Bump conforma/go-containerregistry

[ec-automation]

Automated changes by create-pull-request GitHub action

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:09 AM UTC · Completed 11:13 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review — Approve ✅

Scope: Automated dependency bump of conforma/go-containerregistry fork
Risk: Very low — go.mod/go.sum only, no code changes

Summary

This PR bumps the replace directive for github.com/google/go-containerregistry to a newer pseudo-version of the conforma/go-containerregistry fork:

• From: v0.21.8-0.20260626175242-ae5f0ae7a0b0 (June 26)
• To: v0.21.8-0.20260702142841-f9eefe19c7b2 (July 2)

Analysis

Dimension	Finding
Correctness	Pseudo-version format is valid. The go.mod hash in go.sum is unchanged, confirming the fork's module metadata is stable — only content changed. Base version (v0.21.8) is the same.
Security	Standard bump within the same organization's fork. No new dependencies introduced, no new replace directives.
Intent	Consistent with documented workflow — go.mod line 62 explains the fork and links to hack/ec-patches.sh for the patch list. Automated by ec-automation[bot].
Style	Clean, minimal change. Follows existing conventions.
Docs	No documentation impact.
Cross-repo	Replacement still targets google/go-containerregistry — API surface unchanged.

No blocking findings. The change is a routine automated dependency update.

Previous run

Review — PR #3384

Verdict: ✅ Approve

Summary

Automated dependency bump of the forked go-containerregistry library (conforma/go-containerregistry) from v0.21.8-0.20260626175242-ae5f0ae7a0b0 to v0.21.8-0.20260702142841-f9eefe19c7b2. The change is mechanical: only the replace directive version and corresponding go.sum hashes are updated in the root module. The go.mod module hash (h1:) is unchanged, confirming no API surface change between the two pseudo-versions.

Dimension Results

Dimension	Result
Correctness	One low finding (see below)
Security	No findings — no secrets, permissions, injection vectors, or auth changes
Intent & coherence	Mechanical dependency bump; authorization implicit
Style & conventions	No findings — version string follows existing patterns
Documentation currency	No findings — no stale docs
Cross-repo contracts	Skipped — no exported interfaces modified

Findings

[low] Version skew in acceptance/go.mod — The acceptance/ module's replace directive (line 51) still pins go-containerregistry to the old version (v0.21.8-0.20260626175242-ae5f0ae7a0b0). While the in-code comment notes this is "maybe less important in acceptance," keeping the modules in sync ensures acceptance tests validate against the same dependency version that ships in production. Consider updating acceptance/go.mod and acceptance/go.sum in a follow-up.

Previous run (2)

Looks good to me

---

Labels: Dependency version bump of a Go module.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.25% <ø> (-0.01%)	⬇️
generative	16.80% <ø> (ø)
integration	27.97% <ø> (ø)
unit	71.74% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:36 AM UTC · Completed 10:42 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:27 AM UTC · Completed 10:31 AM UTC
Commit: 87c4a29 · View workflow run →