Update docker.io/library/golang Docker tag to v1.27.1 (release-v0.7)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/golang (source)	stage	minor	1.26.7 → 1.27.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8c7b491c-2b10-4a81-afc0-15de1b661492

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:40 AM UTC · Completed 2:46 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.77

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Single-line Dockerfile base image bump from golang 1.26.7 to 1.27.1 by renovate[bot] with XS blast radius, but the Tier 1 script flagged the Dockerfile as a protected path and CI_WORKFLOW_CHANGED=true (elevating that dimension to 4), and Tier 2 shows moderate multi-author contention (5 distinct contributors in 90 days), yielding a composite of 1.70 that rounds to moderate.

Previous run

Risk Assessment: moderate (2/5)

Details

Single-line Renovate minor bump of the golang base image in a protected, security-sensitive Dockerfile with a clean recent history and no fix/revert churn.

[fullsend-ai-review]

Looks good to me

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies a file under a protected path (Dockerfile). Protected paths are governance and infrastructure files that always require explicit human approval, regardless of the PR's origin. The PR body provides sufficient context for the change (Renovate-managed minor version bump docker.io/library/golang:1.26.7 → 1.27.1 on the release-v0.7 branch), but human approval is still required for protected-path changes.
  Remediation: A human maintainer must review and approve this base-image bump before merge. Confirm that (a) golang:1.27.1 is the intended target on the release-v0.7 release branch (a Go minor version bump on a release branch may introduce runtime/compiler behavior changes beyond a patch update), and (b) the change is consistent with the repo's Renovate configuration for release branches.

Info

• [provenance-warning] — Prior review context was discarded: provenance validation failed with PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app (a prior review comment exists but was created by a different app than expected, so its authorship cannot be trusted). This review treats all findings as first-time assessments — severity anchoring was skipped for this run.
• [dependency-update] Dockerfile:19 — Renovate classifies 1.26.7 → 1.27.1 as a minor Docker tag update, but for the docker.io/library/golang image this crosses a Go minor version boundary (1.26.x → 1.27.x), which per Go's release policy can include new language features, standard-library additions, compiler/runtime behavior changes, and toolchain updates — not just patch-level fixes. On a release branch (release-v0.7), reviewers may prefer to restrict base-image updates to same-minor patch bumps unless an intentional Go minor upgrade is planned.

Previous run (2)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is in the protected paths list (governance/infrastructure). Human approval is always required for protected-path changes, regardless of automation. Context is sufficient: the PR body describes a Renovate-generated minor version bump of the golang build-stage base image (1.26.7 → 1.27.0), and renovate.json at the repo root extends the org-wide Renovate config (github>conforma/.github//config/renovate/renovate.json) that authorizes automated Docker tag updates.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:08 AM UTC · Completed 2:13 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.09