What happened
Since May 2026, Dependabot has created at least 9 consecutive PRs bumping the ubi9/ubi-minimal base image in build/Dockerfile and build/Dockerfile.olm-registry — all failed ci/prow/validate and were auto-closed without merging (PRs #252, #258, #262, #286, #300, #302, #305, #311, #314, #329). The validate failure occurs because the boilerplate framework's update script (at boilerplate/openshift/golang-osd-operator/update, lines 142-151) runs skopeo inspect during make generate and overwrites the UBI image tag with the latest resolved version. This makes the checkout dirty, failing the isclean check in generate-check. On PR #329, a human maintainer (retested the PR) before it was auto-closed — wasted effort on a structurally doomed PR. Across 51 total historical Dependabot ubi-minimal PRs, the boilerplate manages this image tag independently via skopeo inspect, making Dependabot's Docker monitoring redundant for this specific image.
What could go better
The .github/dependabot.yml already ignores two images whose versions are managed externally (app-sre/boilerplate and openshift4/ose-operator-registry), but does not ignore ubi9/ubi-minimal despite the boilerplate managing its tag via the same mechanism. Adding ubi9/ubi-minimal to the ignore list would prevent the weekly cycle of futile PRs, failed CI runs, wasted human attention, and retro agent dispatches. Confidence is high — 9+ consecutive identical failures over 4 months with a clear structural cause (boilerplate overwrites Dependabot's proposed tag). The UBI base image IS being updated through boilerplate syncs (master currently has 9.8-1786987521, upgraded from 9.7-* without any merged Dependabot PR), confirming that the boilerplate path is the effective update mechanism.
Proposed change
Add ubi9/ubi-minimal to the ignore list in .github/dependabot.yml:
ignore:
- dependency-name: "app-sre/boilerplate"
# don't upgrade boilerplate via these means
- dependency-name: "openshift4/ose-operator-registry"
# don't upgrade ose-operator-registry via these means
- dependency-name: "ubi9/ubi-minimal"
# UBI base image tag is managed by boilerplate update script via skopeo inspectThis is a one-line addition to an existing config file. The boilerplate update script will continue to manage the UBI image tag during boilerplate syncs, so the image will still be kept up to date through the boilerplate channel.
Validation criteria
After the change is merged: (1) No new Dependabot PRs should be created for ubi9/ubi-minimal bumps in /build. Monitor for 4 weeks (the current cadence is weekly). (2) The UBI base image should continue to be updated through boilerplate syncs — verify by checking that the tag in build/Dockerfile changes when boilerplate updates are applied. (3) The ci/prow/validate failure rate on Dependabot PRs should drop since the primary source of failures is eliminated.
Generated by retro agent from #329
What happened
Since May 2026, Dependabot has created at least 9 consecutive PRs bumping the
ubi9/ubi-minimalbase image inbuild/Dockerfileandbuild/Dockerfile.olm-registry— all failedci/prow/validateand were auto-closed without merging (PRs #252, #258, #262, #286, #300, #302, #305, #311, #314, #329). The validate failure occurs because the boilerplate framework'supdatescript (atboilerplate/openshift/golang-osd-operator/update, lines 142-151) runsskopeo inspectduringmake generateand overwrites the UBI image tag with the latest resolved version. This makes the checkout dirty, failing theiscleancheck ingenerate-check. On PR #329, a human maintainer (retested the PR) before it was auto-closed — wasted effort on a structurally doomed PR. Across 51 total historical Dependabot ubi-minimal PRs, the boilerplate manages this image tag independently viaskopeo inspect, making Dependabot's Docker monitoring redundant for this specific image.What could go better
The
.github/dependabot.ymlalready ignores two images whose versions are managed externally (app-sre/boilerplateandopenshift4/ose-operator-registry), but does not ignoreubi9/ubi-minimaldespite the boilerplate managing its tag via the same mechanism. Addingubi9/ubi-minimalto the ignore list would prevent the weekly cycle of futile PRs, failed CI runs, wasted human attention, and retro agent dispatches. Confidence is high — 9+ consecutive identical failures over 4 months with a clear structural cause (boilerplate overwrites Dependabot's proposed tag). The UBI base image IS being updated through boilerplate syncs (master currently has9.8-1786987521, upgraded from9.7-*without any merged Dependabot PR), confirming that the boilerplate path is the effective update mechanism.Proposed change
Add
ubi9/ubi-minimalto the ignore list in.github/dependabot.yml:This is a one-line addition to an existing config file. The boilerplate
updatescript will continue to manage the UBI image tag during boilerplate syncs, so the image will still be kept up to date through the boilerplate channel.Validation criteria
After the change is merged: (1) No new Dependabot PRs should be created for
ubi9/ubi-minimalbumps in/build. Monitor for 4 weeks (the current cadence is weekly). (2) The UBI base image should continue to be updated through boilerplate syncs — verify by checking that the tag inbuild/Dockerfilechanges when boilerplate updates are applied. (3) Theci/prow/validatefailure rate on Dependabot PRs should drop since the primary source of failures is eliminated.Generated by retro agent from #329