[cuipinghuo]

What:

Update the ubi9/ubi-minimal base image pin in Dockerfile and Dockerfile.dist to the latest digest.

Old digest: sha256:c4c285d42941ebb2bd4da878479008e1e4536bb599aad1dbe568f89de9053661
New digest: sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed

Why:

Picks up the refreshed CA trust bundle.

RPM changes

- ca-certificates-2025.2.80_v9.0.305-91.el9.noarch
+ ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.noarch

rpms.lock.yaml was regenerated via hack/update-rpm-lock.sh and is unchanged: the tracked packages (ca-certificates, jq, gzip) already resolve to the latest versions in the UBI CDN repos, so the digest bump produces no lockfile diff (see EC-2122).

Tickets:

Ref: https://redhat.atlassian.net/browse/EC-2343

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f42c4c92-b8ed-4dd1-b421-235b7bd95abd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:38 PM UTC · Completed 6:48 PM UTC

Commit: bd8a4fb · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.94

[fullsend-ai-review]

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Signals are unchanged from the prior assessment: this two-line base-image digest pin scores moderate because PROTECTED_PATH_COUNT=2 (score 5) and CI_WORKFLOW_CHANGED=true (score 4) elevate the Tier 1 sub-score, and Tier 2 change-coupling sees 7 co-changed files absent, but zero regressions or reverts keep both tier composites at 2.0, yielding 2 (0.62x2.0 + 0.38x2.0 = 2.0).

Previous run

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

A minimal two-line base-image digest pin earns a moderate score because the Tier 1 script flags both files as protected paths (score 5) and CI-workflow-changed (score 4), and the Tier 2 change-coupling dimension sees 7 co-changed files absent from this PR in recent history, raising the Tier 2 composite above the floor despite zero regressions or reverts.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] Dockerfile, Dockerfile.dist — Both files match the Dockerfile protected path. The PR description explains the rationale (updating the UBI base image pin to pick up a refreshed CA trust bundle) and references EC-2343. Human approval is always required for protected-path changes, regardless of context.

Previous run

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJjb21tZW50IiwiZmluZGluZ3MiOltdfQ== -->

Review

Findings

Medium

• [protected-path] Dockerfile, Dockerfile.dist — This PR modifies protected infrastructure files (Dockerfile and Dockerfile.dist). The change is a mechanical base image digest bump with clear rationale (CA trust bundle refresh, Ref: EC-2343). Human approval is always required for protected-path changes, regardless of context.

---

Labels: PR modifies Dockerfiles with a base image dependency update

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.86% <ø> (ø)
generative	18.14% <ø> (ø)
integration	26.99% <ø> (ø)
unit	68.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[robnester-rh]

LGTM

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure (post-script /home/runner/work/cli/cli/.fullsend/.fullsend-cache/resources/sha256/d0470c49caef9f5ee92bc7c8d4fc3de135d68bf46889c5b4f59133af7dc38178/scripts/post-review.sh failed: exit status 1) · Started 8:18 PM UTC · Completed 8:22 PM UTC

Commit: d4f5d21 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.05

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:25 PM UTC · Completed 8:36 PM UTC

Commit: 640983f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.43

[Acepresso]

lgtm