chore(deps): Update ubi-minimal base image (v0.8)

[simonbaird]

Update ubi-minimal base image to latest digest.

Old digest: sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
New digest: sha256:e5161a7d7d99cf22e4f34b72e111211a399d956d9b0e8714da18e9c4c8151041

RPM changes

- coreutils-single-8.32-41.el9_8.x86_64
+ coreutils-single-8.32-41.el9_8.1.x86_64
- glib2-2.68.4-19.el9_8.9.x86_64
+ glib2-2.68.4-19.el9_8.10.x86_64
- openssl-libs-3.5.5-6.el9_8.x86_64
+ openssl-libs-3.5.8-1.el9_8.x86_64

Ref: https://redhat.atlassian.net/browse/EC-2184
Ref: https://redhat.atlassian.net/browse/EC-2207

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: cef2db84-24ac-4177-bb9b-45c2e541150a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Update UBI Minimal Base Image Digest

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Updates both runtime images to the latest pinned UBI Minimal digest.
• Incorporates patch releases for coreutils-single, glib2, and OpenSSL libraries.

High-Level Assessment

Updating the immutable digest in both Dockerfiles is the optimal approach because it preserves reproducible builds while applying upstream RPM patches. Using an unpinned tag was dismissed because it would make image contents non-deterministic.

Files changed (2) +2 / -2

Other (2) +2 / -2

DockerfileRefresh the standard runtime UBI Minimal image +1/-1

Refresh the standard runtime UBI Minimal image

• Updates the pinned UBI 9 Minimal final-stage image digest. The refreshed image includes patch-level coreutils-single, glib2, and OpenSSL library updates.

Dockerfile

Dockerfile.distRefresh the distribution runtime UBI Minimal image +1/-1

Refresh the distribution runtime UBI Minimal image

• Updates the distribution build's final-stage UBI 9 Minimal digest to match the standard image and consume the same RPM patches.

Dockerfile.dist

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:38 PM UTC · Completed 3:44 PM UTC

Commit: e8f0a9f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.98

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Mechanical ubi-minimal base image digest bump on a release branch touches protected Dockerfiles and is a supply-chain touchpoint, but the change is a routine minor RPM update within the same tag.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — This PR modifies protected build/infrastructure files but has no linked issue authorizing the change. The change itself is a routine, mechanical ubi-minimal base image digest bump on release-v0.8 (the PR body records the old/new digests and the RPM version deltas for coreutils-single, glib2, and openssl-libs), and no correctness, security, or style concerns were found in the diff. However, governance requires explicit authorization for changes under protected paths (Dockerfile, Dockerfile.dist), and human approval is required regardless of the change's mechanical nature.
  Remediation: Link an issue that authorizes the base image refresh (scheduled ubi-minimal maintenance, CVE remediation, or an automated-dependency policy such as Renovate/Konflux Mintmaker) so the change traces to authorized work, and obtain human approval before merge.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.86% <ø> (+<0.01%)	⬆️
generative	18.14% <ø> (ø)
integration	26.99% <ø> (ø)
unit	68.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[robnester-rh]

LGTM

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 7:51 PM UTC · Completed 7:57 PM UTC

Commit: e8f0a9f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.18

[fullsend-ai-retro]

Retro for PR #3569

Outcome: Merged in ~4h with two human approvals (robnester-rh, joejstuart) and no code changes after review. The workflow overall did what it was supposed to do.

Change under review: A 2-file, 4-line ubi-minimal base image digest bump on release-v0.8 (Dockerfile, Dockerfile.dist). PR body documents old/new digests, RPM version deltas, and links two Jira tickets (EC-2184, EC-2207) as authorization.

Review agent behavior (run 34989659020, $1.98, opus/high, 6 min):

• Risk assessment correctly scored the change moderate 2/5 ("routine minor RPM update within the same tag").
• Orchestrator nonetheless emitted a single high-severity [protected-path] finding whose only substantive complaint was governance ("no linked issue authorizing the change"), producing a CHANGES_REQUESTED verdict.
• The intent-coherence sub-agent produced an info-level scope-authorization-implicit finding recognizing the change as mechanical; that evidence was filtered by REVIEW_FINDING_SEVERITY_THRESHOLD=low and did not survive to reconciliation.
• Both human reviewers approved without addressing the protected-path remediation. The Jira refs in the PR body already satisfy the intent of the rule, but the skill only understands GitHub-native "linked issues."

Also observed: 3 of 8 sub-agent invocations initially failed with The model claude-sonnet-4-5@20250929 is not available on your vertex deployment; retries recovered.

No new proposals filed — every improvement this run points to is already tracked by an open issue. Filing more would create duplicate triage load per the retro-analysis skill's "Before proposing" guidance. Fresh evidence from this run, attached to the closest existing issues:

• fullsend-ai/agents#718 — recognize external tracker refs (Jira EC-XXXX) as protected-path authorization. Near-exact match. PR body's Ref: https://redhat.atlassian.net/browse/EC-2184 and EC-2207 were ignored; conforma/cli's own AGENTS.md (lines 60–67) legitimizes EC-XXXX references, but the review agent has no code path that consumes AGENTS.md when calibrating the protected-path rule.
• fullsend-ai/agents#735 — accept PR body rationale (digest deltas + RPM diff) as authorization context.
• fullsend-ai/agents#741 — assess semantic significance before assigning high severity; risk-assessment 2/5 + intent-coherence info-level counter-evidence + mechanical value-only diff should not co-produce a high finding.
• fullsend-ai/agents#1011 — lightweight review for release-branch backports; same digest bump reviewed independently on v0.7 (chore(deps): Update ubi-minimal base image (v0.7) #3568), v0.8 (this PR), v0.9, and main (chore(deps): Update ubi-minimal base image (main) #3570) at ~$2 each.
• fullsend-ai/agents#1110 — use COMMENT verdict when the only finding is governance-only and no code-quality concerns exist.
• fullsend-ai/agents#1186 — sonnet alias resolves to unavailable vertex model; three sub-agents on this run hit the exact claude-sonnet-4-5@20250929 unavailability described there.
• fullsend-ai/fullsend#6891 and fullsend-ai/fullsend#1358 — pre-flight scope heuristic / lightweight review path for trivial bot dep-bumps; extends naturally to human-authored routine digest bumps like this one. Also fullsend-ai/agents#301, #513, #879, #497, #1287.

Suggested next action: revisit #718 first — it is the highest-leverage single change for this class of PR and would have prevented the false-positive here without any other refactoring.