Skip to content

docs(#3502): add UBI base image bump guidance to AGENTS.md #3504

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fullsend-ai-coder wants to merge 1 commit into
base: main
Choose a base branch
from
+23 −0
Open

docs(#3502): add UBI base image bump guidance to AGENTS.md #3504

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,29 @@ Read these before modifying the corresponding areas:
- [internal/validate/vsa/DESIGN.md](internal/validate/vsa/DESIGN.md) — VSA: storage backends, DSSE signing rationale, expiration model
- [acceptance/README.md](acceptance/README.md) — acceptance test framework, Testcontainers, WireMock, snapshot testing

## UBI Base Image Updates

The project pins UBI9 ubi-minimal base image digests in three Dockerfiles:
- `Dockerfile` (production)
- `Dockerfile.dist` (distribution)
- `acceptance/kubernetes/kind/acceptance.Dockerfile` (acceptance tests)

The script `hack/ubi-base-image-bump.sh` updates all three files and regenerates `rpms.lock.yaml`
via `hack/update-rpm-lock.sh`.

### Multi-branch strategy

On `main`, all three Dockerfiles are updated together. On `release-v*` branches, bump PRs may
intentionally update only production Dockerfiles (`Dockerfile`, `Dockerfile.dist`) since acceptance
test infrastructure is typically not backported to release branches. A narrower scope on release
branches is expected, not a bug.

### Review guidance

When reviewing UBI bump PRs on `release-v*` branches, do not flag missing updates to
`acceptance/kubernetes/kind/acceptance.Dockerfile` as stale references. The coordinated update set
defined in `hack/ubi-base-image-bump.sh` applies to `main` branch bumps only.

## Troubleshooting

@fullsend-ai-review fullsend-ai-review Bot Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] technical-accuracy

The statement 'The coordinated update set defined in hack/ubi-base-image-bump.sh applies to main branch bumps only' is misleading. The script itself contains no branch-aware logic — it unconditionally updates all three Dockerfiles. The narrower scope on release branches arises because the script is either not used, or a different mechanism (e.g., Renovate) generates updates independently.

Suggested fix: Rephrase to clarify that the script always updates all three files, but release-branch bump PRs may use a different mechanism that naturally omits acceptance test infrastructure.

@simonbaird simonbaird Aug 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is all madness.

@simonbaird simonbaird Aug 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why does the agent reviewing the a release branch PR even mention files that don't exist in the release branch?


System-level issues that surface in acceptance tests:
Expand Down
Loading