Skip to content

Update docker.io/library/golang Docker tag to v1.26.8 (main) #3366

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update docker.io/library/golang Docker tag to v1.26.8 (main) #3366

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

## Build

FROM docker.io/library/golang:1.26.7@sha256:e30143be198ab04cf7ba25fba83ab3a692ca584c994aad0bf131fa0eb32dd8c1 AS build
FROM docker.io/library/golang:1.26.8@sha256:eb36c1664dd974cde625f736e02c204383deebe03977365caaec5bf49f794348 AS build

Check failure on line 19 in Dockerfile

View workflow job for this annotation

GitHub Actions / Test 

Containerfile version incompatible, saw 1.26.8, running with version: 1.26.7

@fullsend-ai-review fullsend-ai-review Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] protected-path

PR modifies Dockerfile, which is listed in the active protected-paths set. No linked issue justifies the modification of this governance / build-critical path. The change itself is a routine Renovate patch bump of the golang build-stage image from 1.26.7 to 1.26.8 (tag and sha256 digest updated in lockstep), but protected-path policy requires an explicit human sign-off regardless of the change pattern.

Suggested fix: A human reviewer with build-infra ownership should confirm the patch bump is acceptable before merge. The repository renovate.json and the renovate[bot] author identity establish that automated dependency bumps are an authorized change pattern for this file, which supports (but does not substitute for) the required human review.

@fullsend-ai-review fullsend-ai-review Bot Oct 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] protected-path

The PR modifies Dockerfile, which is listed in the repository protected paths list (governance/infrastructure files that require human approval). The PR has no linked issue authorizing the change; per the protected-path rule, no linked issue is treated as insufficient context on its own.

Suggested fix: A human reviewer must approve this protected-path change. Context: this is a routine Renovate bot update, and the repository renovate.json configures Renovate to manage dependency updates; both facts support manual approval but do not substitute for human sign-off on a protected path.


ARG TARGETOS
ARG TARGETARCH
Expand Down
Loading