Update grpc golang module and bump ubi base image

[simonbaird]

Same as PR #3519 but in the (very) new release-v0.9 branch. Commits are cherry-picked.

[qodo-for-conforma]

PR Summary by Qodo

Upgrade gRPC dependencies and UBI 9 base image

⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Upgrades gRPC to v1.83.2 across application, acceptance, and tooling modules.
• Refreshes related transitive dependencies and module checksums.
• Pins production and acceptance images to the updated UBI 9 digest.

Diagram

graph TD
  GRPC["gRPC Release"] --> MOD["Module Manifests"] --> SUM["Module Checksums"] --> BUILD["Build Outputs"]
  UBI["UBI 9 Digest"] --> IMG["Image Definitions"] --> BUILD
  UBI --> RPM["RPM Lock"] --> BUILD

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Split dependency and image upgrades

• ➕ Isolates Go dependency and container-image validation
• ➕ Allows either maintenance update to be reverted independently
• ➖ Adds release-branch coordination and review overhead
• ➖ Separates two already validated cherry-picked maintenance commits

Recommendation: Keep the updates grouped for this release-branch backport. The commits remain logically separated for rollback, while the combined PR efficiently mirrors the previously validated changes from PR #3519.

Files changed (12) +137 / -138

Other (12) +137 / -138

DockerfilePin the updated UBI 9 runtime image +1/-1

Pin the updated UBI 9 runtime image

• Updates the production runtime stage to the new immutable UBI 9 minimal image digest.

Dockerfile

Dockerfile.distRefresh the distributed runtime image digest +1/-1

Refresh the distributed runtime image digest

• Keeps the distribution Dockerfile aligned with the updated UBI 9 minimal runtime image.

Dockerfile.dist

go.modUpgrade acceptance-test gRPC dependencies +8/-8

Upgrade acceptance-test gRPC dependencies

• Raises gRPC from v1.82.0 to v1.83.2 and aligns CEL and golang.org/x transitive dependencies.

acceptance/go.mod

go.sumRefresh acceptance module checksums +18/-18

Refresh acceptance module checksums

• Replaces checksums for gRPC and the transitive dependency versions resolved by the acceptance module.

acceptance/go.sum

acceptance.DockerfileUpdate the acceptance-test UBI image +1/-1

Update the acceptance-test UBI image

• Pins the Kind acceptance-test image to the same refreshed UBI 9 minimal digest.

acceptance/kubernetes/kind/acceptance.Dockerfile

go.modUpgrade root gRPC dependency graph +12/-12

Upgrade root gRPC dependency graph

• Updates gRPC to v1.83.2 and aligns related networking, security, telemetry, SPIFFE, CEL, and tooling dependencies.

go.mod

go.sumRegenerate root dependency checksums +24/-24

Regenerate root dependency checksums

• Refreshes checksum entries for the upgraded gRPC dependency and its resolved transitive graph.

go.sum

rpms.lock.yamlRefresh locked gzip packages +20/-20

Refresh locked gzip packages

• Updates gzip to 1.12-2.el9_8 with new URLs, sizes, and checksums for four supported architectures.

rpms.lock.yaml

go.modAlign tooling module dependencies +12/-12

Align tooling module dependencies

• Upgrades gRPC and related transitive packages across the repository tooling module.

tools/go.mod

go.sumRefresh tooling module checksums +24/-24

Refresh tooling module checksums

• Updates checksum entries for the tooling module's revised gRPC and transitive dependency versions.

tools/go.sum

go.modAlign kubectl helper dependencies +4/-5

Align kubectl helper dependencies

• Updates golang.org/x networking, system, terminal, and text packages while removing the explicit x/tools requirement.

tools/kubectl/go.mod

go.sumRefresh kubectl helper checksums +12/-12

Refresh kubectl helper checksums

• Records checksums for the newly resolved golang.org/x module versions used by the kubectl helper.

tools/kubectl/go.sum

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:41 PM UTC · Completed 3:52 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.91

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend pre-review check}

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 3:42 PM UTC · Completed 3:52 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.86

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend post-review check}

[fullsend-ai-retro]

Retro: PR #3523 — Wrong base branch, closed in 22 seconds

PR #3523 was a backport of #3519 (gRPC + UBI image upgrade) intended for the release-v0.9 branch, but was accidentally opened with main as the base branch. The author noticed the mistake within 22 seconds and closed the PR. The corrected replacement #3524 was opened ~3 minutes later targeting the correct branch.

What happened

• 15:40:47 UTC — PR Update grpc golang module and bump ubi base image #3523 opened (base: main, should have been release-v0.9)
• 15:41:04 UTC — Review workflow dispatched
• 15:41:09 UTC — PR closed by author (22 seconds after opening)
• 15:41:23 UTC — Retro workflow dispatched
• 15:41:58 UTC — Review agent posted "Review skipped — this PR is already closed" (correct defensive behavior)
• 15:43:39 UTC — Replacement PR Update grpc golang module and bump ubi base image (v0.9) #3524 opened with correct base branch

Assessment

The review agent's pre-review check correctly detected the closed PR and skipped — this is good defensive behavior already in place. However, both the review and retro agents were dispatched unnecessarily, consuming workflow runner time and (for the retro) full LLM inference costs on a PR with no meaningful workflow to analyze.

No new proposals are warranted — the improvement opportunities identified are already covered by existing open issues in fullsend-ai/fullsend:

• Add PR state check to routing layer before dispatching review agent fullsend-ai/fullsend#6725 — Proposes adding a live PR state check to the routing layer before dispatching the review agent. This retro provides concrete evidence: the review was dispatched on an already-closed PR, ran through repo checkout and credential setup before the agent-level pre-review check caught it.
• Skip review/fix dispatch when PR action is 'closed' fullsend-ai/fullsend#1870 — Proposes skipping review/fix dispatch when the PR event action is closed. Would prevent the review dispatch from this scenario.
• Broaden retro skip criteria to all unmerged PRs with no agent interaction fullsend-ai/fullsend#5619 — Proposes broadening retro skip criteria to all unmerged PRs with no agent interaction. This retro adds a nuance: the review agent's "skipped" message technically counts as agent interaction, which could prevent the skip logic from firing. The definition of "meaningful agent interaction" may need to exclude review-skip outcomes.
• Skip retro dispatch for closed-without-merge PRs with immediate successor fullsend-ai/fullsend#2176 — Proposes skipping retro dispatch when a closed-without-merge PR has an immediate successor. PR Update grpc golang module and bump ubi base image (v0.9) #3524 was opened as a successor within 3 minutes of Update grpc golang module and bump ubi base image #3523's closure, matching this pattern exactly.

If #6725 and #1870 are implemented (blocking review dispatch on closed PRs), the cascade effect would also address the retro waste: no review dispatch means no agent interaction, which means #5619's skip criteria would trigger.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.46% <ø> (ø)
generative	12.27% <ø> (ø)
integration	23.59% <ø> (ø)
unit	72.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.