What happened
On PR #3498, the fullsend review agent (run 32155154900) flagged a MEDIUM stale-reference finding: acceptance/kubernetes/kind/acceptance.Dockerfile still referenced the old UBI digest while Dockerfile and Dockerfile.dist were updated. The agent correctly cross-referenced hack/ubi-base-image-bump.sh line 33 which defines DOCKER_FILES=(Dockerfile Dockerfile.dist acceptance/kubernetes/kind/acceptance.Dockerfile) as a coordinated set. Combined with a HIGH protected-path finding, the agent submitted CHANGES_REQUESTED. The human reviewer (robnester-rh) approved without comment, overriding the bot, and the PR was merged. A companion PR #3500 targeting main updated all three Dockerfiles and merged 17 seconds earlier.
What could go better
The stale-reference finding was technically correct but contextually wrong. The PR intentionally targeted release-v0.7 with a narrower scope — only production Dockerfiles, not acceptance test infrastructure. The review agent had no way to know this because AGENTS.md contains no guidance about the UBI bump workflow, the multi-branch update strategy, or which files are relevant on release branches vs. main. The agent did excellent pattern recognition (finding the DOCKER_FILES list and cross-checking) but lacked the domain context to properly calibrate severity. Confidence: high — the root cause (missing AGENTS.md context) is clear from the file's contents, and the review agent is designed to consume AGENTS.md guidance.
Proposed change
Add a section to AGENTS.md in conforma/cli documenting the UBI base image update workflow. Suggested content:
## UBI Base Image Updates
The project pins UBI9 ubi-minimal base image digests in three Dockerfiles:
- `Dockerfile` (production)
- `Dockerfile.dist` (distribution)
- `acceptance/kubernetes/kind/acceptance.Dockerfile` (acceptance tests)
The script `hack/ubi-base-image-bump.sh` updates all three files and regenerates `rpms.lock.yaml` via `hack/update-rpm-lock.sh`.
### Multi-branch strategy
On `main`, all three Dockerfiles are updated together. On `release-v*` branches, bump PRs may intentionally update only production Dockerfiles (`Dockerfile`, `Dockerfile.dist`) since acceptance test infrastructure is typically not backported to release branches. A narrower scope on release branches is expected, not a bug.
### Review guidance
When reviewing UBI bump PRs on release branches, do not flag missing updates to `acceptance/kubernetes/kind/acceptance.Dockerfile` as stale references. The coordinated update set defined in `hack/ubi-base-image-bump.sh` applies to `main` branch bumps.
Validation criteria
The next UBI base image bump PR targeting a release-v* branch should not receive a stale-reference finding about acceptance.Dockerfile from the review agent. Validate by observing the next 2-3 release branch bump PRs — the review agent should either omit the finding entirely or downgrade it to informational based on the AGENTS.md context.
Generated by retro agent from #3498
What happened
On PR #3498, the fullsend review agent (run 32155154900) flagged a MEDIUM stale-reference finding:
acceptance/kubernetes/kind/acceptance.Dockerfilestill referenced the old UBI digest whileDockerfileandDockerfile.distwere updated. The agent correctly cross-referencedhack/ubi-base-image-bump.shline 33 which definesDOCKER_FILES=(Dockerfile Dockerfile.dist acceptance/kubernetes/kind/acceptance.Dockerfile)as a coordinated set. Combined with a HIGH protected-path finding, the agent submitted CHANGES_REQUESTED. The human reviewer (robnester-rh) approved without comment, overriding the bot, and the PR was merged. A companion PR #3500 targetingmainupdated all three Dockerfiles and merged 17 seconds earlier.What could go better
The stale-reference finding was technically correct but contextually wrong. The PR intentionally targeted
release-v0.7with a narrower scope — only production Dockerfiles, not acceptance test infrastructure. The review agent had no way to know this becauseAGENTS.mdcontains no guidance about the UBI bump workflow, the multi-branch update strategy, or which files are relevant on release branches vs. main. The agent did excellent pattern recognition (finding the DOCKER_FILES list and cross-checking) but lacked the domain context to properly calibrate severity. Confidence: high — the root cause (missing AGENTS.md context) is clear from the file's contents, and the review agent is designed to consume AGENTS.md guidance.Proposed change
Add a section to
AGENTS.mdin conforma/cli documenting the UBI base image update workflow. Suggested content:Validation criteria
The next UBI base image bump PR targeting a release-v* branch should not receive a stale-reference finding about acceptance.Dockerfile from the review agent. Validate by observing the next 2-3 release branch bump PRs — the review agent should either omit the finding entirely or downgrade it to informational based on the AGENTS.md context.
Generated by retro agent from #3498