chore(deps): Update ubi-minimal base image (release-v0.7)

[st3penta]

Update ubi-minimal base image to latest digest.

Old digest: sha256:8ebe2ad8fdf3cab3e5a53c1edc69194c98209cfadab24b884f4ad9ebcf7bbbfc
New digest: sha256:beeada7dd17903dfb69fd5f6916c054720bf28a52daaa2f7a1910a1394244bd2

RPM changes

- libxml2-2.9.13-14.el9_8.4
+ libxml2-2.9.13-14.el9_8.5

Co-Authored-By: gpt-6-luna noreply@openai.com

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 2cdd9021-859c-4c30-ba81-413411497185

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:55 AM UTC · Completed 11:00 AM UTC

Commit: 01db61b · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.42

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Trivial 4-line digest bump with an embedded security fix; low inherent change risk, but protected-path governance and release-branch targeting require explicit human sign-off before merge.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] Dockerfile, Dockerfile.dist — The PR modifies files under governance-listed protected paths (Dockerfile, Dockerfile.dist). The PR description provides rationale (Red Hat errata reference for libxml2 patch update, old/new digests documented). Human approval is always required for protected-path changes, regardless of context.

Info

• [scope-authorization-implicit] N/A — Authorization inferred from the mechanical nature of the change (Docker digest bump / value-only). No architectural review performed.

Risk assessment

Moderate (2/5) — trivial 4-line digest bump with an embedded security fix; low inherent change risk, but protected-path governance and release-branch targeting warrant explicit human sign-off before merge.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	69.55% <ø> (ø)
integration	69.55% <ø> (ø)
unit	69.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 1:25 PM UTC · Completed 1:29 PM UTC

Commit: 01db61b · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.65

[fullsend-ai-retro]

Retro on PR fullsend-ai/fullsend#3588 (UBI base image digest bump, release-v0.7)

Pipeline outcome: Healthy. Review agent ran successfully (workflow 36412334175, $2.42, opus, high effort, ~5 min), produced one Medium [protected-path] finding and a Moderate (2/5) risk assessment, two human contributors approved without comments, and the PR merged. No fix cycle. Two humans reviewed a 4-line diff in ≤25 min after the review agent posted — a fast, clean pass.

Systemic pattern (evidence for existing issues, no new proposal filed): Renovate opens roughly 4 near-identical UBI digest-bump PRs per week across conforma/cli's release branches (one per active branch — sample: PRs 3568–3571, 3578–3581, 3587–3590). Each triggers a full opus/high review that fans out 5 sub-agents and consistently emits the same boilerplate protected-path finding. Sample of the last 7 such PRs shows costs of $1.92–$2.75 (mean ~$2.30, ~$40/month). This corroborates several already-open issues — no new proposal is filed for these:

• Effort/model right-sizing for mechanical bumps: fullsend-ai/agents#513, #1431, #497, #257; fullsend-ai/fullsend#2842, #7583. This PR is a textbook case: 4-line Renovate digest swap on a known protected path, opus/high, $2.42, no correctness/security/style/coherence signal produced.
• Protected-path exemption for mechanical changes: fullsend-ai/agents#1616, #5370, #3164; fullsend-ai/agents#741. Same mechanical digest-only change hits the same finding every cycle.
• Retro skip on trivial/no-agent-involvement PRs: fullsend-ai/agents#649, #349; fullsend-ai/fullsend#939. This retro run on a clean merged Renovate PR is itself an example.

Repo-local lever available today: conforma/cli's .fullsend/customized/harness/review.yaml already overrides REVIEW_FINDING_SEVERITY_THRESHOLD but does not override effort or model — the opus/high defaults are inherited. Once any of the upstream issues above ship a route-based override (Renovate author, digest-only diff, or protected-path-only findings), the repo can opt in immediately.

One new proposal filed: severity of the protected-path finding is non-deterministic across nearly identical Renovate digest-bump PRs (oscillates Medium↔High). Because the rule ("changed file matches governance path list → human approval required") is deterministic, the severity should be too. Filed against the agents repo.

Proposals skipped (target repo not allowed)

File manually or update create_issues.allow_targets in config.yaml:

• review agent: make protected-path finding severity deterministic (rule-based, not LLM-adjudicated) (fullsend-ai/agents)