Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9.8-1786023237

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi9/go-toolset	stage	patch	9.8-1785443561 → 9.8-1786023237

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated the build environment to use a newer Go toolset image, improving build consistency and maintenance.

Walkthrough

The Dockerfile updates the builder stage from UBI9 Go toolset image tag 9.8-1785443561 to 9.8-1786023237.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: ciaranroche

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Sec-02: Secrets In Log Output	❌ Error	CWE-532: test/integration/testcontainer.go logs amqpURL via Extra("amqp_url", amqpURL); the URL uses the configured guest password and is not an excluded *_test.go file.	Do not log the full AMQP URL. Log only a redacted host/port or a fixed startup message, and remove userinfo before logging.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Hardcoded Secrets	✅ Passed	PR adds only a public UBI9 image tag; added-line scans found no credentials, private keys, embedded auth URLs, or base64 strings over 32 characters (CWE-798/CWE-321).
No Weak Cryptography	✅ Passed	The sole change updates a UBI9 Go toolset image tag; no banned primitive, ECB mode, custom crypto, or secret comparison was added (CWE-327 not applicable).
No Injection Vectors	✅ Passed	HEAD changes only the Dockerfile base-image tag; no SQL, exec.Command, template.HTML, or yaml.Unmarshal code was added, so no flagged injection vector exists.
No Privileged Containers	✅ Passed	No CWE/CVE finding: the only USER root use is justified for make installation and followed by USER 1001; runtime uses 65532, and Helm defaults to non-root with escalation disabled.
No Pii Or Sensitive Data In Logs	✅ Passed	The patch changes only the Dockerfile base-image tag; it adds no logging statement, output command, request/response handling, or customer-data exposure path.
Description check	✅ Passed	The description directly documents the Docker image tag update and related merge configuration.
Title check	✅ Passed	The title clearly identifies the updated UBI9 Go toolset Docker tag.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/docker-image-updates

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch konflux/mintmaker/main/docker-image-updates

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Line 3: Update the builder stage’s FROM declaration to pin the exact
ubi9/go-toolset:9.8-1786023237 image by its verified immutable sha256 digest
while retaining the existing tag alongside it.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 80059839-cc05-4726-b86d-97f26815916a

📥 Commits

Reviewing files that changed from the base of the PR and between e3c79d5 and 9316074.

📒 Files selected for processing (1)

• Dockerfile

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Pin the builder image by digest.

registry.access.redhat.com/ubi9/go-toolset:9.8-1786023237 remains mutable. A registry retag can change the build toolchain without a Dockerfile change, which creates a supply-chain integrity risk (CWE-494).

Resolve the verified digest for this exact tag and use both references:

Proposed fix

-FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1786023237 AS builder
+FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1786023237@sha256:<verified-digest> AS builder

As per path instructions: pin base images by digest (@sha256:...), not only by tag.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 3, Update the builder stage’s FROM declaration to pin the
exact ubi9/go-toolset:9.8-1786023237 image by its verified immutable sha256
digest while retaining the existing tag alongside it.

Source: Path instructions

[hyperfleet-ci-bot]

Risk Score: 0 — risk/low

Signal	Detail	Points
PR size	2 lines	+0
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}

[rafabene]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rafabene

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [rafabene]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment