Update grpc golang module and bump ubi base image (v0.9)

[simonbaird]

Similar to PR #3519 but for the new v0.9 release branch.

Commits are cherry picked.

[qodo-for-conforma]

PR Summary by Qodo

Upgrade gRPC and UBI runtime dependencies for v0.9

⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Upgrades gRPC to v1.83.2 across application, acceptance, and tooling modules.
• Refreshes transitive Go dependencies and checksums required by the gRPC upgrade.
• Pins newer UBI minimal and gzip artifacts for reproducible release builds.

Diagram

graph TD
  GRPC["gRPC v1.83.2"] -->|"declared in"| MODULES["Go modules"] -->|"verified by"| SUMS["Checksums"]
  UBI["UBI minimal"] -->|"pinned by"| DOCKER["Dockerfiles"] -->|"build"| IMAGES["Runtime images"]
  UBI -->|"publishes"| REPOS["UBI repositories"] -->|"resolved into"| LOCK["RPM lock"]

Loading

High-Level Assessment

The current approach is appropriate: it uses the repository’s upgrade helper to refresh gRPC and its transitive graph consistently across every Go module, while retaining immutable image, RPM, and checksum pins. Narrow manual edits or floating image tags would reduce diff size but risk inconsistent module graphs or non-reproducible release builds.

Files changed (12) +137 / -138

Other (12) +137 / -138

DockerfileRefresh the production UBI minimal image digest +1/-1

Refresh the production UBI minimal image digest

• Pins the final production image to the newer UBI 9 minimal digest while preserving the existing build stages and runtime configuration.

Dockerfile

Dockerfile.distRefresh the distribution UBI minimal image digest +1/-1

Refresh the distribution UBI minimal image digest

• Aligns the distribution image with the same updated immutable UBI 9 minimal digest used by the production Dockerfile.

Dockerfile.dist

go.modUpgrade acceptance-test gRPC dependencies +8/-8

Upgrade acceptance-test gRPC dependencies

• Updates gRPC from v1.82.0 to v1.83.2 and refreshes CEL and golang.org/x transitive dependencies in the acceptance module.

acceptance/go.mod

go.sumRefresh acceptance dependency checksums +18/-18

Refresh acceptance dependency checksums

• Replaces checksums for gRPC and its updated transitive dependency versions in the acceptance module.

acceptance/go.sum

acceptance.DockerfileRefresh the acceptance image base digest +1/-1

Refresh the acceptance image base digest

• Pins the Kind acceptance-test image to the newer UBI 9 minimal digest used by the release images.

acceptance/kubernetes/kind/acceptance.Dockerfile

go.modUpgrade root-module gRPC and transitive dependencies +12/-12

Upgrade root-module gRPC and transitive dependencies

• Updates gRPC to v1.83.2 and resolves compatible CEL, OpenTelemetry, SPIFFE, and golang.org/x dependency versions.

go.mod

go.sumRefresh root-module dependency checksums +24/-24

Refresh root-module dependency checksums

• Updates integrity hashes for gRPC and all transitive packages changed by the root module upgrade.

go.sum

rpms.lock.yamlUpgrade locked gzip packages for all architectures +20/-20

Upgrade locked gzip packages for all architectures

• Updates gzip from 1.12-1.el9 to 1.12-2.el9_8 for aarch64, ppc64le, s390x, and x86_64, including URLs, sizes, source RPMs, and checksums.

rpms.lock.yaml

go.modUpgrade tooling-module gRPC dependencies +12/-12

Upgrade tooling-module gRPC dependencies

• Updates gRPC to v1.83.2 and refreshes the associated CEL, OpenTelemetry, SPIFFE, and golang.org/x dependency graph for development tools.

tools/go.mod

go.sumRefresh tooling dependency checksums +24/-24

Refresh tooling dependency checksums

• Replaces checksum entries for the updated gRPC release and resolved transitive tooling dependencies.

tools/go.sum

go.modRefresh kubectl helper dependencies +4/-5

Refresh kubectl helper dependencies

• Updates golang.org/x networking, system, terminal, text, and tooling dependencies and removes the no-longer-required direct tools entry.

tools/kubectl/go.mod

go.sumRefresh kubectl helper checksums +12/-12

Refresh kubectl helper checksums

• Updates checksums for the golang.org/x modules resolved by the kubectl helper dependency refresh.

tools/kubectl/go.sum

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:45 PM UTC · Completed 3:56 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.82

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

Risk Assessment: elevated (3/5)

Details

Dependency upgrade touching 8 lock/mod files across multiple modules with Dockerfile changes and edits to 2 protected paths elevate the risk despite being a routine cherry-pick of a grpc module bump and base image update.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — This PR modifies protected infrastructure files (Dockerfile, Dockerfile.dist) without a linked issue providing explicit authorization. The changes are mechanical UBI base image digest updates (sha256:8eb2830d... → sha256:7fbeae18...) cherry-picked from merged PR chore(deps): Update google.golang.org/grpc and ubi base image (main) #3519, and no correctness or security concerns were identified. However, human approval is always required for protected-path modifications regardless of change nature. The PR lacks a linked issue justifying changes to these governance or infrastructure files.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] protected-path

This PR modifies protected infrastructure files (Dockerfile, Dockerfile.dist) without a linked issue providing explicit authorization. The changes are mechanical UBI base image digest updates cherry-picked from merged PR #3519, but human approval is always required for protected-path modifications. The PR lacks a linked issue justifying changes to governance or infrastructure files.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: d7c573b9-9e4f-4f9c-aa98-cba0d5cee895

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}