updating dependiencies to support k8s 1.36#179
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (7)
✅ Files skipped from review due to trivial changes (2)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR upgrades the operator certification project to Go 1.26.3 with coordinated updates to controller-tools, key Kubernetes/OpenShift/Tekton libraries, and build tooling, while refactoring scheme registration to use runtime.NewSchemeBuilder() callbacks. ChangesGo and Operator Framework Upgrades
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/manager/kustomization.yaml`:
- Around line 15-16: The kustomization override currently sets newName and
newTag to a personal image (newName and newTag) which replaces the default
controller image; update the kustomization.yaml to stop pointing at a personal
repository by either removing the newName/newTag entries or replacing them with
the official project image and tag used for releases (e.g., the canonical
controller image/tag), so the default deploy artifact remains the project's
supply-chain image instead of a personal namespace.
In `@Dockerfile`:
- Line 5: The Dockerfile uses a mutable base image tag in the FROM instruction
("FROM docker.io/library/golang:1.26 as builder"); replace this with the
corresponding immutable digest form (golang@sha256:<digest>) for the intended
target platform to ensure reproducible builds — obtain the correct sha256 digest
for go 1.26 on your platform (e.g., by pulling the image and inspecting its
repoDigests or checking the official registry manifest) and update the FROM line
to use that digest (you may keep the readable tag alongside the digest for
clarity).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 45f53d80-45e9-4826-b9f5-86910db5f39b
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (8)
DockerfileMakefileapi/v1alpha1/groupversion_info.goapi/v1alpha1/operatorpipeline_types.goapi/v1alpha1/zz_generated.deepcopy.goconfig/crd/bases/certification.redhat.com_operatorpipelines.yamlconfig/manager/kustomization.yamlgo.mod
|
|
||
| # Build the manager binary | ||
| FROM docker.io/library/golang:1.25 as builder | ||
| FROM docker.io/library/golang:1.26 as builder |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the current immutable digest for docker.io/library/golang:1.26, and does Docker recommend digest pinning for reproducible/supply-chain-safe builds?
💡 Result:
As of June 8, 2026, the docker.io/library/golang:1.26 tag is a mutable reference that points to multiple platform-specific images and variants (e.g., bookworm, alpine, windowsservercore) [1]. Because it is a tag rather than a specific version, it does not have a single immutable digest [2]. Instead, it resolves to different digests depending on the host architecture and the specific sub-tag or manifest currently being tracked as 1.26 [2]. For example, the latest minor release in the 1.26 series is Go 1.26.4 (released June 2, 2026) [3][4]. The specific digest for a golang:1.26 image depends on the OS/architecture and the specific build variant you pull [5][6]. To obtain the immutable digest for your specific environment, you can run: docker pull golang:1.26 docker inspect --format='{{index.RepoDigests 0}}' golang:1.26 Docker strongly recommends digest pinning for reproducible and supply-chain-safe builds [7][8][2]. Because tags are mutable—meaning they can be updated or overwritten to point to different image contents—relying on them can lead to non-deterministic builds [7][2]. Using a digest (e.g., golang@sha256:...) ensures that your build always uses the exact same, immutable image content [8][2]. Docker documentation explicitly states that pinning by digest guarantees consistency across development, staging, and production environments and is a standard practice for verifying the integrity of base images [7][2]. Note, however, that pinning prevents automatic security updates; if you pin to a specific digest, you must manually update the digest in your Dockerfile when you wish to move to a newer version of the image [8][9].
Citations:
- 1: https://github.com/docker-library/official-images/blob/master/library/golang
- 2: https://docs.docker.com/dhi/core-concepts/digests/
- 3: https://go.dev/doc/devel/release
- 4: https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
- 5: https://hub.docker.com/r/library/golang/tags
- 6: https://hub.docker.com/_/golang/tags
- 7: https://docs.docker.com/build/policies/validate-images/
- 8: https://docs.docker.com/reference/cli/docker/image/pull/
- 9: https://man.archlinux.org/man/docker-image-pull.1.en.raw
Pin the Go builder base image to an immutable digest.
FROM docker.io/library/golang:1.26 as builder uses a mutable tag; Docker tag references can resolve to different image digests depending on platform/variant and may drift over time. Pin to golang@sha256:<digest> for the target platform (optionally keeping the tag for readability) to make builds reproducible and improve supply-chain safety.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 5, The Dockerfile uses a mutable base image tag in the
FROM instruction ("FROM docker.io/library/golang:1.26 as builder"); replace this
with the corresponding immutable digest form (golang@sha256:<digest>) for the
intended target platform to ensure reproducible builds — obtain the correct
sha256 digest for go 1.26 on your platform (e.g., by pulling the image and
inspecting its repoDigests or checking the official registry manifest) and
update the FROM line to use that digest (you may keep the readable tag alongside
the digest for clarity).
Source: Coding guidelines
Signed-off-by: Adam D. Cornett <adc@redhat.com>
3 participants
No description provided.