Update docker.io/library/golang Docker tag to v1.27.1 (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/golang (source)	stage	minor	1.26.7 → 1.27.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:45 AM UTC · Completed 2:52 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] Dockerfile — This PR is a Renovate-managed golang base image tag bump (1.26.7 → 1.27.1) touching Dockerfile, which is on the protected-paths list. The change itself is mechanical and well-formed: valid pinned sha256: digest, same FROM ... AS build format as the surrounding context, trusted automated author red-hat-konflux[bot] acting through the repo's renovate.json (which extends github>conforma/.github//config/renovate/renovate.json). Regardless of authorization context, human approval is always required for protected-path changes.
  Remediation: Human reviewer confirms the golang 1.27.1 bump is acceptable. Related manifests (Dockerfile.dist, go.mod, .tool-versions) remain on earlier versions and will be updated by separate Renovate PRs on their own cadence — that inconsistency is expected Renovate behavior, not a defect of this PR.

No correctness, security, style, or documentation findings above the configured severity threshold.

Previous run

Review

Findings

Medium

• [protected-path] Dockerfile — This PR is a Renovate-managed golang base image tag bump (1.26.7 → 1.27.1) touching Dockerfile, which is on the protected-paths list. The change itself is mechanical and well-formed (valid sha256: digest, format matches surrounding context, trusted automated author red-hat-konflux[bot] acting through the renovate.json policy). Regardless of authorization context, human approval is always required for protected-path changes.
  Remediation: Human reviewer confirms the golang 1.27.1 bump is acceptable. Related manifests (go.mod, .tool-versions, Dockerfile.dist) remain on 1.26.7 and will be updated by separate Renovate PRs on their own cadence — the inconsistency with those files is expected Renovate behavior, not a defect of this PR.

No correctness, security, style, or documentation findings above the configured severity threshold.

Previous run (2)

Review

Findings

Info

• [protected-path] Dockerfile — This PR modifies a protected path (Dockerfile). Human approval is always required for protected-path changes, regardless of context. Note: intent-coherence identifies this as a mechanical Renovate bot dependency bump (golang 1.26.7 → 1.27.1), and the repo's renovate.json authorizes automated dependency bumps.
• [scope-authorization-implicit] N/A — Authorization inferred from mechanical nature of change (Docker base image version/digest bump by Renovate bot). No architectural review required.
• [provenance-warning] N/A — Prior review context discarded: provenance validation failed (unverifiable-wrong-app). This review treats all findings as first-time assessments; severity anchoring was skipped for this run.

Previous run (3)

Review

Reason: stale-head

The review agent reviewed commit a65a109ba5e1605c4e42ed419edcee2d14f33b90 but the PR HEAD is now 64d307409d15bab965337b0e0d6cae151b152e10. This review was discarded to avoid approving unreviewed code.

Previous run (4)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is on the repository's protected-paths list. Human approval is always required for changes to governance and infrastructure files, regardless of context. The change is a Renovate/MintMaker automated base image bump (docker.io/library/golang:1.26.7 → 1.27.1) with a matching pinned sha256 digest, and the repository's renovate.json authorizes this bot's dependency-update pattern; that authorization does not remove the human-approval requirement for protected paths.

Info

• [provenance-warning] — Prior review context discarded: provenance validation failed (PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app). This review treats all findings as first-time assessments and severity anchoring was skipped for this run.

Previous run (5)

Review

Mechanical Renovate-bot Docker tag bump: docker.io/library/golang:1.26.7
→ 1.27.1 (build stage only), with an updated pinned SHA256 digest. No
functional bugs, security issues, style problems, or intent/coherence
concerns identified. The multi-stage runtime image
(registry.access.redhat.com/ubi9/ubi-minimal) is unchanged.

Not approving because Dockerfile is a governance-protected path — human
review is required by policy regardless of how mechanical the change is.

Findings

Info

• [protected-path] Dockerfile — This PR modifies a governance-protected
  path (Dockerfile is in REVIEW_PROTECTED_PATHS). No issue is linked, so
  under the strict rule this would be raised as high severity, but the
  intent-coherence finding cites the mechanical value-only nature of the
  change as implicit authorization, and the repository's renovate.json
  extends the org-wide Renovate config that authorizes exactly this class
  of dependency update. Severity downgraded to info via orchestrator
  reconciliation. Human approval is still required for protected-path
  changes — this note exists so reviewers understand what is being
  changed and why.
• [scope-authorization-implicit] Authorization inferred from the
  mechanical nature of the change (value-only / digest bump). No
  architectural review required.
• [sub-agent-failure] The challenger sub-agent returned an empty
  adjudicated_findings array (it argued the single info finding was a
  non-actionable meta-note). Per the orchestrator's guard against empty
  challenger results, the pre-challenger finding set was preserved.
• [provenance-warning] Prior review context was discarded because
  provenance validation failed (PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app
  — the prior comment was created by a different app than expected). This
  review treats all findings as first-time assessments; severity anchoring
  was skipped for this run.

Previous run (6)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is listed in this repository's REVIEW_PROTECTED_PATHS (governance / infrastructure). The PR body and this repo's renovate.json (extending github>conforma/.github//config/renovate/renovate.json) supply sufficient context: this is a value-only Renovate base-image bump. Human approval is nevertheless required for any protected-path change, regardless of context.
  Remediation: A human reviewer must approve. Before merge, confirm the new digest sha256:512690a5660563b57d37ecc31129e7f136e831db2aed24a1dbeb8ad7380dc0fa corresponds to docker.io/library/golang:1.27.1 on Docker Hub (Renovate is authoritative for the tag→digest pair; the pin remains the source of trust for the build).

Info

• [scope-authorization-implicit] — Authorization inferred from the mechanical nature of the change (value-only dependency version bump by the Renovate bot). No architectural review required.
• [provenance-warning] — Prior review context was discarded: provenance validation returned unverifiable-wrong-app (a prior review comment exists but was created by a different app than expected). This review treats all findings as first-time assessments; severity anchoring was skipped for this run.

Previous run (7)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is under protected paths. The PR has no linked issue providing explicit authorization for this change. While this appears to be a routine renovate bot dependency update (golang 1.26.3 → 1.27.0 with pinned digest), human approval is always required for changes to protected governance and infrastructure files.
  Remediation: Obtain human reviewer approval for this protected-path change.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (8)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is under a protected path requiring human approval. The PR has no linked issue providing authorization for the change. While the Renovate bot description explains this is a golang base image update from 1.26.3 to 1.27.0, protected-path changes require explicit issue-based authorization.
  Remediation: Link an issue authorizing the Dockerfile change, or obtain explicit human approval for this dependency update.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (9)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is a protected governance/infrastructure file requiring human approval. The PR has no linked issue providing authorization or justification for the change. While this is an automated Renovate dependency update (golang 1.26.3 → 1.27.0), protected-path changes always require explicit human review regardless of the change mechanism.
  Remediation: A human maintainer must review and approve changes to protected files. No automated approval is permitted for governance/infrastructure paths.

---

Labels: PR modifies Dockerfile with a dependency version update

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:56 AM UTC · Completed 3:04 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:05 AM UTC · Completed 3:15 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.14

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:26 AM UTC · Completed 2:33 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.65

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:02 AM UTC · Completed 3:10 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.38

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 8ba9237d-5499-4de1-b759-023ea1ccfb54

📥 Commits

Reviewing files that changed from the base of the PR and between f8ea70c and 1680698.

📒 Files selected for processing (1)

• Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The Docker build stage now uses Go 1.27.1 and its corresponding image digest instead of Go 1.26.7.

Changes

Go build image

Layer / File(s)	Summary
Update Go build image Dockerfile	The build stage switches from Go 1.26.7 to Go 1.27.1 and its corresponding image digest.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: simonbaird, st3penta

Merge Risk: ⚪ Minimal · up to 16806

The only change is the Go builder image update to 1.27.1 with a matching published digest. No concrete merge-blocking risk is evident.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Go Docker image tag update to 1.27.1.
Description check	✅ Passed	The description clearly states the image update and provides related configuration details. It does not use the template headings or include a ticket or explicit rationale, but it is mostly complete.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:47 AM UTC · Completed 2:51 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.29

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:56 AM UTC · Completed 3:01 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.01

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

XS bot-authored Renovate Dockerfile pin (1.26.7 → 1.27.1, 1 file, 2 lines) with zero regression or revert history; CI_WORKFLOW_CHANGED and a single protected path modestly elevate Tier 1, while a 4-author 90-day contention and recent activity on the Dockerfile temper but do not escalate Tier 2, yielding a composite of 1.82 rounded to moderate.

Previous run

Risk Assessment: moderate (2/5)

Details

Routine Renovate bot Go toolset minor-version bump in a well-trodden pattern; protected-path status and minor API-compatibility risk across a Go minor version elevate from low to moderate.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Small bot-authored Go version bump to a protected but low-blast Dockerfile with modestly active recent history yields a moderate composite score.

Previous run (3)

Risk Assessment: moderate (2/5)

Details

Routine Renovate-bot Go builder image bump (1.26.7 to 1.27.1) pinned by digest in a single protected file (Dockerfile); small blast radius but a major Go minor-version jump warrants moderate rather than low risk.

[fullsend-ai-review]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:02 AM UTC · Completed 3:09 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.50

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure (ensuring provider "vertex-ai": provider create "vertex-ai" failed: exit status 1 (output: Error: × code: 'Client specified an invalid argument', message: "provider │ credentials are not declared by pr…) · Started 1:59 AM UTC · Completed 1:59 AM UTC

Commit: 1680698 · View workflow run →

Effort: high