OCM-00000 | ci: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26.5-1783931515

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi9/go-toolset	stage	patch	1.26.4-1783442369 → 1.26.5-1783931515
registry.access.redhat.com/ubi9/go-toolset	final	patch	1.26.4-1783442369 → 1.26.5-1783931515

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Summary by CodeRabbit

• Chores
  • Updated the Go build toolset image to a newer version for container builds.
  • Refreshed the end-to-end and Konflux container build images to use the updated Go tooling base.
  • Kept the end-to-end support component installation behavior unchanged while aligning build environments.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updated UBI9 Go toolset image references from 1.26.4 to 1.26.5 in the main, e2e, and Konflux Dockerfiles. The e2e Dockerfile also updates the rosa-support builder and final runtime stages.

Possibly related PRs

• openshift/rosa#3347 — Updates the same UBI9 Go toolset references across the same Dockerfiles.

Suggested reviewers: robpblake, davidleerh

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description lacks most required template sections, including summary, issue context, testing, and checklist details.	Add the missing template sections: PR Summary, issue context, related links, type of change, behavior before/after, test steps, proof, and checklist items.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes Dockerfiles; no test files or Ginkgo titles were added or modified.
Test Structure And Quality	✅ Passed	Only Dockerfiles changed; no Ginkgo test files or test logic were modified, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	Only Dockerfiles changed; no Go/e2e test files or Ginkgo specs were added or modified.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit only updates three Dockerfiles; no Ginkgo e2e tests or topology-sensitive test code were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only Go toolset base images changed in three Dockerfiles; no manifests, controllers, or topology/scheduling constraints were added.
Ote Binary Stdout Contract	✅ Passed	Only Dockerfile base-image tags changed; no process-level code or stdout writes in main/suite setup were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Diff only updates Dockerfile base images; no Ginkgo test code or IPv4/external-network assumptions were added, and no It/Describe/Context/When changes appeared.
No-Weak-Crypto	✅ Passed	The PR only updates Go toolset base-image tags in three Dockerfiles; the changed hunks contain no weak-crypto APIs, algorithms, or secret comparisons.
Container-Privileges	✅ Passed	PR only updates base image tags in Dockerfiles; no Kubernetes/container manifests changed, and no new privileged settings were introduced.
No-Sensitive-Data-In-Logs	✅ Passed	PR only bumps Docker base image tags in three Dockerfiles; no logging, debug output, or sensitive-data handling was added.
Title check	✅ Passed	The title is specific and accurately matches the dependency update in the PR.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/master/registry.access.redhat.com-ubi9-go-toolset-1.x

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign amandahla for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@images/Dockerfile.e2e`:
- Around line 22-23: The E2E Dockerfile’s final stage currently uses the build
toolchain image and switches to root, so update the runtime stage to a minimal
supported base (such as UBI minimal or distroless) and copy only the required
artifacts from the builder stage. In the Dockerfile for the E2E image, remove
any build tools from the final image, switch to a non-root user like appuser
before runtime setup, and add a HEALTHCHECK for the running service. Use the
existing multi-stage structure and adjust the final-stage setup around the
Dockerfile’s runtime instructions rather than the build stage.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 5ddceca7-bfa6-4c90-be6a-18faf76ad471

📥 Commits

Reviewing files that changed from the base of the PR and between f89fbbc and fefe012.

📒 Files selected for processing (3)

• Dockerfile
• images/Dockerfile.e2e
• images/Dockerfile.konflux

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Use a minimal non-root runtime image for the E2E stage.

The final stage is based on ubi9/go-toolset and explicitly starts as root, retaining build tooling in the runtime image. Please use a supported minimal runtime base, copy only required artifacts, set USER appuser before runtime operations where possible, and add the required HEALTHCHECK.
As per path instructions: “Base image: UBI minimal or distroless,” “Multi-stage builds; no build tools in final image,” “USER non-root; never run as root,” and “HEALTHCHECK defined.”

Also applies to: 39-44

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@images/Dockerfile.e2e` around lines 22 - 23, The E2E Dockerfile’s final stage
currently uses the build toolchain image and switches to root, so update the
runtime stage to a minimal supported base (such as UBI minimal or distroless)
and copy only the required artifacts from the builder stage. In the Dockerfile
for the E2E image, remove any build tools from the final image, switch to a
non-root user like appuser before runtime setup, and add a HEALTHCHECK for the
running service. Use the existing multi-stage structure and adjust the
final-stage setup around the Dockerfile’s runtime instructions rather than the
build stage.

Source: Path instructions

[openshift-ci]

@red-hat-konflux[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/govulncheck	b6817f5	link	false	/test govulncheck
ci/prow/security	b6817f5	link	false	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.