[afdesk]

Description

GoReleaser was failing with context deadline exceeded at the “docker images” stage:
https://github.com/aquasecurity/trivy-operator/actions/runs/19397417900/job/55499343231

The UBI9 Docker build stalled on microdnf install shadow-utils due to an interactive confirmation prompt:

#6 8.363 Downloading metadata...
#6 11.47 Package                                       Repository          Size
#6 11.47 Upgrading:                                                            
#6 11.47  shadow-utils-2:4.9-15.el9.x86_64             ubi-9-baseos-rpms 1.3 MB
#6 11.47    replacing shadow-utils-2:4.9-12.el9.x86_64                         
#6 11.47 Transaction Summary:
#6 11.47  Installing:        0 packages
#6 11.47  Reinstalling:      0 packages
#6 11.47  Upgrading:         1 packages
#6 11.47  Obsoleting:        0 packages
#6 11.47  Removing:          0 packages
#6 11.47  Downgrading:       0 packages
#6 11.47 Is this ok [y/N]:

This PR makes UBI9 Dockerfile Non‑Interactive and microdnf clean all reduces the final image size and prevents stale metadata from being cached.

Testing

$ goreleaser release -f=goreleaser-e2e.yaml --snapshot --skip=publish --clean

Before:

 • docker images
    • building docker image                          image=mirror.gcr.io/aquasec/trivy-operator:baa8f8eac80782428922a86d4c6c8d6762554604-ubi9-amd64
    • building docker image                          image=mirror.gcr.io/aquasec/trivy-operator:baa8f8eac80782428922a86d4c6c8d6762554604-amd64
    ⨯ release failed after 30m0s             error=context deadline exceeded
Error: The process '/opt/hostedtoolcache/goreleaser-action/2.4.8/x64/goreleaser' failed with exit code 1

After:

• release succeeded after 27s
  • thanks for using GoReleaser!

Checklist

• I've read the guidelines for contributing to this repository.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[afdesk]

@simar7
private registry tests uses pull_request_target:

trivy-operator/.github/workflows/private-registries.yaml

Line 14 in baa8f8e

pull_request_target:

Shouldn't we remove it here to prevent potential security issues (ref)?
WDYT?