chore(deps): Update google.golang.org/grpc and ubi base image (v0.7)

[simonbaird]

Update google.golang.org/grpc module dependency.

Version changes:

• acceptance/go.mod: v1.82.0 → v1.83.2
• go.mod: v1.82.0 → v1.83.2
• tools/go.mod: v1.82.0 → v1.83.2

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 2c3657b7-0292-4e6f-91e9-2913620b7982

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Upgrade gRPC to v1.83.2 across Go modules

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Upgrades gRPC from v1.82.0 to v1.83.2 across applicable Go modules.
• Refreshes transitive dependencies and checksums for consistent module resolution.

Diagram

graph TD
  G["gRPC v1.83.2"] --> R["Module resolution"] --> M["Root module"] --> S["Checksum files"]
  R --> A["Acceptance module"] --> S
  R --> T["Tools module"] --> S
  R --> K["Kubectl module"] --> S

Loading

High-Level Assessment

Using the repository's Go module upgrade helper is the appropriate approach because it keeps gRPC and its minimum-version-selected transitive dependencies synchronized across module boundaries. Manually pinning only gRPC was considered but would risk inconsistent manifests and stale checksums.

Files changed (8) +90 / -90

Other (8) +90 / -90

go.modUpgrade acceptance module gRPC dependencies +6/-6

Upgrade acceptance module gRPC dependencies

• Raises gRPC to v1.83.2 in the acceptance module and updates related indirect Go modules selected during dependency resolution.

acceptance/go.mod

go.sumRefresh acceptance dependency checksums +14/-14

Refresh acceptance dependency checksums

• Replaces checksums for gRPC and the transitive module versions selected by the acceptance module upgrade.

acceptance/go.sum

go.modUpgrade root module gRPC dependency set +10/-10

Upgrade root module gRPC dependency set

• Raises gRPC to v1.83.2 and refreshes direct and indirect dependencies selected in the root module, including networking, telemetry, SPIFFE, and Go tooling modules.

go.mod

go.sumRefresh root module dependency checksums +20/-20

Refresh root module dependency checksums

• Updates integrity hashes for gRPC and all transitive versions changed by root module resolution.

go.sum

go.modUpgrade tools module gRPC dependency set +10/-10

Upgrade tools module gRPC dependency set

• Raises gRPC to v1.83.2 and synchronizes the tools module's related indirect dependencies with the resolved graph.

tools/go.mod

go.sumRefresh tools module dependency checksums +20/-20

Refresh tools module dependency checksums

• Updates checksums for gRPC and the transitive dependency versions selected in the tools module.

tools/go.sum

go.modAlign kubectl transitive Go modules +2/-2

Align kubectl transitive Go modules

• Advances the nested kubectl module's transitive networking and text dependencies to versions selected by the repository-wide upgrade.

tools/kubectl/go.mod

go.sumRefresh kubectl transitive checksums +8/-8

Refresh kubectl transitive checksums

• Replaces hashes for the updated Go module, networking, text, and tools dependencies in the nested kubectl module.

tools/kubectl/go.sum

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:21 PM UTC · Completed 2:27 PM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.58

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	69.55% <ø> (ø)
integration	69.55% <ø> (ø)
unit	69.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — Protected governance/infrastructure files modified. Both Dockerfiles update the UBI9 base image digest (sha256:8eb2830d... → sha256:7fbeae18...), which is a routine dependency change. However, the PR has no linked issue providing authorization for modifying protected paths. Human approval is always required for protected-path changes.
  Remediation: Link a tracking issue that authorizes the base image update, or obtain explicit human approval for these protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — This PR modifies protected infrastructure files (Dockerfile, Dockerfile.dist) which require human approval. The PR has no linked issue and the description does not explain why these files are being changed — it only describes go.mod dependency version bumps. The Dockerfile changes are base image digest updates (ubi9/ubi-minimal digest swap) that appear routine but fall under protected-path governance.
  Remediation: Ensure a human reviewer explicitly approves the Dockerfile changes. Consider adding a brief note to the PR description explaining the base image digest update, or linking to an issue/policy that authorizes routine base image updates alongside dependency bumps.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Looks good to me

---

Labels: PR updates Go module dependencies (grpc v1.82.0 to v1.83.2 and transitive deps)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:30 PM UTC · Completed 2:37 PM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.55

[joejstuart]

A newer ubi9/ubi-minimal image is now available and should replace sha256:580752f96d36c4132bffd30f9c34865bf4bd87f6aa161c969d117f21732e50f7:

registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93

This is UBI 9.8-1788166357, built on 2026-08-31 at 08:53 UTC after the libxml2 security advisory shipped. Please update both Dockerfiles to this digest so the rebuilt release image includes the libxml2 fix.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:54 PM UTC · Completed 3:06 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.25

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Routine dependency update PR with 2 protected paths (Dockerfiles) and multiple dependency files changed. Tier 1 composite: 2.75, Tier 2 composite: 2.05. Weighted score (0.62×2.75 + 0.38×2.05 = 2.48) rounds to 2.

[fullsend-ai-review]

See the review comment for full details.

[robnester-rh]

LGTM

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 3:36 PM UTC · Completed 3:47 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.50

[fullsend-ai-retro]

Retro: PR #3517 — chore(deps): Update grpc and ubi base image (v0.7)

What happened

This human-authored dependency bump PR updated google.golang.org/grpc (v1.82.0 → v1.83.2) and the UBI9 base image digest across three Go modules and two Dockerfiles. The review agent ran 3 times across 6 days, costing $6.38 total ($1.58 + $1.55 + $3.25).

Review iteration timeline:

1. Run 1 (32979600713, Aug 26 14:21–14:27, $1.58) — Reviewed only the initial go.mod/go.sum changes (no Dockerfiles yet). APPROVED.
2. Run 2 (32980566031, Aug 26 14:30–14:37, $1.55) — Triggered after force-push added Dockerfile changes. Correctly flagged Dockerfile and Dockerfile.dist as protected paths with no linked issue. CHANGES_REQUESTED. Human @dheerajodha dismissed this review.
3. Run 3 (33522268887, Sep 1 14:54–15:06, $3.25) — Triggered after another force-push (updated UBI image per @joejstuart's request). Produced the identical protected-path finding. CHANGES_REQUESTED. Two humans (@joejstuart, @robnester-rh) then approved and the PR merged.

The review agent used fullsend-ai/agents@v0.39.0 (commit c4e059f9f2b8). All three runs correctly classified the PR as a mechanical dependency bump and appropriately scoped sub-agents to trivial. The correctness and security sub-agents found no issues. The sole finding across all iterations was the protected-path governance check on the Dockerfiles.

Assessment

The review agent behaved correctly per its current rules: Dockerfile modifications without a linked issue trigger a high-severity protected-path finding that forces CHANGES_REQUESTED. However, this workflow pattern is costly for routine dependency bumps — 3 runs and $6.38 for a change that always required human sign-off and never had actionable agent findings.

Run 3 was ~2x more expensive ($3.25 vs $1.55) because the prior review comment's provenance could not be validated (it was created by a different GitHub App — log line: Prior review comment 5426798938 created by app client_id=Iv23li1nIorNLIQy6NWK, expected — discarding (wrong app)). This forced a full first-review scope instead of a narrower incremental re-review.

Existing issue coverage

All improvement areas identified are already tracked by open issues. No new proposals are warranted. Evidence from this PR supports:

• fullsend-ai/agents#931 — Configure REVIEW_APP_CLIENT_ID for provenance validation. This PR demonstrates the direct cost impact: Run 3 cost $3.25 (full review) vs the expected ~$1.55 (incremental re-review), a ~$1.70 overhead from the provenance failure.
• fullsend-ai/agents#1110 — Use COMMENT verdict when all findings are human-only. The protected-path finding was marked actionable: false since linking an issue cannot be done by a fix agent, yet the agent still submitted CHANGES_REQUESTED.
• fullsend-ai/agents#741 — Assess semantic significance of protected-path changes before assigning high severity. A digest-only Dockerfile change in a dependency bump PR is low-risk.
• conforma/cli#3502 / #3503 — Add AGENTS.md guidance for UBI base image bump workflow. This PR is another instance of the pattern those issues aim to address.
• fullsend-ai/fullsend#3061 — Reduce protected-path severity for digest-only Dockerfile changes. This PR is a direct example of the behavior that issue targets.