Update docker.io/library/golang Docker tag to v1.26.4 (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change	Pending
docker.io/library/golang	stage	patch	1.26.3 → 1.26.4	1.26.5

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:08 AM UTC · Completed 1:15 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review

Outcome: Approve

Summary

Mechanical patch-version bump of the Go build image from golang:1.26.3 to golang:1.26.4 in Dockerfile, generated by MintMaker/Renovate. The change is a single-line value substitution that follows the existing pattern. No logic, security, API, or documentation concerns.

Findings

Severity	Category	File	Description
low	version-consistency	Dockerfile:19	The Dockerfile is bumped to golang:1.26.4, while Dockerfile.dist still uses go-toolset:1.26.3, and go.mod / .tool-versions also reference 1.26.3. For a Go patch release this is benign — go.mod's go directive is a minimum-version floor, and Renovate manages each dependency independently. No action needed on this PR; the other files will be updated by their own Renovate PRs.

Dimensions evaluated

• Correctness: No logic, edge-case, or test-integrity concerns. The only observation is the expected cross-file version skew noted above.
• Security: No secrets, injection patterns, permission changes, or supply-chain concerns introduced. The mutable tag (no digest pin) on the golang build image is a pre-existing pattern not introduced by this PR.
• Intent & coherence: Mechanical dependency bump by an automated bot. Authorization is implicit from the change's nature.
• Style & conventions: Value-only change follows existing Dockerfile pattern exactly.
• Documentation currency: No documentation impact.
• Cross-repo contracts: No exported interfaces or APIs modified.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

---

Labels: PR already has appropriate labels (dependencies, docker, renovate); adding go label since this is a Go compiler version bump.

Previous run

Review of #3372 — Update docker.io/library/golang Docker tag to v1.26.4

Verdict: Approve ✅

Summary

This is a routine Renovate-automated patch version bump of the Go build image in Dockerfile, from golang:1.26.3 to golang:1.26.4. The change is a single-line tag update — no code, logic, or configuration changes.

Analysis

Dimension	Result
Correctness	✅ Tag format is consistent. Single-line change with no behavioral impact.
Security	✅ Go patch releases typically include security fixes — this is a positive change.
Intent & scope	✅ Appropriately scoped to Dockerfile only. Dockerfile.dist uses a different base image (ubi9/go-toolset) from a different registry and is managed separately.
Style/conventions	✅ Follows existing Renovate update patterns in this repo.
Documentation	✅ No documentation changes needed.

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (2)

Review — #3372

Verdict: ✅ Approve

Summary

This is a single-line, automated patch version bump of the Go build image in Dockerfile from golang:1.26.3 to golang:1.26.4, generated by MintMaker/Renovate. The change is mechanically correct and introduces no logic, security, style, or documentation concerns.

Dimension Results

Dimension	Result	Notes
Correctness	✅ Pass (2 low)	Version skew with other Go version references is expected with separate Renovate rules
Security	✅ Pass	No secrets, injection vectors, or permission changes
Intent & Coherence	✅ Pass	Mechanical dependency bump; authorization implicit
Style & Conventions	✅ Pass	Value-only change follows existing pattern
Documentation	✅ Pass	No public symbols or behavioral changes
Cross-repo Contracts	⏭ Skipped	No exported interfaces modified

Low-severity Observations

1. Go version skew — Dockerfile.dist (Dockerfile, line 19): This PR bumps Dockerfile to Go 1.26.4 while Dockerfile.dist still uses ubi9/go-toolset:1.26.3 (pinned by digest). These are different base images managed by separate Renovate rules, so the temporary skew is expected and will resolve when the go-toolset:1.26.4 image is published and picked up.

2. Go version skew — go.mod / .tool-versions (Dockerfile, line 19): Several files (.tool-versions, go.mod, tools/go.mod, tools/kubectl/go.mod, acceptance/go.mod) still reference Go 1.26.3. These are managed independently and the patch-level discrepancy is benign for Go's compatibility guarantees.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (3)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected infrastructure file requiring human approval. The PR has no linked issue providing authorization for the change. While the PR is a Renovate-managed patch bump of the Go base image (1.26.3 → 1.26.4), protected-path changes always require explicit human review and approval regardless of the change's nature.
  Remediation: A human reviewer with infrastructure approval authority should verify and approve this Dockerfile change.

Previous run (4)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is a protected path requiring human approval. The PR is an automated Renovate dependency update (golang 1.26.3 → 1.26.4) with a clear rationale in the PR body, but human review is always required for changes to governance and infrastructure files regardless of context.

---

Labels: PR modifies the Dockerfile to bump a dependency version.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:39 AM UTC · Completed 1:44 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:49 AM UTC · Completed 1:54 AM UTC
Commit: 7c8ccca · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:39 AM UTC · Completed 1:42 AM UTC
Commit: 8f05d87 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:33 AM UTC · Completed 1:38 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[low] version-consistency

The Dockerfile is bumped to golang:1.26.4, while Dockerfile.dist still uses go-toolset:1.26.3 and go.mod/.tool-versions reference 1.26.3. For a Go patch release this is benign — go.mod's go directive is a minimum-version floor, and Renovate manages each dependency independently. No action needed on this PR.