Fixes fix-TC-5834

.tekton/on-cm-runner.yaml

@@ -62,7 +62,7 @@ spec:
               type: string
           steps:
             - name: parse-eval-flag
-              image: registry.redhat.io/ubi9/ubi-micro:latest
+              image: registry.redhat.io/ubi10/ubi-micro:10.2-1787684489
               env:
                 - name: TRIGGER_COMMENT
                   value: $(params.TRIGGER_COMMENT)
@@ -339,7 +339,7 @@ spec:
                 - name: otel-config-volume
                   mountPath: /etc/otelcol-contrib/
             - name: trace-collector
-              image: registry.access.redhat.com/ubi9/python-312:9.6
+              image: registry.access.redhat.com/ubi10/python-312-minimal:10.2-1788165617
               volumeMounts:
                 - name: openshift-service-ca
                   mountPath: /app/certs

.tekton/on-pull-request.yaml

@@ -72,7 +72,7 @@ spec:
               type: string
           steps:
             - name: read-eval-toggle
-              image: registry.redhat.io/ubi9/ubi-micro:latest
+              image: registry.redhat.io/ubi10/ubi-micro:10.2-1787684489
               env:
                 - name: POST_INTEGRATION_EVAL_ENABLED
                   valueFrom:
@@ -171,7 +171,7 @@ spec:
             - name: unit-test-cache
           steps:
             - name: setup-cache-link
-              image: registry.redhat.io/ubi9/ubi-micro:latest
+              image: registry.redhat.io/ubi10/ubi-micro:10.2-1787684489
               workingDir: $(workspaces.source.path)
               script: |
                 #!/bin/bash
@@ -205,7 +205,7 @@ spec:
               volumeMounts:
                 - name: $(workspaces.unit-test-cache.volume)
                   mountPath: /exploit-iq-data
-              image: registry.access.redhat.com/ubi9/ubi-minimal:9.8
+              image: registry.access.redhat.com/ubi10/ubi:1780550950
               workingDir: $(workspaces.source.path)
               script: |
                 #!/bin/bash
@@ -216,9 +216,9 @@ spec:
                     echo "----------- ${1} -----------"
                 }
 
-                # ubi-minimal has no dev tools — install the essentials
+                # Full UBI ships dnf and shadow-utils; install the dev tools needed for the build.
                 print_banner "Installing system packages"
-                microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic
+                dnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic
 
                 # Install Node.js 26.5.0 manually
                 print_banner "Installing Node.js 26.5.0"
@@ -524,7 +524,7 @@ spec:
                 - name: otel-config-volume
                   mountPath: /etc/otelcol-contrib/
             - name: trace-collector
-              image: registry.access.redhat.com/ubi9/python-312:9.6
+              image: registry.access.redhat.com/ubi10/python-312-minimal:10.2-1788165617
               volumeMounts:
                 - name: openshift-service-ca
                   mountPath: /app/certs

.tekton/on-tag.yaml

@@ -89,7 +89,7 @@ spec:
             - name: target-image
           steps:
             - name: format-image
-              image: registry.redhat.io/ubi9/ubi-minimal:9.4
+              image: registry.redhat.io/ubi10/ubi-minimal:10.2-1788137716
               script: |
                 #!/usr/bin/env bash
                 IMAGE="$(params.image_name):$(echo $(params.tag_name) | sed 's|refs/tags/||')"

Dockerfile

@@ -13,13 +13,17 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-ARG BASE_IMAGE_URL=registry.redhat.io/ubi9/ubi
-ARG BASE_IMAGE_TAG=9.8-1782841664
+ARG BASE_IMAGE_URL=registry.redhat.io/ubi10/ubi
+ARG BASE_IMAGE_TAG=1780550950
 ARG PYTHON_VERSION=3.12
 
 # Specified on the command line with --build-arg VULN_ANALYSIS_VERSION=$(python -m setuptools_scm)
 ARG VULN_ANALYSIS_VERSION=2.0.0
 
+# Go toolchain source: Red Hat go-toolset (UBI 10). Its GOROOT (/usr/lib/golang, Go 1.24.6)
+# is copied into the runtime image below, replacing the previous go.dev download.
+FROM registry.redhat.io/ubi10/go-toolset:1.24-1763548447 AS go-builder
+
 FROM ${BASE_IMAGE_URL}:${BASE_IMAGE_TAG} AS base
 COPY --from=ghcr.io/astral-sh/uv:0.7.15 /uv /uvx /bin/
 ARG VULN_ANALYSIS_VERSION
@@ -50,9 +54,9 @@ RUN dnf install -y --nodocs \
     && update-ca-trust
 
 
-RUN curl -L -X GET https://go.dev/dl/go1.24.1.linux-amd64.tar.gz -o /tmp/go1.24.1.linux-amd64.tar.gz \
-    && tar -C /usr/local -xzf /tmp/go1.24.1.linux-amd64.tar.gz \
-    && rm /tmp/go1.24.1.linux-amd64.tar.gz
+# Go toolchain from Red Hat go-toolset (was: go.dev download of go1.24.1). GOROOT is /usr/lib/golang
+# in the builder; copying it to /usr/local/go keeps the existing PATH entry (/usr/local/go/bin) valid.
+COPY --from=go-builder /usr/lib/golang /usr/local/go
 
 ENV GOTOOLCHAIN=auto
 

kustomize/base/nginx.yaml

@@ -22,7 +22,7 @@ spec:
       imagePullSecrets: []
       initContainers:
         - name: render-nginx-config
-          image: registry.redhat.io/ubi9/python-312@sha256:55ddb67dcfc6c7ec072fce58753910b290c2903b10cd71d0d64c631d44ef4ab0
+          image: registry.redhat.io/ubi10/python-312-minimal:10.2-1788165617
           command: ["python3", "-c"]
           args:
             - |
@@ -89,8 +89,11 @@ spec:
               mountPath: /generated
       containers:
         - name: nginx
-          image: registry.access.redhat.com/hi/nginx:1.30.3
+          image: registry.access.redhat.com/ubi10/nginx-126:10.2-1788242896
           imagePullPolicy: IfNotPresent
+          # The UBI 10 nginx s2i image's default command only prints usage; start nginx directly
+          # against the mounted /etc/nginx/nginx.conf (binary at /usr/sbin/nginx).
+          command: ["nginx", "-g", "daemon off;"]
           ports:
             - name: http
               protocol: TCP