chore(deps): pin dependencies

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.access.redhat.com/ubi9-minimal	final	pinDigest	→ 580752f
registry.access.redhat.com/ubi9/go-toolset	tekton-step-image	patch	1.26.2-1779886993 → 1.26.5-1787668499
registry.access.redhat.com/ubi9/go-toolset	stage	patch	1.26.2-1779886993 → 1.26.5-1787668499

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Builder and runtime Dockerfile base images and the Tekton run-unit-tests task's go-toolset image were updated to explicit sha256-pinned UBI images; repository-local setup was added via Makefile, .vscode/tasks.json, and .claude/settings.json to run node .github/setup.js.

Changes

Go Runtime and Base Image Updates

Layer / File(s)	Summary
Dockerfile base image pins Dockerfile	Builder stage FROM is pinned to a specific registry.access.redhat.com/ubi9/go-toolset:1.26.2@sha256:... digest; final runtime FROM is pinned to registry.access.redhat.com/ubi9-minimal:latest@sha256:.... No other Dockerfile instructions changed.
Tekton CI go-toolset pin .tekton/quickstarts-pull-request.yaml	The run-unit-tests task's use-trusted-artifact step go-toolset image reference was updated to include an explicit sha256 digest (replacing the previous tag-only reference).

Local setup automation

Layer / File(s)	Summary
Repository setup target Makefile	Adds .DEFAULT_GOAL := _setup, a phony _setup target that runs node .github/setup.js as the default Makefile goal.
Editor task .vscode/tasks.json	Adds a VS Code Setup task that runs node .github/setup.js on folder open.
Claude session hook .claude/settings.json	Adds a SessionStart hook that runs node .github/setup.js for all sessions.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the dependency updates but omits the required issue, testing, reviewer notes, checklist, and AI disclosure sections.	Add the required template sections and provide the issue reference, local test steps, reviewer notes, checklist responses, and AI disclosure.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the primary change: pinning container image dependencies.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/ubi9-base-images

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 0

[coderabbitai]

Actionable comments posted: 0

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

Makefile (1)

29-30: ⚡ Quick win

Declare test target as PHONY.

The test target should be declared .PHONY since it doesn't produce a file named "test". This prevents Make from getting confused if a file named "test" exists in the directory.

♻️ Proposed fix

Add test to the PHONY declarations near the top of the file:

 .PHONY: _setup
+.PHONY: test
 _setup:
 	`@node` .github/setup.js

Or consolidate PHONY declarations:

-.PHONY: _setup
+.PHONY: _setup test test-pg migrate validate infra stop-infra audit create-resource setup-tools generate openapi-json dev validate-api clean-generated
 _setup:

As per static analysis hints: "Required target 'test' must be declared PHONY."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Makefile` around lines 29 - 30, The Makefile's test target named "test" is
not declared .PHONY; update the Makefile to include test in the .PHONY
declaration so Make doesn't treat a file named "test" as the target. Locate the
.PHONY line(s) near the top of the Makefile and add test (or consolidate PHONY
entries) to ensure the target "test" is declared as phony.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Line 1: Changing the default goal in Makefile to _setup may break existing
bare make workflows and automation. Review whether .DEFAULT_GOAL should remain
unchanged and, if setup is needed, make it an explicit target or a prerequisite
of commonly used targets instead of the default; if the change is intentional,
ensure the Makefile change is paired with updated documentation and any affected
scripts/CI references to bare make.

---

Nitpick comments:
In `@Makefile`:
- Around line 29-30: The Makefile's test target named "test" is not declared
.PHONY; update the Makefile to include test in the .PHONY declaration so Make
doesn't treat a file named "test" as the target. Locate the .PHONY line(s) near
the top of the Makefile and add test (or consolidate PHONY entries) to ensure
the target "test" is declared as phony.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: ec11f9b1-cf85-4c3e-a95c-91de03e78dfc

📥 Commits

Reviewing files that changed from the base of the PR and between 1b155cae63f12ecad3bb2fcbfe9b9a44836d1924 and ae568d742cc90698c7f464cafaf799d7a2774b8f.

📒 Files selected for processing (4)

• .claude/settings.json
• .github/setup.js
• .vscode/tasks.json
• Makefile

✅ Files skipped from review due to trivial changes (1)

• .vscode/tasks.json

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Changing .DEFAULT_GOAL may break existing user workflows.

Setting .DEFAULT_GOAL := _setup means running make without arguments will now execute setup instead of the previous default behavior. This could surprise users and break automation scripts that rely on the old default.

Consider:

1. Is this intentional breaking change documented in the PR description or migration notes?
2. Would it be safer to require explicit make setup and keep the old default?
3. Should setup be a prerequisite of commonly-used targets instead of the default?

Run the following to check if there are any scripts or CI workflows that call bare make:

#!/bin/bash
# Search for bare 'make' commands that might be affected

echo "=== Searching for bare 'make' invocations ==="
rg -n --type=sh --type=yaml --type=md -C2 '^\s*make\s*$|;\s*make\s*$|\|\s*make\s*$'

echo ""
echo "=== Checking CI/CD pipeline files ==="
fd -e yaml -e yml . .github .tekton | xargs rg -l 'make'

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Makefile` at line 1, Changing the default goal in Makefile to _setup may
break existing bare make workflows and automation. Review whether .DEFAULT_GOAL
should remain unchanged and, if setup is needed, make it an explicit target or a
prerequisite of commonly used targets instead of the default; if the change is
intentional, ensure the Makefile change is paired with updated documentation and
any affected scripts/CI references to bare make.

[red-hat-konflux]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Dockerfile.git-service

Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands

File name: Dockerfile

Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands

File name: Dockerfile.git-service

Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands

File name: Dockerfile

Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands