Align hardened executor base to CNG-canonical ubi9/ubi-minimal:9.8

Andrew Dunnrequested to merge
andunn/default-docker-image:cng-base-align-ubi9-9.8 into main

What

Move the Dockerfile.hardened base to the CNG-canonical ubi9/ubi-minimal repository path, pinned to the immutable build-specific tag 9.8-1781496742. It was ubi9-minimal:9.7-1776833838 (the legacy short-path repository).

Why

The rest of the GitLab distribution bases on the canonical ubi9/ubi-minimal path: CNG's ci_files/variables.yml uses registry.access.redhat.com/ubi9/ubi-minimal (and ubi9/ubi-micro). This moves the hardened executor onto that path while keeping the immutable build-specific pin the image already practiced, so builds stay reproducible and Renovate tracks the build id within the 9.8 minor.

CVE impact

None, by design. A controlled rebuild on both the old and new bases (Trivy 0.69.3, this project's Container-Scanning template) returns an identical 3 HIGH / 0 Critical, the same git-lfs findings, because the existing microdnf update -y already pulls current packages. Evidence in #12 (closed).

Test

Fork pipeline builds amd64 and arm64 and passes container scanning at the HIGH threshold.

Edited by Andrew Dunn

Merge request reports