Update docker.io/library/golang Docker tag to v1.26.5 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/golang	stage	patch	1.26.3 → 1.26.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:17 AM UTC · Completed 1:23 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review of #3366

LGTM ✅

Change: Bumps the Go build image from golang:1.26.3 to golang:1.26.5 (patch release) in the Dockerfile.

Assessment

This is a mechanical Renovate patch version bump of the Go Docker build image. Reviewed across correctness, security, intent, style, and documentation dimensions.

• Correctness: The go directive in go.mod (1.26.3) specifies a minimum version. Go 1.26.5 is fully backward-compatible and will build the module without issue. Renovate typically handles go.mod and .tool-versions updates in separate PRs.
• Security: No auth, permissions, secrets, or injection concerns. The mutable tag pattern (golang:1.26.5 vs digest-pinned) is pre-existing and not introduced by this PR.
• Intent: Mechanical dependency update by Renovate bot — authorization is implicit from the automated nature of the change.
• Style: The version tag format is consistent with the existing Dockerfile pattern.
• Documentation: No public-facing docs reference specific Go build image versions.

No blocking findings. Safe to merge.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run

Review — Approve ✅

PR: #3366 — Update docker.io/library/golang Docker tag to v1.26.4 (main)
Author: renovate[bot] | Files changed: 1 | Lines: +1/−1

Summary

Routine Renovate patch-version bump of the Go build image (docker.io/library/golang) from 1.26.3 → 1.26.4 in the Dockerfile. The change is a single-line, value-only modification to the build-stage base image tag.

Reviewed across correctness, security, intent/coherence, style, documentation currency, and cross-repo contracts. No blocking findings.

Observations (low severity — non-blocking)

• Version skew with go.mod files: The four go.mod files (go.mod, acceptance/go.mod, tools/go.mod, tools/kubectl/go.mod) and .tool-versions still specify Go 1.26.3. This is expected Renovate behavior — it manages Docker image tags and go directives as separate dependency updates. The Go toolchain is backward-compatible at the patch level, so building inside a 1.26.4 container with go 1.26.3 in go.mod is valid. CI workflows use go-version-file: go.mod and will continue using 1.26.3 until the go.mod is updated separately.

• Dockerfile.dist uses separate image source: Dockerfile.dist references registry.access.redhat.com/ubi9/go-toolset:1.26.3 (pinned by digest). This is a different image registry managed on a separate Renovate cadence — no inconsistency.

Dimensions reviewed

Dimension	Result
Correctness	✅ No logic issues. Tag format consistent.
Security	✅ No secrets, injection vectors, or permission changes.
Intent & coherence	✅ Mechanical change, authorization implicit.
Style & conventions	✅ Value follows existing pattern.
Documentation currency	✅ No docs reference Go 1.26.3.
Cross-repo contracts	⏭ Skipped — no exported APIs modified.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (2)

Review — approve

Summary

Automated Renovate patch-level bump of the Go build image in Dockerfile: docker.io/library/golang:1.26.3 → 1.26.4.

The change is a single-line modification to the multi-stage build's FROM directive. No application code, configuration, tests, or documentation are affected.

Analysis

Dimension	Assessment
Correctness	✅ Trivially correct — only the Docker image tag changes. The build stage, arguments, and all subsequent steps are unchanged.
Security	✅ Positive — patch releases typically include security and bug fixes. Staying current with Go patch versions is good practice.
Intent & coherence	✅ Standard automated dependency update, appropriately scoped to a single file. Consistent with the project's Renovate configuration.
Style/conventions	✅ Follows the existing docker.io/library/golang:<version> convention without digest pinning (matching the project's current approach).
Documentation	✅ No documentation impact.
Cross-repo contracts	✅ No API, schema, or interface changes.

Go version note: The go.mod directive remains at go 1.26.3. This is fine — the Go toolchain respects the go.mod language version, and building with a newer patch-level image is standard practice. Renovate manages go.mod and Dockerfile updates independently.

Findings

No findings at or above the reporting threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (3)

Review

Outcome: Approve

Summary

Automated Renovate patch-version bump of the Go build image from golang:1.26.3 to golang:1.26.4 in the Dockerfile's build stage. This is a single-line change with no impact on application logic, APIs, or runtime behavior.

Analysis

Dimension	Finding
Correctness	✅ Patch version bump is backward-compatible with the go 1.26.3 directive in go.mod. No behavioral changes.
Security	✅ Patch releases typically include bug fixes and security patches — updating is beneficial.
Intent & scope	✅ Properly scoped automated dependency update; single file, single line.
Style	✅ No style changes.
Documentation	✅ No documentation impact.
Cross-repo contracts	✅ No API or schema changes.

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

---

Labels: PR updates Go toolchain version in Docker build stage

Previous run (4)

Review

Findings

High

• [protected-path] Dockerfile:19 — Dockerfile is a protected infrastructure file requiring human approval. This PR modifies it but has no linked issue providing explicit authorization for the change. While the PR is authored by renovate[bot] and renovate.json is configured for this repository (indicating this is an expected automated dependency update of golang from 1.26.3 to 1.26.4), protected-path changes always require human review and approval regardless of automation source.
  Remediation: A human maintainer must review and approve this Dockerfile change.

Previous run (5)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected governance/infrastructure file requiring human approval. The PR has no linked issue providing authorization for this change. While the change is a mechanical Renovate patch version bump (golang 1.26.3 → 1.26.4), protected-path changes require explicit justification via a linked issue regardless of scope.
  Remediation: Ensure a human reviewer with appropriate permissions approves this protected-path change. For future automated dependency updates to protected files, consider linking a standing issue or policy that authorizes routine patch bumps.

Previous run (6)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected path requiring human approval. The PR has no linked issue providing authorization for this change. While the Renovate bot description explains the version bump (golang 1.26.3 → 1.26.4) and the change itself is a routine patch update with no correctness or security concerns, protected-path changes without a linked issue require explicit human approval for traceability.
  Remediation: A maintainer should explicitly approve this protected-path change, or link an authorizing issue to the PR.

---

Labels: PR modifies the Dockerfile for a Docker base image version bump.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:39 PM UTC · Completed 2:45 PM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:53 PM UTC · Completed 7:59 PM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:43 AM UTC · Completed 9:45 AM UTC
Commit: 47d3320 · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:02 PM UTC · Completed 1:04 PM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:46 PM UTC · Completed 8:51 PM UTC
Commit: 7c8ccca · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:52 AM UTC · Completed 12:57 AM UTC
Commit: 7c8ccca · View workflow run →