Update docker.io/library/golang Docker tag to v1.27.1 (release-v0.7)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/golang (source)	stage	minor	1.26.7 → 1.27.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 57958ff7-ef82-47c5-9e41-3e79f76516de

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:40 AM UTC · Completed 2:46 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.77

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Automated minor Go version bump (1.26→1.27) targeting a release branch; the change is XS and follows a well-established renovate pattern with no linked issue, placing composite risk at moderate.

Previous run

Risk Assessment: moderate (2/5)

Details

Functionally identical to prior review (1 file, 2 lines, bot Renovate tag bump on Dockerfile, release branch); Tier 1 signals unchanged so anchoring preserves score 2, with multi-author contention on Dockerfile (7 unique authors in 90d, up from 5) confirming moderate rather than low.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Single-line Renovate base-image bump (1 file, 2 lines, bot author, no source/test/dep changes) on a release branch. Tier 1 would score near 1, but Dockerfile is protected/CI-related and Tier 2 multi-author contention (5 authors in 90d) with sibling Dockerfile.dist not co-updated nudges the composite to 2.

Previous run (3)

Risk Assessment: moderate (2/5)

Details

Single-line Dockerfile base image bump from golang 1.26.7 to 1.27.1 by renovate[bot] with XS blast radius, but the Tier 1 script flagged the Dockerfile as a protected path and CI_WORKFLOW_CHANGED=true (elevating that dimension to 4), and Tier 2 shows moderate multi-author contention (5 distinct contributors in 90 days), yielding a composite of 1.70 that rounds to moderate.

Previous run (4)

Risk Assessment: moderate (2/5)

Details

Single-line Renovate minor bump of the golang base image in a protected, security-sensitive Dockerfile with a clean recent history and no fix/revert churn.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is on the repository's protected-paths list (governance/infrastructure files that require human approval). Context is sufficient: the PR body describes an automated Renovate-managed minor version bump of the docker.io/library/golang build-stage base image (1.26.7 → 1.27.1) on the release-v0.7 branch, and renovate.json at the repository root extends the org-wide Renovate config (github>conforma/.github//config/renovate/renovate.json), which authorizes automated Docker tag updates. Human approval is still required for protected-path changes regardless of authorization evidence.
  Remediation: A repository maintainer must review and approve the Dockerfile change directly. Confirm that (a) crossing a Go minor version boundary on a release branch (1.26.x → 1.27.x) is intentional — Go minor releases can include compiler/runtime/toolchain changes beyond patch-level fixes — and (b) the change is consistent with the repo's Renovate configuration policy for release branches.

Previous run

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is on the repository's protected-paths list (governance/infrastructure files that require human approval). The change is an automated Renovate base-image bump (docker.io/library/golang 1.26.7 → 1.27.0) on release-v0.7, with no linked issue authorising the change to the protected file. Human approval is required for protected-path changes regardless of automation.
  Remediation: A repository maintainer must review and approve the Dockerfile change directly. If ongoing Renovate-managed Go base-image bumps for release-v0.7 are pre-authorised by policy, link the governing config (renovate.json) or an authorising issue/ADR in the PR description so future re-reviews can reconcile the finding down to informational.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is on the repository's protected-paths list (governance/infrastructure files that require human approval). The PR is an automated Renovate base-image bump (docker.io/library/golang 1.26.7 → 1.27.0) on release-v0.7, with no linked issue authorising the change to the protected file. Human approval is required for protected-path changes regardless of automation.
  Remediation: A repository maintainer must review and approve the Dockerfile change directly. If ongoing Renovate-managed Go base-image bumps for release-v0.7 are pre-authorised by policy, link the governing config (renovate.json) or an authorising issue/ADR in the PR description so future re-reviews can reconcile the finding down to informational.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Looks good to me

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (4)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies a file under a protected path (Dockerfile). Protected paths are governance and infrastructure files that always require explicit human approval, regardless of the PR's origin. The PR body provides sufficient context for the change (Renovate-managed minor version bump docker.io/library/golang:1.26.7 → 1.27.1 on the release-v0.7 branch), but human approval is still required for protected-path changes.
  Remediation: A human maintainer must review and approve this base-image bump before merge. Confirm that (a) golang:1.27.1 is the intended target on the release-v0.7 release branch (a Go minor version bump on a release branch may introduce runtime/compiler behavior changes beyond a patch update), and (b) the change is consistent with the repo's Renovate configuration for release branches.

Info

• [provenance-warning] — Prior review context was discarded: provenance validation failed with PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app (a prior review comment exists but was created by a different app than expected, so its authorship cannot be trusted). This review treats all findings as first-time assessments — severity anchoring was skipped for this run.
• [dependency-update] Dockerfile:19 — Renovate classifies 1.26.7 → 1.27.1 as a minor Docker tag update, but for the docker.io/library/golang image this crosses a Go minor version boundary (1.26.x → 1.27.x), which per Go's release policy can include new language features, standard-library additions, compiler/runtime behavior changes, and toolchain updates — not just patch-level fixes. On a release branch (release-v0.7), reviewers may prefer to restrict base-image updates to same-minor patch bumps unless an intentional Go minor upgrade is planned.

Previous run (5)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is in the protected paths list (governance/infrastructure). Human approval is always required for protected-path changes, regardless of automation. Context is sufficient: the PR body describes a Renovate-generated minor version bump of the golang build-stage base image (1.26.7 → 1.27.0), and renovate.json at the repo root extends the org-wide Renovate config (github>conforma/.github//config/renovate/renovate.json) that authorizes automated Docker tag updates.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:08 AM UTC · Completed 2:13 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.09

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:53 AM UTC · Completed 12:00 PM UTC

Commit: 06b014f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.09

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:55 AM UTC · Completed 2:01 AM UTC

Commit: fd1f7bc · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.68

Superseded by updated review

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] protected-path

This PR modifies Dockerfile, which is on the repository protected-paths list (governance/infrastructure files that require human approval). Context is sufficient: the PR body describes an automated Renovate-managed minor version bump of the docker.io/library/golang build-stage base image (1.26.7 -> 1.27.1) on the release-v0.7 branch, and renovate.json at the repository root extends the org-wide Renovate config (github>conforma/.github//config/renovate/renovate.json), which authorizes automated Docker tag updates. Human approval is still required for protected-path changes regardless of authorization evidence.

Suggested fix: A repository maintainer must review and approve the Dockerfile change directly. Confirm that (a) crossing a Go minor version boundary on a release branch (1.26.x -> 1.27.x) is intentional — Go minor releases can include compiler/runtime/toolchain changes beyond patch-level fixes — and (b) the change is consistent with the repo Renovate configuration policy for release branches.