chore(deps): update registry.access.redhat.com/ubi10/go-toolset docker digest to cc3a002

[renovate-fullsend]

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi10/go-toolset	stage	digest	1f675b8 → cc3a002

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:33 PM UTC · Completed 3:40 PM UTC

Commit: 838c8a6 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] images/runner/Containerfile — This file is under the images/ protected path, which requires human approval for all changes. The PR is an automated Renovate Docker digest update for the ubi10/go-toolset build-stage base image (1f675b8 → cc3a002), referenced from Dependency Dashboard Dependency Dashboard #2682. The change is a mechanical sha256 digest swap on a trusted Red Hat registry image with no logic, security, or style concerns. Human sign-off is still required for protected-path changes regardless of risk level.

Previous run

Review

Findings

Medium

• [protected-path] images/runner/Containerfile — This file is under the images/ protected path, which requires human approval for all changes. The PR is an automated Renovate Docker digest update for the ubi10/go-toolset build-stage base image (1f675b8 → cc3a002), referenced from Dependency Dashboard Dependency Dashboard #2682. The change is a mechanical sha256 digest swap on a trusted Red Hat registry image with no logic, security, or style concerns. Human sign-off is still required for protected-path changes regardless of risk level.

Previous run (2)

Review

Findings

Medium

• [protected-path] images/runner/Containerfile — This file is under the images/ protected path, which requires human approval for all changes. The PR is an automated Renovate Docker digest update for the ubi10/go-toolset build-stage base image (1f675b8 → cc3a002), referenced from Dependency Dashboard Dependency Dashboard #2682. The change is a mechanical sha256 digest swap on a trusted Red Hat registry image with no logic, security, or style concerns. Human sign-off is still required for protected-path changes regardless of risk level.

---

Labels: PR modifies runner container image definition under images/runner/

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:49 AM UTC · Completed 3:58 AM UTC

Commit: fe6634e · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:33 PM UTC · Completed 3:42 PM UTC

Commit: 18f8520 · View workflow run →

[ralphbean]

Renovate digest bump for the go-toolset UBI base — CI is green, low risk. Approving so the new UBI automerge rule's manual backfill can go through.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 4:55 PM UTC · Completed 5:04 PM UTC

Commit: 18f8520 · View workflow run →

[fullsend-ai-retro]

Retro: PR #6047 — Renovate Docker digest bump for ubi10/go-toolset

What happened: Renovate opened a 1-line PR updating the pinned Docker digest for ubi10/go-toolset in images/runner/Containerfile. The review agent ran 3 times (initial review + 2 re-reviews triggered by Renovate rebases), each producing the identical [medium] protected-path finding. Total review cost: ~$4.45 across ~26 minutes of compute. A human (ralphbean) approved ~25 hours after PR creation and merged it, noting this was part of a manual backfill for a new UBI automerge rule.

Assessment: The workflow functioned correctly — the review agent identified the protected-path requirement and correctly declined to auto-approve. The human reviewer confirmed the change was low-risk and approved it. No bugs were missed, no false positives flagged beyond the legitimate protected-path gate. The inefficiency is in the 2 redundant re-reviews that produced identical results.

No new proposals filed. All improvement opportunities identified in this retro are well-covered by existing open issues:

• Redundant re-reviews on rebase: Issues Review agent should detect rebase-only force-pushes and skip re-review when the effective diff is unchanged #4401, Review agent should avoid full re-reviews when Renovate rebases without content changes #4596, Skip redundant re-reviews when Renovate rebases a dependency PR without changing the diff #4652, Skip re-review when PR diff is unchanged after rebase/reopen #1356, Skip or diff-gate re-review when PR changes are rebase-only #1287, Skip re-review when bot dep-bump PR is rebased with no semantic change #1355 all propose skipping re-review when the effective diff is unchanged after a rebase. This PR provides additional evidence: 3 identical reviews at ~$1.50 each, with $3 wasted on runs 2 and 3.
• Fast-path for bot dependency PRs: Issues Skip review and retro stages for bot-authored dependency update PRs #5360, Skip or minimize fullsend agent stages on bot-authored automerge PRs #4377, Skip or fast-track fullsend agents on auto-merge bot PRs #4825, Skip agent stages for auto-merge bot PRs to reduce wasted compute #4975, Consider fast-path for review agent on single-file bot dependency PRs #3347, Add fast-path in review orchestrator for trivial bot-authored PRs #2639 propose skipping or minimizing agent stages for bot-authored dependency updates. This PR is a textbook case — a mechanical digest swap that consumed 3 full Opus-tier reviews.
• Protected-path severity for bot digest updates: Issues Review agent should downgrade protected-path for platform bot managed-file updates #3164, Review agent: downgrade protected-path severity for bot-authored dependency update PRs #2588, Review agent should reduce protected-path severity for digest-only Dockerfile changes from trusted bots #3061, Refine protected-path policy to allow agent approval for FROM-line-only Dockerfile changes with digest pinning #3675 propose downgrading or exempting protected-path severity for trusted bot digest-only changes. The human reviewer's approval comment confirms this class of change is considered low-risk.
• Review dispatch debouncing: Issues Deduplicate review runs when PR is rebased multiple times in quick succession #1422, Debounce review agent runs on rapid force-pushes to reduce token waste #4960, Deduplicate review agent runs on the same commit SHA to reduce token waste #4681 propose deduplicating review runs on rapid successive pushes. The overnight + afternoon rebase pattern here would benefit from diff-equivalence checking at the dispatch layer.

The human reviewer's comment ("Approving so the new UBI automerge rule's manual backfill can go through") suggests the team is actively working on automerge rules for this class of change, which would address the 25-hour approval latency for future UBI digest bumps.