Exclude boilerplate base image from Dependabot Docker updates

What happened

Dependabot created PR #328 to bump redhat-services-prod/openshift/boilerplate from image-v8.4.1 to image-v8.4.3 in build/Dockerfile. The ci/prow/validate check failed on all 5 attempts across 24 days (Aug 17 – Sep 10). The failure occurs because the boilerplate ecosystem requires coordinated updates via make boilerplate-update — the Dockerfile, boilerplate/_data/last-boilerplate-commit, and UBI base image tags must all be updated together. Dependabot's isolated single-file bump will always fail the boilerplate-freeze-check / generate-check sequence. The PR was eventually closed manually by @wangsu502 after the dependency was promoted via a separate coordinated update (PR #348).

What could go better

This PR could never have passed CI due to the structural mismatch between Dependabot's single-file update model and the boilerplate's coordinated update requirement. It consumed CI resources across 5 failed test runs, triggered 3 automated retests, required human intervention to close, and generated a retro dispatch — all for a change that was architecturally impossible to merge as-is.

The repo uses Renovate (configured in .github/renovate.json extending github>openshift/boilerplate//.github/renovate.json) as its primary dependency update tool. Dependabot appears to be enabled separately (likely at the org or repo level via GitHub settings). Existing issue #330 addresses the same class of problem for ubi9/ubi-minimal but does not cover the boilerplate base image.

Confidence: High. The boilerplate-freeze-check step in boilerplate/openshift/golang-osd-operator/standard.mk clones boilerplate at the hash in last-boilerplate-commit and runs the update script, which rewrites Dockerfile FROM lines and refreshes UBI tags via skopeo inspect. Any Dependabot bump that changes the Dockerfile without updating last-boilerplate-commit will produce a dirty working tree that fails the subsequent isclean check.

Proposed change

Add a .github/dependabot.yml configuration file (or modify the repo's Dependabot settings) to ignore the redhat-services-prod/openshift/boilerplate Docker image. Example:

version: 2
updates:
  - package-ecosystem: docker
    directory: /build
    schedule:
      interval: weekly
    ignore:
      - dependency-name: "redhat-services-prod/openshift/boilerplate"

Alternatively, if Dependabot is enabled at the org level and the repo intends to rely solely on Renovate for dependency updates, consider disabling Dependabot's Docker ecosystem scanning for this repo entirely to avoid duplicate/conflicting PRs. The boilerplate image is already updated through the coordinated make boilerplate-update / redhat-chai-bot pipeline.

Validation criteria

After applying the change, no new Dependabot PRs should be created for the redhat-services-prod/openshift/boilerplate Docker image. Verify by monitoring for 30 days — no new PRs matching the pattern dependabot/docker/build/redhat-services-prod/openshift/boilerplate-* should appear. Existing coordinated boilerplate updates via make boilerplate-update or Renovate should continue to function normally.

Generated by retro agent from https://github.com/openshift/ocm-agent-operator/pull/328

Start with build/Dockerfile, .github/renovate.json, and the proposed .github/dependabot.yml configuration. Read the boilerplate-freeze-check references in boilerplate/openshift/golang-osd-operator/standard.mk and compare them with the existing Dependabot and Renovate setup. Done means Dependabot no longer opens updates for the boilerplate image while coordinated boilerplate-update or Renovate updates remain unaffected.