/jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.\n\nThe bug has been updated to refer to the pull request using the external bug tracker.\n\n\n> \n>\n>\n> \n>Dockerfile.rhel10 (1)
\n> \n> `1-76`: _⚠️ Potential issue_ | _🟠 Major_ | _⚖️ Poor tradeoff_\n> \n> **Add USER instruction to run as non-root.**\n> \n> The Dockerfile does not specify a USER instruction, so the container will run as root by default. As per coding guidelines, containers should run as non-root users.\n> \n> However, driver-toolkit is a build/toolkit image containing kernel-devel packages and build tools that may require elevated privileges during driver compilation. If running as root is genuinely required for this use case, document the justification in a comment. Otherwise, add a USER instruction before the final metadata layers.\n> \n> \n> \n> \n> \n> \n> \n>\n>\n> \n>🛡️ Suggested fix if non-root operation is feasible
\n> \n> ```diff\n> RUN dnf clean all && rm -rf /var/cache/dnf/*\n> \n> +# Run as non-root user for security (if compatible with driver-build workflows)\n> +USER 1001\n> +\n> COPY manifests/01-openshift-imagestream.yaml /manifests/01-openshift-imagestream.yaml\n> COPY manifests/image-references-rhel10 /manifests/image-references\n> ```\n> \n> **Note**: If root access is required for driver compilation workflows that consume this toolkit image, add a comment justifying the privileged requirement.\n> \n>\n>\n> \n> \n> \n> _Sources: Coding guidelines, Linters/SAST tools_\n> \n>🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@Dockerfile.rhel10` around lines 1 - 76, Add a non-root USER (or justify why\n> root is required) and place the USER instruction before the final metadata\n> layers (i.e., before the COPY manifests / LABEL / final RUN that writes\n> /etc/driver-toolkit-release.json). If non-root is feasible: create a user/group\n> (example: driveruser), ensure ownership of any runtime files/directories the\n> image needs (chown /manifests and any build/runtime dirs and ensure the final\n> RUN that queries rpms or writes /etc/driver-toolkit-release.json can be executed\n> earlier as root), then add USER driveruser; if root is required, add an explicit\n> comment near those sections (COPY manifests, LABEL, and the final RUN that sets\n> INSTALLED_KERNEL/INSTALLED_RT_KERNEL) documenting that privileged/root is\n> necessary for kernel package inspection and driver build tools.\n> ```\n> \n>
\n> \n>\n>\n>pkg/cloud/azure/services/networkinterfaces/networkinterfaces.go (1)
\n> \n> `212-227`: _⚠️ Potential issue_ | _🔴 Critical_\n> \n> **Attach the selected NAT rule once, to its owning IP family.**\n> \n> Line 213 uses the frontend list as a multiplier but always appends the same `nicSpec.NatRule` entry. On a dual-stack LB, that can put the same NAT rule ID into both `loadBalancerInboundNatRules` and `loadBalancerInboundNatRulesV6`, even though an inbound NAT rule belongs to a single frontend IP configuration. This block also needs nil/bounds checks before dereferencing `lb.FrontendIPConfigurations` and indexing `lb.InboundNatRules`.\n> \n>\n>\n> \n>🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against the current code and only fix it if needed.\n> \n> In `@pkg/cloud/azure/services/networkinterfaces/networkinterfaces.go` around lines\n> 212 - 227, The code currently loops frontend IP configs but always appends the\n> same inbound NAT rule index, causing the same rule to end up in both\n> loadBalancerInboundNatRules and loadBalancerInboundNatRulesV6; instead, locate\n> the inbound NAT rule entry once (using (*lb.InboundNatRules)[*nicSpec.NatRule]),\n> nil-check lb.FrontendIPConfigurations and lb.InboundNatRules and bounds-check\n> *nicSpec.NatRule, then inspect that inbound rule's FrontendIPConfiguration (or\n> compare its referenced frontend ID to entries in *lb.FrontendIPConfigurations)\n> to determine whether it is IPv4 or IPv6 and append a single\n> network.InboundNatRule{ID: ...} to only loadBalancerInboundNatRules or\n> loadBalancerInboundNatRulesV6; finally keep the existing assignments to\n> nicConfig.LoadBalancerInboundNatRules and\n> nicConfigV6.LoadBalancerInboundNatRules but only after these checks and the\n> single appended rule.\n> ```\n> \n>\n>\n> \n>pkg/cloud/azure/services/networkinterfaces/networkinterfaces_stack.go (1)
\n> \n> `167-177`: _⚠️ Potential issue_ | _🔴 Critical_\n> \n> **Don't fan out one NAT rule across every frontend.**\n> \n> Line 168 appends the same `nicSpec.NatRule` once per frontend config, so a dual-stack LB produces duplicate references while `loadBalancerInboundNatRulesV6` still stays empty. The direct index on `(*lb.InboundNatRules)[*nicSpec.NatRule]` can also panic when the slice is nil or shorter than the requested rule. \n> \n> \n>\n>\n> \n>Proposed fix
\n> \n> ```diff\n> -\t\tif nicSpec.NatRule != nil {\n> -\t\t\tfor range *lb.FrontendIPConfigurations {\n> -\t\t\t\tloadBalancerInboundNatRules = append(loadBalancerInboundNatRules,\n> -\t\t\t\t\tnetwork.InboundNatRule{ID: (*lb.InboundNatRules)[*nicSpec.NatRule].ID})\n> -\t\t\t}\n> -\t\t}\n> +\t\tif nicSpec.NatRule != nil {\n> +\t\t\tif lb.InboundNatRules == nil || *nicSpec.NatRule < 0 || *nicSpec.NatRule >= int64(len(*lb.InboundNatRules)) {\n> +\t\t\t\treturn fmt.Errorf(\"load balancer %s does not have inbound NAT rule %d\", nicSpec.PublicLoadBalancerName, *nicSpec.NatRule)\n> +\t\t\t}\n> +\t\t\trule := (*lb.InboundNatRules)[*nicSpec.NatRule]\n> +\t\t\tloadBalancerInboundNatRules = append(loadBalancerInboundNatRules, network.InboundNatRule{ID: rule.ID})\n> +\t\t\t// Append to loadBalancerInboundNatRulesV6 only after resolving the selected rule's frontend family.\n> +\t\t}\n> ```\n>\n>\n> \n>🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against the current code and only fix it if needed.\n> \n> In `@pkg/cloud/azure/services/networkinterfaces/networkinterfaces_stack.go` around\n> lines 167 - 177, The code is appending the same NAT rule once per frontend which\n> duplicates references and leaves the IPv6 list empty, and it directly indexes\n> (*lb.InboundNatRules)[*nicSpec.NatRule] which can panic if the slice is nil or\n> too short; change the logic in the block that handles nicSpec.NatRule so you (1)\n> only append the referenced NAT rule once (do not loop over\n> lb.FrontendIPConfigurations to append the same rule), (2) guard access to\n> lb.InboundNatRules by checking it is non-nil and that *nicSpec.NatRule <\n> len(*lb.InboundNatRules) before dereferencing, and (3) decide whether to push\n> the rule into loadBalancerInboundNatRules or loadBalancerInboundNatRulesV6 by\n> inspecting the corresponding frontend IP configuration’s IP version (iterate\n> frontends to find the matching frontend IP config for that NAT rule or otherwise\n> determine v4/v6) and then set nicConfig.LoadBalancerInboundNatRules and\n> nicConfigV6.LoadBalancerInboundNatRules appropriately.\n> ```\n> \n>
\n\n\n\n\npkg/cli/admin/release/new_test.go (1)
\n\n`62-150`: _⚡ Quick win_\n\n**Convert this into a table-driven test and compare the final tag set in one assertion.**\n\nThese three subtests are the same arrange/act/assert shape with different inputs and expected tags. Folding them into a table and asserting `tagNames(is)` with a single `cmp.Diff` would match the repo’s test conventions and make future pruning cases easier to extend.\n\n\n\n\nAs per coding guidelines, \"Write unit tests for every change using table-driven test patterns and standard `testing.T`\" and \"Use `google/go-cmp` to compare expected and actual objects rather than checking individual fields with if statements.\"\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n🤖 Prompt for AI Agents
\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@pkg/cli/admin/release/new_test.go` around lines 62 - 150, The test\nTestPruneUnreferencedImageStreams should be converted to a table-driven test:\nreplace the three near-duplicate t.Run blocks with a single slice of test cases\n(fields: name, setup inputs such as operator/base image references created via\nwriteImageReferences and createImageStream, metadata map, include list, and\nexpected tag slice), loop over cases calling pruneUnreferencedImageStreams, then\ncompute actual := tagNames(is) and assert equality with cmp.Diff in one\nassertion per case (use t.Fatalf on prune error and t.Errorf with the diff on\nmismatch). Keep references to the existing helpers\npruneUnreferencedImageStreams, tagNames, writeImageReferences, and\ncreateImageStream so the setup/act/assert logic is identical but consolidated\ninto the table-driven structure.\n```\n\n
/jira refresh.\n\n/jira refresh.\n\n\n\n\n\n\ngo.mod (1)
\n\n`135-135`: _⚡ Quick win_\n\n**Document the OpenShift Ginkgo fork override (pre-existing, still applies).**\n\nThe `replace github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1` directive persists from earlier review feedback. If this override is still in use, please add a comment in `go.mod` or the project documentation explaining:\n- Why the OpenShift fork is required (specific bug fixes, backports, or features not in upstream ginkgo).\n- Whether the override is permanent or temporary, and if temporary, the plan/timeline to upstream changes and revert to upstream ginkgo.\n\nThis supports supply-chain transparency and future maintainability.\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n🤖 Prompt for AI Agents
\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@go.mod` at line 135, Add a short explanatory comment next to the existing\nreplace directive \"replace github.com/onsi/ginkgo/v2 =>\ngithub.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1\" (or in\nproject docs) that states why the OpenShift fork is required (specific\nbug/PR/backport or feature) and whether this override is permanent or temporary;\nif temporary, include the plan/timeline and the criteria for reverting to\nupstream ginkgo so future maintainers can understand and remove the override\nwhen appropriate.\n```\n\n
/jira refresh.\n\n/jira refresh.\n\n/jira refresh.\n\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\ngo.mod (1)
\n\n`140-140`: _⚠️ Potential issue_ | _🟠 Major_ | _⚖️ Poor tradeoff_\n\n**Personal fork replace persists with updated pseudo-version.**\n\nThis replace directive still redirects `github.com/openshift/library-go` to the personal fork `github.com/bertinatto/library-go`, now at pseudo-version `v0.0.0-20260611152622-0514d6ff0d72` (updated from the previous `v0.0.0-20260604185359-a6df8b6151a1`). The root supply chain security concerns flagged in the prior review remain:\n\n- No verifiable provenance, SBOM, or signing for the forked module\n- License compatibility not established\n- Violates supply chain security guidelines for production dependencies\n\nAs per coding guidelines, dependencies should come from canonical sources with proper provenance attestations, or include explicit justification plus SBOM/signing artifacts when using forks. Since this is a WIP testing PR, ensure the replace is removed before merge or document the test-specific justification clearly.\n\n\n\n\n\n\n\nVerify the new commit for any CVEs or security issues:\n\n```shell\n#!/bin/bash\n# Description: Check the new pseudo-version commit for security advisories\n\nCOMMIT_HASH=\"0514d6ff0d72\"\nPSEUDO_VERSION=\"v0.0.0-20260611152622-0514d6ff0d72\"\n\necho \"=== Verify commit exists in both upstream and fork ===\"\ngh api \"repos/openshift/library-go/commits/${COMMIT_HASH}\" --jq '.sha, .commit.message, .html_url' 2>/dev/null || echo \"Commit not found in upstream\"\ngh api \"repos/bertinatto/library-go/commits/${COMMIT_HASH}\" --jq '.sha, .commit.message, .html_url' 2>/dev/null || echo \"Commit not found in fork\"\n\necho -e \"\\n=== Query OSV for known vulnerabilities ===\"\ncurl -sS https://api.osv.dev/v1/query \\\n -H 'Content-Type: application/json' \\\n -d `@-` <\n 🤖 Prompt for AI Agents
\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@go.mod` at line 140, The go.mod replace directive pointing\ngithub.com/openshift/library-go to the personal fork\ngithub.com/bertinatto/library-go at pseudo-version\nv0.0.0-20260611152622-0514d6ff0d72 must be removed or explicitly justified;\neither delete the replace line (the replace directive and pseudo-version string)\nso the module resolves to the canonical openshift/library-go, or add documented,\nreviewable justification plus accompanying provenance (SBOM, signatures) and\nlicense compatibility evidence for using the fork in this PR. Locate the replace\ndirective entry in go.mod (the \"replace github.com/openshift/library-go =>\ngithub.com/bertinatto/library-go v0.0.0-20260611152622-0514d6ff0d72\" line),\nremove it for production codepaths, or add the required security artifacts and a\nclear comment explaining it's a WIP/testing-only override if you must keep it\ntemporarily.\n```\n\n
/jira refresh.\n\n/jira refresh.\n\n/jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.\n\nThe bug has been updated to refer to the pull request using the external bug tracker.\n\n/jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.\n\nThe bug has been updated to refer to the pull request using the external bug tracker.\n\nSourced from github.com/operator-framework/operator-lifecycle-manager's releases.
\n>\n>\n>v0.43.0
\n>Install
\n>Scripted
\n>\n>curl -L https://github.com/operator-framework/operator-lifecycle-manager/releases/download/v0.43.0/install.sh -o install.sh\r\n>chmod +x install.sh\r\n>./install.sh v0.43.0\r\n>Changelog
\n>5ccfad100 :seedling: Bump github.com/containerd/containerd from 1.7.31 to 1.7.32 (#3835)\n>6bf419c4f :seedling: Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 (#3825)\n>06b8e709e :seedling: Bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.2 (#3818)\n>d3e6fe0de :seedling: Bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0 (#3834)\n>9fea07743 :seedling: Bump github.com/onsi/gomega from 1.40.0 to 1.41.0 (#3833)\n>02c6b44d8 :seedling: Bump github.com/operator-framework/operator-registry (#3819)\n>a42730bbd :seedling: Bump github.com/operator-framework/operator-registry (#3823)\n>dc8452417 :seedling: Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#3811)\n>70254e02e :seedling: Bump go.podman.io/image/v5 from 5.39.2 to 5.40.0 (#3837)\n>96a8e9ad3 :seedling: Bump golang.org/x/net from 0.52.0 to 0.53.0 (#3814)\n>9127b4e74 :seedling: Bump golang.org/x/net from 0.53.0 to 0.54.0 (#3829)\n>46eccdd10 :seedling: Bump golang.org/x/net from 0.54.0 to 0.55.0 (#3836)\n>50a264230 :seedling: Bump google.golang.org/grpc from 1.80.0 to 1.81.0 (#3822)\n>adc7ebf93 :seedling: Bump the k8s-dependencies group with 8 updates (#3816)\n>87c9ef246 Bump softprops/action-gh-release from 2 to 3 (#3815)\n>4aab00c4e Improve bundle unpack failure handling and user experience (#3832)\n>4e18ba810 Update google.golang.org/grpc to v1.81.1 (#3831)\n>e00d2cd2c Update operator-registry to v1.68.0 (#3830)\n>a51f789b9 chore(dep): bump operator-registry to v1.69.0 (#3838)\n>0cb3902fb remove stale owners (#3813)
\n>Docker images
\n>\n>
\n>- \n>
docker pull quay.io/operator-framework/olm:v0.43- \n>
docker pull quay.io/operator-framework/olm:v0.43.0
8781c65 fix: bypass system registries.conf in image-canonical-ref tool (#3839)a51f789 chore(dep): bump operator-registry to v1.69.0 (#3838)70254e0 :seedling: Bump go.podman.io/image/v5 from 5.39.2 to 5.40.0 (#3837)46eccdd :seedling: Bump golang.org/x/net from 0.54.0 to 0.55.0 (#3836)5ccfad1 :seedling: Bump github.com/containerd/containerd from 1.7.31 to 1.7.32 (#3835)4aab00c Improve bundle unpack failure handling and user experience (#3832)d3e6fe0 :seedling: Bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0 (#3834)9fea077 :seedling: Bump github.com/onsi/gomega from 1.40.0 to 1.41.0 (#3833)4e18ba8 Update google.golang.org/grpc to v1.81.1 (#3831)9127b4e :seedling: Bump golang.org/x/net from 0.53.0 to 0.54.0 (#3829)/jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.\n\nThe bug has been updated to refer to the pull request using the external bug tracker.\n\nThis pull request references [Jira Issue OCPBUGS-86503](https://redhat.atlassian.net/browse/OCPBUGS-86503), which is valid.\n\n/jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.\n\nThis pull request references [Jira Issue OCPBUGS-86503](https://redhat.atlassian.net/browse/OCPBUGS-86503), which is valid.\n\n\n> \n>\n>\n> \n>Dockerfile.openshift (1)
\n> \n> `10-16`: _⚠️ Potential issue_ | _🔴 Critical_ | _⚡ Quick win_\n> \n> **Add USER directive to run as non-root.**\n> \n> The final image has no USER directive and will run as root by default, violating the security guideline requiring non-root execution. This is also flagged by the Trivy static analysis rule DS-0002.\n> \n> Add a USER directive before the COPY commands in the final stage to specify a non-root user.\n> \n> \n> \n> \n> \n> \n>\n>\n> \n>🔒 Proposed fix to add USER directive
\n> \n> ```diff\n> FROM registry.ci.openshift.org/ocp/5.0:base-rhel9\n> \n> +USER 65534\n> +\n> COPY --from=builder /go/src/sigs.k8s.io/apiserver-network-proxy/proxy-server /usr/bin/proxy-server\n> COPY --from=builder /go/src/sigs.k8s.io/apiserver-network-proxy/proxy-agent /usr/bin/proxy-agent\n> ```\n> \n> Alternatively, if the base image provides a suitable non-root user, consider using a named user (e.g., `nobody`) if available in the image.\n> \n>\n>\n> \n> \n> \n> _Source: Coding guidelines_\n> \n>🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@Dockerfile.openshift` around lines 10 - 16, The Dockerfile.openshift final\n> stage runs as root by default due to missing a USER directive, violating\n> security requirements. Add a USER directive after the FROM statement for the\n> base image (registry.ci.openshift.org/ocp/5.0:base-rhel9) and before the COPY\n> commands to specify a non-root user such as 'nobody' or another suitable\n> non-root user available in the base image to ensure the container runs with\n> reduced privileges.\n> ```\n> \n>
\n> \n>\n>\n> \n>Dockerfile.openshift (1)
\n> \n> `10-15`: _⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Run the final image as a non-root user.**\n> \n> The runtime stage still defaults to root, which conflicts with the container security guidance and the Trivy finding in this diff. Please add an explicit non-root `USER` before the image is finalized.\n> \n> As per coding guidelines, `USER non-root; never run as root`.\n> \n> \n> \n> \n> \n> \n>\n>\n> \n>🐛 Proposed fix
\n> \n> ```diff\n> FROM registry.ci.openshift.org/ocp/5.0:base-rhel9\n> \n> COPY --from=builder /go/src/sigs.k8s.io/apiserver-network-proxy/proxy-server /usr/bin/proxy-server\n> COPY --from=builder /go/src/sigs.k8s.io/apiserver-network-proxy/proxy-agent /usr/bin/proxy-agent\n> +\n> +USER 65532:65532\n> \n> LABEL io.openshift.release.operator=true\n> ```\n>\n>\n> \n> \n> \n> _Sources: Coding guidelines, Linters/SAST tools_\n> \n>🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@Dockerfile.openshift` around lines 10 - 15, The final image in\n> Dockerfile.openshift defaults to running as root, which violates container\n> security guidelines and causes Trivy security findings. Add an explicit USER\n> directive after the LABEL statement to specify a non-root user (such as USER\n> non-root) to ensure the container runs with non-root privileges by default.\n> ```\n> \n>
\n\n\n\n\npkg/server/desthost_backend_manager.go (1)
\n\n`86-86`: _⚡ Quick win_\n\n**Remove unused variable `firstDrainingBackend`.**\n\nThe variable `firstDrainingBackend` is assigned but its value is never used—only its nil-ness is checked on line 98. However, this check is redundant: given that `len(bes) > 0` (guaranteed by line 81) and the read lock prevents concurrent modification, the loop will always examine at least one backend, making `firstDrainingBackend` non-nil when we reach line 98.\n\nThe fallback on line 100 picks a random draining backend rather than returning `firstDrainingBackend`, so the variable serves no purpose.\n\n\n\n\n\n\n\n\n\nAlso applies to: 92-94, 98-98\n\n♻️ Simplify by removing the unused variable
\n\n```diff\n \t\tklog.V(5).InfoS(\"Get the backend through the DestHostBackendManager\", \"destHost\", destHost)\n\n \t\t// Randomly select from non-draining backends first\n \t\tstartIdx := dibm.random.Intn(len(bes))\n-\t\tvar firstDrainingBackend *Backend\n \t\tfor i := 0; i < len(bes); i++ {\n \t\t\tidx := (startIdx + i) % len(bes)\n \t\t\tif !bes[idx].IsDraining() {\n \t\t\t\treturn bes[idx], nil\n \t\t\t}\n-\t\t\tif firstDrainingBackend == nil {\n-\t\t\t\tfirstDrainingBackend = bes[idx]\n-\t\t\t}\n \t\t}\n\n \t\t// All backends for this destination are draining, fall back to a random draining one\n-\t\tif firstDrainingBackend != nil {\n-\t\t\tklog.V(3).InfoS(\"All backends for destination host are draining, using one as fallback\", \"destHost\", destHost)\n-\t\t\treturn bes[dibm.random.Intn(len(bes))], nil\n-\t\t}\n+\t\tklog.V(3).InfoS(\"All backends for destination host are draining, using one as fallback\", \"destHost\", destHost)\n+\t\treturn bes[dibm.random.Intn(len(bes))], nil\n \t}\n```\n\n\n\n\n\n🤖 Prompt for AI Agents
\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@pkg/server/desthost_backend_manager.go` at line 86, The variable\nfirstDrainingBackend declared in the affected code block is never used—it is\nassigned in the loop at lines 92-94 but only its nil-ness is checked at line 98,\nand the actual fallback at line 100 uses a random draining backend instead.\nRemove the unused variable declaration, remove the assignment within the loop,\nand remove the redundant nil-ness check at line 98, simplifying the logic since\nthe loop will always assign at least one backend given the initial length check\nguarantees at least one iteration.\n```\n\n
\n> \n>\n>\n> \n>Dockerfile.openshift (1)
\n> \n> `10-16`: _⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Run the runtime image as non-root.**\n> \n> `Dockerfile.openshift` has no `USER` directive, so the final container runs as root by default (Line 10 onward). Add a non-root user in the runtime stage before entrypoint/cmd usage.\n> \n>\n>\n> \n> As per coding guidelines, \"`USER` non-root; never run as root\" for `Dockerfile`/`Containerfile` patterns.\n> \n>Suggested patch
\n> \n> ```diff\n> FROM registry.ci.openshift.org/ocp/5.0:base-rhel9\n> \n> COPY --from=builder /go/src/sigs.k8s.io/apiserver-network-proxy/proxy-server /usr/bin/proxy-server\n> COPY --from=builder /go/src/sigs.k8s.io/apiserver-network-proxy/proxy-agent /usr/bin/proxy-agent\n> \n> LABEL io.openshift.release.operator=true\n> +USER 65532\n> ```\n>\n>\n> \n> \n> \n> _Sources: Coding guidelines, Linters/SAST tools_\n> \n>🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@Dockerfile.openshift` around lines 10 - 16, The Dockerfile.openshift file\n> currently has no USER directive, which causes the container to run as root by\n> default. Add a non-root USER directive in the runtime stage (in\n> Dockerfile.openshift) after the COPY commands that copy proxy-server and\n> proxy-agent binaries and after the LABEL directive. The USER directive should\n> specify a non-root user to ensure the container runs with restricted privileges\n> according to security guidelines.\n> ```\n> \n>
\n> \n>\n>\n> \n>Dockerfile (1)
\n> \n> `6-11`: _⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Add a HEALTHCHECK in the runtime stage.**\n> \n> No `HEALTHCHECK` is defined after the final stage starts at Line 6, so image-level health signaling is missing. \n> As per coding guidelines, \"`**/{Dockerfile,Containerfile}*`: HEALTHCHECK defined\".\n> \n>\n>\n> \n> \n> \n> _Source: Coding guidelines_\n> \n>🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@Dockerfile` around lines 6 - 11, The Dockerfile runtime stage is missing an\n> image HEALTHCHECK; add a HEALTHCHECK instruction after USER dns-operator (or\n> immediately before ENTRYPOINT [\"/usr/bin/dns-operator\"]) to probe the running\n> dns-operator binary (for example run a lightweight command that verifies\n> /usr/bin/dns-operator is responsive or checks a readiness endpoint) and\n> configure sensible interval/retries/start-period. Ensure the HEALTHCHECK uses\n> the container user context (dns-operator) and references the ENTRYPOINT binary\n> path (/usr/bin/dns-operator) so the runtime image emits proper health signals.\n> ```\n> \n>
/jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.\n\nThe bug has been updated to refer to the pull request using the external bug tracker.\n\nSourced from codecov/codecov-action's releases.
\n>\n>\n>v7.0.0
\n>⚠️ Due to migration issues with keybase, we are unable to update our keys under the
\n>codecovsecurityaccount. We have deleted the account and are usingcodecovsecopswith the original gpg keyWhat's Changed
\n>\n>
\n>- ci: remove Enforce License Compliance workflow by
\n>@thomasrockhu-codecovin codecov/codecov-action#1950- chore(release): 7.0.0 by
\n>@thomasrockhu-codecovin codecov/codecov-action#1957Full Changelog: https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0
\n>v6.0.2
\n>This is a copy of the
\n>v7.0.0release to make updates easierWhat's Changed
\n>\n>
\n>- ci: remove Enforce License Compliance workflow by
\n>@thomasrockhu-codecovin codecov/codecov-action#1950- chore(release): 7.0.0 by
\n>@thomasrockhu-codecovin codecov/codecov-action#1957Full Changelog: https://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2
\n>
Sourced from codecov/codecov-action's changelog.
\n>\n>\n>v5.5.2
\n>What's Changed
\n>Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2
\n>v5.5.1
\n>What's Changed
\n>\n>
\n>- fix: overwrite pr number on fork by
\n>@thomasrockhu-codecovin codecov/codecov-action#1871- build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by
\n>@app/dependabotin codecov/codecov-action#1868- build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by
\n>@app/dependabotin codecov/codecov-action#1867- fix: update to use local app/ dir by
\n>@thomasrockhu-codecovin codecov/codecov-action#1872- docs: fix typo in README by
\n>@datalaterin codecov/codecov-action#1866- Document a
\n>codecov-cliversion reference example by@webknjazin codecov/codecov-action#1774- build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by
\n>@app/dependabotin codecov/codecov-action#1861- build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by
\n>@app/dependabotin codecov/codecov-action#1833Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1
\n>v5.5.0
\n>What's Changed
\n>\n>
\n>- feat: upgrade wrapper to 0.2.4 by
\n>@jviallin codecov/codecov-action#1864- Pin actions/github-script by Git SHA by
\n>@martincostelloin codecov/codecov-action#1859- fix: check reqs exist by
\n>@joseph-sentryin codecov/codecov-action#1835- fix: Typo in README by
\n>@spalmurrayin codecov/codecov-action#1838- docs: Refine OIDC docs by
\n>@spalmurrayin codecov/codecov-action#1837- build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by
\n>@app/dependabotin codecov/codecov-action#1829Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0
\n>v5.4.3
\n>What's Changed
\n>\n>
\n>- build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by
\n>@app/dependabotin codecov/codecov-action#1822- fix: OIDC on forks by
\n>@joseph-sentryin codecov/codecov-action#1823Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3
\n>v5.4.2
\n>\n>
... (truncated)
\n>fb8b358 chore(release): 7.0.0 (#1957)ca0a928 ci: remove Enforce License Compliance workflow (#1950)/jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.\n\nThe bug has been updated to refer to the pull request using the external bug tracker.\n\n