chore(deps): Update ubi-minimal base image#3326
Open
simonbaird wants to merge 2 commits into
Open
Conversation
📝 WalkthroughWalkthroughRefresh pinned container base image digests in three Dockerfiles, upgrade the jq RPM lock entries for four architectures, and perform widespread Go dependency version bumps across acceptance/go.mod, go.mod, tools/go.mod, and tools/kubectl/go.mod. ChangesDependency & build artifacts
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
tools/kubectl/go.mod (1)
5-5:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAlign Kubernetes dependency minors in
tools/kubectl/go.mod
k8s.io/kubernetes v1.34.2(line 5) is mixed withk8s.io/api,k8s.io/apimachinery, andk8s.io/client-goatv0.35.4(lines 79–82); align these to the same Kubernetes minor to avoid incompatibilities.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/kubectl/go.mod` at line 5, The go.mod mixes Kubernetes minor versions: k8s.io/kubernetes is set to v1.34.2 while k8s.io/api, k8s.io/apimachinery and k8s.io/client-go are at v0.35.4; update these dependencies so all Kubernetes-related modules share the same minor version (either bump k8s.io/kubernetes to the 1.35.x series to match v0.35.4 modules or downgrade the other three to the 0.34.x equivalents), e.g., adjust the version strings for k8s.io/kubernetes, k8s.io/api, k8s.io/apimachinery, and k8s.io/client-go to the same Kubernetes minor to avoid incompatibilities.tools/go.mod (1)
15-15:⚠️ Potential issue | 🟠 Major | ⚡ Quick winFix Kubernetes module version skew in tools/go.mod.
tools/go.modpinsk8s.io/kubernetes v1.34.2(line 15) whilek8s.io/api,k8s.io/apimachinery,k8s.io/apiserver,k8s.io/client-go, andk8s.io/component-baseare pinned tov0.35.4(lines 604–610). This cross-minor mismatch (core 1.34 vs libs ~1.35) is high risk for dependency/tooling/build compatibility; align allk8s.io/*pins to the same minor series.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/go.mod` at line 15, Update the Kubernetes core module pin so all k8s.io/* modules use the same minor series: change the k8s.io/kubernetes requirement (currently v1.34.2) to the matching 1.35 series used by the other modules (e.g., v1.35.4) so it aligns with k8s.io/api, k8s.io/apimachinery, k8s.io/apiserver, k8s.io/client-go, and k8s.io/component-base (v0.35.4) and then run go mod tidy to verify dependency resolution.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@acceptance/go.mod`:
- Line 16: The acceptance module lists github.com/google/go-containerregistry
v0.21.5 in require but a replace directive pointing to
github.com/conforma/go-containerregistry v0.20.7-... overrides it, so the
acceptance build won’t use upstream v0.21.5; to fix, update the acceptance
go.mod to either remove the replace directive that targets
github.com/conforma/go-containerregistry (so the required
github.com/google/go-containerregistry v0.21.5 is used) or change the require to
match the replaced version and author (or update the replace to point at a
v0.21.x mirror if intentional); locate the require entry for
github.com/google/go-containerregistry and the replace directive for
github.com/conforma/go-containerregistry and make them consistent (remove or
adjust the replace) so the module resolution uses the intended version.
---
Outside diff comments:
In `@tools/go.mod`:
- Line 15: Update the Kubernetes core module pin so all k8s.io/* modules use the
same minor series: change the k8s.io/kubernetes requirement (currently v1.34.2)
to the matching 1.35 series used by the other modules (e.g., v1.35.4) so it
aligns with k8s.io/api, k8s.io/apimachinery, k8s.io/apiserver, k8s.io/client-go,
and k8s.io/component-base (v0.35.4) and then run go mod tidy to verify
dependency resolution.
In `@tools/kubectl/go.mod`:
- Line 5: The go.mod mixes Kubernetes minor versions: k8s.io/kubernetes is set
to v1.34.2 while k8s.io/api, k8s.io/apimachinery and k8s.io/client-go are at
v0.35.4; update these dependencies so all Kubernetes-related modules share the
same minor version (either bump k8s.io/kubernetes to the 1.35.x series to match
v0.35.4 modules or downgrade the other three to the 0.34.x equivalents), e.g.,
adjust the version strings for k8s.io/kubernetes, k8s.io/api,
k8s.io/apimachinery, and k8s.io/client-go to the same Kubernetes minor to avoid
incompatibilities.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 0c147247-c36a-4567-981d-63e69fa18dcd
⛔ Files ignored due to path filters (4)
acceptance/go.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sumtools/go.sumis excluded by!**/*.sumtools/kubectl/go.sumis excluded by!**/*.sum
📒 Files selected for processing (4)
acceptance/go.modgo.modtools/go.modtools/kubectl/go.mod
| github.com/go-git/go-git/v5 v5.17.1 | ||
| github.com/go-openapi/strfmt v0.26.1 | ||
| github.com/google/go-containerregistry v0.21.0 | ||
| github.com/google/go-containerregistry v0.21.5 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether replace overrides the intended upgraded version and where else this pattern exists.
set -euo pipefail
echo "== acceptance/go.mod relevant lines =="
sed -n '1,90p' acceptance/go.mod | nl -ba | sed -n '1,90p'
echo
echo "== All go-containerregistry require/replace entries across repo =="
rg -n --type=gomod 'github.com/google/go-containerregistry|replace\s+github.com/google/go-containerregistry'Repository: conforma/cli
Length of output: 156
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE="acceptance/go.mod"
echo "== File exists? =="
test -f "$FILE" && echo "Found $FILE" || (echo "Missing $FILE" && exit 1)
echo
echo "== acceptance/go.mod (lines 1-120, numbered) =="
awk '{printf "%4d\t%s\n", NR, $0}' "$FILE" | sed -n '1,120p'
echo
echo "== Search for go-containerregistry require/replace across repo =="
rg -n --type=gomod 'github.com/google/go-containerregistry' -S . || true
echo
echo "== Specifically: replace go-containerregistry across repo =="
rg -n --type=gomod 'replace\s+github.com/google/go-containerregistry' -S . || trueRepository: conforma/cli
Length of output: 6513
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== All go-containerregistry replace directives (any go.mod) =="
rg -n --glob '*/go.mod' --hidden --follow 'replace\s+github\.com/google/go-containerregistry\s*=>' .
echo
echo "== All go-containerregistry require entries (any go.mod) =="
rg -n --glob '*/go.mod' --hidden --follow 'require\s*\(?.*github\.com/google/go-containerregistry\s+v' . || true
echo
echo "== All occurrences of go-containerregistry in any go.mod =="
rg -n --glob '*/go.mod' --hidden --follow 'github\.com/google/go-containerregistry' .Repository: conforma/cli
Length of output: 947
go-containerregistry v0.21.5 bump is effectively overridden in acceptance by replace
acceptance/go.modrequiresgithub.com/google/go-containerregistry v0.21.5(line 16) but replaces it withgithub.com/conforma/go-containerregistry v0.20.7-0.20250703195040-6f40a3734728(line 51), so the acceptance build won’t use the upstream v0.21.5 code directly.- Repo search shows this
replaceexists only inacceptance/go.mod, so the shadowing is scoped to the acceptance module.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@acceptance/go.mod` at line 16, The acceptance module lists
github.com/google/go-containerregistry v0.21.5 in require but a replace
directive pointing to github.com/conforma/go-containerregistry v0.20.7-...
overrides it, so the acceptance build won’t use upstream v0.21.5; to fix, update
the acceptance go.mod to either remove the replace directive that targets
github.com/conforma/go-containerregistry (so the required
github.com/google/go-containerregistry v0.21.5 is used) or change the require to
match the replaced version and author (or update the replace to point at a
v0.21.x mirror if intentional); locate the require entry for
github.com/google/go-containerregistry and the replace directive for
github.com/conforma/go-containerregistry and make them consistent (remove or
adjust the replace) so the module resolution uses the intended version.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.