Dockerfiles)

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:00 PM UTC · Completed 2:10 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	69.55% <ø> (ø)
integration	69.55% <ø> (ø)
unit	69.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[robnester-rh]

LGTM