Update docker.io/library/golang Docker tag to v1.26.3 (main) - autoclosed

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change	Pending
docker.io/library/golang	stage	minor	1.25.8 → 1.26.3	1.26.4

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:27 AM UTC · Completed 1:34 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected governance/infrastructure file. The PR has no linked issue providing authorization for this change. While the change itself is a straightforward Go version bump (1.25.8 → 1.26.3) from the Renovate bot, protected-path changes require human review and justification via a linked issue.
  Remediation: Link an issue authorizing this Dockerfile change, or obtain explicit human maintainer approval.

---

Labels: PR modifies the Dockerfile to bump the Go builder image, matching docker and dependencies labels.

Previous run

Review

Findings

Medium

• [version mismatch] Dockerfile:19 — The Dockerfile bumps the build image from golang:1.25.8 to golang:1.26.4, but go.mod (and tools/kubectl/go.mod, tools/go.mod, acceptance/go.mod) all still declare go 1.25.8. There is no toolchain directive in any go.mod. Building a go-1.25.8-declared module with a Go 1.26 toolchain may introduce differing default GODEBUG values and vet behavior between Docker builds and local/CI builds that use Go 1.25.8, and this is a minor-version jump rather than a patch bump.
  Remediation: Either (a) update all four go.mod files to go 1.26.4, or (b) keep the Dockerfile at a 1.25.x patch release matching go.mod. If intentionally using a newer toolchain, add a toolchain go1.26.4 directive to go.mod to make the intent explicit.

Info

• [sub-agent-failure] The style-conventions sub-agent did not return findings due to model unavailability. This dimension was not evaluated.

Previous run (2)

Review

Findings

Low

• [stale-reference] Dockerfile.dist:19 — Dockerfile.dist still references Go 1.25.8 (via go-toolset:1.25.8). The two Dockerfiles now specify different Go toolchain versions (1.26.3 vs 1.25.8), which could produce binaries with different language-level behavior depending on which Dockerfile is used for the build. This is expected since Dockerfile.dist uses the Red Hat go-toolset image from a different registry with its own release cadence — no action needed unless the versions are intended to stay in sync.

• [version-mismatch] go.mod:3 — go.mod declares go 1.25.8 while the Dockerfile now builds with Go 1.26.3. This is not a build error (Go is backward-compatible), but the module's declared minimum version is a full minor release behind the actual build toolchain.

• [version-mismatch] .tool-versions:1 — .tool-versions still pins golang 1.25.8. Local developer builds will use a different Go version than the Docker build, potentially masking version-specific issues.

Info

• [missing-authorization] Dockerfile:19 — No linked issue. Authorization inferred from the mechanical nature of the change (automated Renovate bot dependency version bump).

[fullsend-ai-review]

[info] missing-authorization

No linked issue. Authorization inferred from the mechanical nature of the change (automated Renovate bot dependency version bump).

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 3:12 AM UTC · Ended 3:18 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:20 AM UTC · Completed 3:25 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:46 AM UTC · Completed 2:51 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] protected-path

This PR modifies Dockerfile, which is a protected governance/infrastructure file. The PR has no linked issue providing authorization for this change. While the change itself is a straightforward Go version bump (1.25.8 to 1.26.3) from the Renovate bot, protected-path changes require human review and justification via a linked issue.

Suggested fix: Link an issue authorizing this Dockerfile change, or obtain explicit human maintainer approval.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 9:37 PM UTC · Completed 9:43 PM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3194 (Renovate Go Docker tag bump, autoclosed)

This was an automated Renovate bot PR updating the Go Docker image from 1.25.8 to 1.26.3 in a single Dockerfile line. It was open for 3 months with 8+ force-push rebases, received 3 review agent runs with escalating severity (approved → requires-manual-review → changes-requested), and was ultimately autoclosed by the bot without merging.

Key observations

1. Review severity inconsistency across runs: The same fundamental issues (version mismatch with go.mod/.tool-versions, no linked issue) were rated [low] on Run 1 (approved), [medium] on Run 2, and [high] protected-path on Run 3 (changes requested). Run 1 applied ready-for-merge which was later removed.
2. Wasted review cycles on bot rebases: Each bot rebase triggered a new review run despite no semantic change to the diff. Three review runs consumed tokens for a PR that was never merged.
3. Retro running on autoclosed bot PR: This retro itself is an example of unnecessary work — the PR was autoclosed by the bot (superseded by a newer version), making retrospective analysis low-value.
4. Protected-path finding on bot dependency PR: The final review flagged [high] protected-path on a Dockerfile change from a known dependency bot, which is noisy for this class of change.

No new proposals — existing issues cover all findings

All improvement opportunities identified are already tracked by open issues in fullsend-ai/fullsend:

• Severity inconsistency / approve-then-escalate: #1319 (align approval with severity on first pass), #827 (revoke stale approvals), #1561 (inconsistent findings on identical diffs)
• Bot PR review waste: #1355 (skip re-review on no-semantic-change rebase), #1358 (lightweight review for trivial bot bumps), #2639 (fast-path for trivial bot PRs)
• Retro on autoclosed bot PRs: #2461 (skip retro dispatch for autoclosed bot-authored PRs) — this is exactly what happened here
• Protected-path noise on bot PRs: #2588 (downgrade protected-path severity for bot dependency PRs)
• Version mismatch across pinning files: conforma/cli#3360 (configure Renovate to update Go version atomically across all files)

This workflow is a textbook case for the bot-PR optimization track. Resolving #2461 alone would have prevented this retro from running.