Add ubi9/ubi-minimal to Dependabot ignore list to stop recurring CI-failing PRs

What happened

Since May 2026, Dependabot has created at least 9 consecutive PRs bumping the ubi9/ubi-minimal base image in build/Dockerfile and build/Dockerfile.olm-registry — all failed ci/prow/validate and were auto-closed without merging (PRs #252, #258, #262, #286, #300, #302, #305, #311, #314, #329). The validate failure occurs because the boilerplate framework's update script (at boilerplate/openshift/golang-osd-operator/update, lines 142-151) runs skopeo inspect during make generate and overwrites the UBI image tag with the latest resolved version. This makes the checkout dirty, failing the isclean check in generate-check. On PR #329, a human maintainer (retested the PR) before it was auto-closed — wasted effort on a structurally doomed PR. Across 51 total historical Dependabot ubi-minimal PRs, the boilerplate manages this image tag independently via skopeo inspect, making Dependabot's Docker monitoring redundant for this specific image.

What could go better

The .github/dependabot.yml already ignores two images whose versions are managed externally (app-sre/boilerplate and openshift4/ose-operator-registry), but does not ignore ubi9/ubi-minimal despite the boilerplate managing its tag via the same mechanism. Adding ubi9/ubi-minimal to the ignore list would prevent the weekly cycle of futile PRs, failed CI runs, wasted human attention, and retro agent dispatches. Confidence is high — 9+ consecutive identical failures over 4 months with a clear structural cause (boilerplate overwrites Dependabot's proposed tag). The UBI base image IS being updated through boilerplate syncs (master currently has 9.8-1786987521, upgraded from 9.7-* without any merged Dependabot PR), confirming that the boilerplate path is the effective update mechanism.

Proposed change

Add ubi9/ubi-minimal to the ignore list in .github/dependabot.yml:

ignore:
  - dependency-name: "app-sre/boilerplate"
    # don't upgrade boilerplate via these means
  - dependency-name: "openshift4/ose-operator-registry"
    # don't upgrade ose-operator-registry via these means
  - dependency-name: "ubi9/ubi-minimal"
    # UBI base image tag is managed by boilerplate update script via skopeo inspect

This is a one-line addition to an existing config file. The boilerplate update script will continue to manage the UBI image tag during boilerplate syncs, so the image will still be kept up to date through the boilerplate channel.

Validation criteria

After the change is merged: (1) No new Dependabot PRs should be created for ubi9/ubi-minimal bumps in /build. Monitor for 4 weeks (the current cadence is weekly). (2) The UBI base image should continue to be updated through boilerplate syncs — verify by checking that the tag in build/Dockerfile changes when boilerplate updates are applied. (3) The ci/prow/validate failure rate on Dependabot PRs should drop since the primary source of failures is eliminated.

Generated by retro agent from https://github.com/openshift/ocm-agent-operator/pull/329

Open .github/dependabot.yml and review the existing ignore entries alongside the ubi9/ubi-minimal references in build/Dockerfile and build/Dockerfile.olm-registry. Add the requested ignore entry, then verify the YAML remains valid and confirm that future Dependabot updates no longer target this image while boilerplate syncs remain its update path.