Update docker images (release-v0.7)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi9/ubi-minimal	final	digest	463cae3 → 062c52f

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:04 AM UTC · Completed 2:11 AM UTC
Commit: 47d3320 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	68.07% <ø> (-1.48%)	⬇️
integration	69.55% <ø> (ø)
unit	69.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 107 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Verdict: Approve ✅

Summary

This is an automated dependency update from MintMaker/Renovate (red-hat-konflux[bot]) that bumps the SHA256 digest of the registry.access.redhat.com/ubi9/ubi-minimal:latest base image used in the final stage of both Dockerfile and Dockerfile.dist.

Change: sha256:463cae3... → sha256:062c52f...

Analysis

Dimension	Assessment
Correctness	✅ Both Dockerfiles are updated consistently to the identical new digest. The change is limited to the base image pin — no build logic, COPY instructions, or runtime behavior is affected.
Security	✅ Updating a pinned base image digest is a security-positive operation — it pulls in the latest Red Hat UBI security patches. The digest-pinning convention (image:tag@sha256:...) is correctly maintained, ensuring reproducible builds.
Intent & coherence	✅ The change matches the PR title, description, and automated bot scope. It targets the release-v0.7 branch as expected for a release-branch maintenance update.
Style/conventions	✅ Format is consistent with the existing Dockerfile conventions. No style issues.
Documentation	✅ No documentation updates needed for a base image digest bump.
Cross-repo contracts	✅ No API, schema, or interface changes. The CLI's public surface is unaffected.

PR body injection check

The PR body contains standard Renovate bot output. The embedded base64 renovate-debug comment decodes to benign metadata ({"createdInVer":"43.210.0-rpm",...}). No instruction-injection patterns detected.

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile
• Dockerfile.dist

Previous run

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — Both Dockerfiles are protected infrastructure files that require human approval. This PR has no linked issue providing explicit authorization for modifying these files. While the change is a mechanical Renovate bot digest bump (UBI9 minimal 5b74fce → 463cae3) and the repository's renovate.json implicitly authorizes this update pattern, protected-path changes always require human review regardless of automation source.
  Remediation: A human maintainer should review and approve this PR. No code changes are needed — the digest update itself is correct and consistent across both Dockerfiles.

---

Labels: PR modifies Dockerfiles with a dependency digest update

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 2:01 AM UTC · Ended 2:04 AM UTC
Commit: 87c4a29 · View workflow run →

Superseded by updated review