chore(deps): Update google.golang.org/grpc and ubi base image (v0.8)

[simonbaird]

Update google.golang.org/grpc module dependency.

Version changes:

• acceptance/go.mod: v1.82.0 → v1.83.2
• go.mod: v1.82.0 → v1.83.2
• tools/go.mod: v1.82.0 → v1.83.2

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: f92bc94a-c62b-4b44-b11c-696a1a7a9bbb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Upgrade gRPC to v1.83.2 across Go modules

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Upgrade gRPC from v1.82.0 to v1.83.2 across application and tooling modules.
• Refresh transitive dependency versions and checksums, including kubectl tooling dependencies.

Diagram

graph TD
  G["gRPC v1.83.2"] --> R["Root module"] --> RS["Root checksums"]
  G --> A["Acceptance module"] --> AS["Acceptance checksums"]
  G --> T["Tools module"] --> TS["Tools checksums"]
  T --> K["Kubectl module"]

Loading

High-Level Assessment

The automated Go module upgrade is the appropriate approach because it updates gRPC consistently and preserves the dependency solver's transitive selections and checksums. Manual pinning or suppressing transitive updates would risk inconsistent module graphs without providing a meaningful benefit.

Files changed (8) +90 / -90

Other (8) +90 / -90

go.modUpgrade acceptance gRPC and transitive dependencies +6/-6

Upgrade acceptance gRPC and transitive dependencies

• Raises gRPC to v1.83.2 in the acceptance module. Also refreshes CEL and golang.org/x dependency versions selected by the module graph.

acceptance/go.mod

go.sumRefresh acceptance dependency checksums +14/-14

Refresh acceptance dependency checksums

• Replaces checksums for gRPC v1.82.0 and superseded transitive releases with entries for the newly resolved versions.

acceptance/go.sum

go.modUpgrade root gRPC dependency graph +10/-10

Upgrade root gRPC dependency graph

• Raises gRPC to v1.83.2 and updates related networking, text, telemetry, SPIFFE, CEL, and Go tooling dependencies resolved in the root module.

go.mod

go.sumRefresh root module checksums +20/-20

Refresh root module checksums

• Updates checksum entries for gRPC v1.83.2 and the root module's newly selected transitive dependency versions.

go.sum

go.modUpgrade tooling gRPC dependency graph +10/-10

Upgrade tooling gRPC dependency graph

• Raises gRPC to v1.83.2 in the tools module and aligns its CEL, telemetry, SPIFFE, golang.org/x, and related transitive dependencies.

tools/go.mod

go.sumRefresh tooling dependency checksums +20/-20

Refresh tooling dependency checksums

• Regenerates checksums for the upgraded gRPC release and all changed transitive dependencies in the tools module.

tools/go.sum

go.modAlign kubectl transitive Go dependencies +2/-2

Align kubectl transitive Go dependencies

• Updates the kubectl submodule's indirect golang.org/x/net and golang.org/x/text dependencies to versions selected by the refreshed module graph.

tools/kubectl/go.mod

go.sumRefresh kubectl dependency checksums +8/-8

Refresh kubectl dependency checksums

• Replaces checksums for prior golang.org/x module releases with the newly resolved mod, net, text, and tools versions.

tools/kubectl/go.sum

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:21 PM UTC · Completed 2:27 PM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.69

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — Protected paths modified without linked issue authorization. Both Dockerfiles update the UBI9 minimal base image digest (sha256:8eb2830d... → sha256:7fbeae18...). Protected-path policy requires human approval for changes to governance and infrastructure files. The PR lacks a linked issue providing explicit authorization for these changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — These files are under the protected path Dockerfile. The PR has no linked issue providing authorization for modifying governance/infrastructure files. Human approval is always required for protected-path changes.
  Remediation: Link an issue that authorizes the Dockerfile changes, or obtain explicit human approval for the base image update.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Looks good to me

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:32 PM UTC · Completed 2:40 PM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.76

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.86% <ø> (+<0.01%)	⬆️
generative	18.14% <ø> (ø)
integration	26.99% <ø> (ø)
unit	68.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[joejstuart]

A newer ubi9/ubi-minimal image is now available and should replace sha256:580752f96d36c4132bffd30f9c34865bf4bd87f6aa161c969d117f21732e50f7:

registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93

This is UBI 9.8-1788166357, built on 2026-08-31 at 08:53 UTC after the libxml2 security advisory shipped. Please update both Dockerfiles to this digest so the rebuilt release image includes the libxml2 fix.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:55 PM UTC · Completed 3:04 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.26

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Dependency-only update with 11 files and 224 lines changed, elevated by 2 protected paths (Dockerfiles) and 8 dependency files, but low git churn and mechanical nature keep overall risk moderate.

[fullsend-ai-review]

See the review comment for full details.

[robnester-rh]

LGTM

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 3:37 PM UTC · Completed 3:48 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.68

[fullsend-ai-retro]

Retro: PR #3518 — chore(deps): Update google.golang.org/grpc and ubi base image (v0.8)

Timeline

This was a human-authored dependency upgrade PR by simonbaird, updating gRPC from v1.82.0 to v1.83.2 and the UBI9 minimal base image digest across Dockerfiles. The PR was opened on Aug 26 and merged Sep 1 after two human approvals overrode the review agent's protected-path findings.

1. Aug 26 14:19 — PR opened with grpc-only changes (go.mod/go.sum, 8 files).
2. Aug 26 14:27 — Review Run 1 completed: APPROVED ($1.69). Only go.mod/go.sum in scope.
3. Aug 26 14:30 — Author pushed a second commit adding Dockerfile and Dockerfile.dist changes (UBI base image digest bump).
4. Aug 26 14:40 — Review Run 2 completed: CHANGES_REQUESTED ($1.76). Flagged [protected-path] on both Dockerfiles — no linked issue.
5. Aug 26 17:30 — Human dheerajodha dismissed the CHANGES_REQUESTED review.
6. Aug 31 — Human joejstuart requested a newer UBI digest (libxml2 security fix).
7. Sep 1 14:54 — Author force-pushed with the updated UBI digest.
8. Sep 1 15:04 — Review Run 3 completed: CHANGES_REQUESTED ($2.26). Same protected-path finding repeated.
9. Sep 1 15:34 — Human robnester-rh approved with "LGTM".
10. Sep 1 15:36 — PR merged.

Key observations

Review cost: $5.71 total, ~$3.95 avoidable (69%). Of three review runs, only Run 2 ($1.76) produced genuinely new information. Run 1 was superseded 11 minutes later when the author pushed Dockerfile changes. Run 3 repeated the identical protected-path finding from Run 2 after a force-push. All sub-agents (correctness, style-conventions, security) returned zero findings across all three runs — the only actionable output was the protected-path file-list check.

Protected-path finding was policy-correct but created unnecessary friction. The Dockerfiles were modified only to update the FROM-line base image digest — a mechanical, routine operation. Two separate humans dismissed or overrode the finding without requesting any code changes, confirming this was expected maintenance.

Evidence for existing open issues (no new proposals needed)

All improvement opportunities identified in this retro are already tracked:

• Refine protected-path policy to allow agent approval for FROM-line-only Dockerfile changes with digest pinning fullsend-ai/fullsend#3675 — Refine protected-path policy for FROM-line-only Dockerfile digest changes. This retro provides a concrete example: both Dockerfiles changed only the base image digest SHA, and two humans overrode the finding without discussion.
• Debounce review dispatch on rapid synchronize events fullsend-ai/fullsend#1014 — Debounce review dispatch on rapid pushes. Run 1 was triggered at 14:20 and invalidated by a new push at 14:30 (10 min gap). A debounce window would have saved $1.69.
• Deduplicate inline review comments across force-push re-reviews fullsend-ai/fullsend#5007 — Deduplicate findings across force-push re-reviews. Run 3 re-raised the identical protected-path finding that Run 2 had already surfaced and a human had already dismissed.
• Review agent should not re-raise findings that a human has explicitly resolved fullsend-ai/fullsend#3515 — Review agent should not re-raise findings a human has explicitly resolved. The human dismissal of Run 2's CHANGES_REQUESTED was ignored by Run 3.
• Review agent: use cheaper model for trivial bot-authored PRs fullsend-ai/fullsend#2842 — Use cheaper model for trivial dependency PRs. All three runs used claude-opus-4-6 at high effort for a mechanical go.mod/Dockerfile-digest change where zero code-quality findings existed.
• Add AGENTS.md guidance for UBI base image bump workflow and release branch scope #3502, Document UBI base image bump workflow in AGENTS.md to prevent false-positive review findings #3503 — Document UBI base image bump workflow in AGENTS.md. Issue Document UBI base image bump workflow in AGENTS.md to prevent false-positive review findings #3503 already has a PR open (pr-open label).
• Track autonomy readiness: review agent fully covered human review on Go dependency upgrade PR #3406 in conforma/cli fullsend-ai/fullsend#4882 — Autonomy readiness for Go dependency upgrade PRs in conforma/cli. This PR adds another data point: the review agent's analysis was comprehensive (no gaps), both humans approved without adding findings the agent missed, and the only friction was the overly strict protected-path policy for digest-only changes.