Add rhel-9-golang-1.25 builder

group.yml

@@ -24,7 +24,7 @@ vars:
   #               - rhel-9-golang-{GO_LATEST}
   #               image: openshift/golang-builder:v1.21.3-202401221732.el9.g00c615b
   GO_LATEST: "1.24"
-  GO_EXTRA: "1.24"  # There is no extra version at this time, so just duplicate latest.
+  GO_EXTRA: "1.25"  # ovn-kubernetes or other components require Go 1.25
 
 compliance:
   rpm_shim:

images/ci-openshift-golang-builder-extra.rhel9.yml

@@ -0,0 +1,62 @@
+content:
+  # set_build_variables to false, as setting git commit env vars break certain
+  # workloads. Set env vars in the Dockerfile, and use modifications if they
+  # should be variable
+  set_build_variables: false
+  source:
+    dockerfile: ci_images/rhel-9/ci-openshift-golang-builder/Dockerfile
+    git:
+      branch:
+        target: openshift-{MAJOR}.{MINOR}
+      url: [email protected]:openshift-priv/ocp-build-data.git
+      web: https://github.com/openshift-eng/ocp-build-data
+    ci_alignment:
+      streams_prs:
+        enabled: false
+      mirror: true
+      mirror_manifest_list: true
+      upstream_image: registry.ci.openshift.org/ocp/builder:rhel-9-golang-{GO_EXTRA}-openshift-{MAJOR}.{MINOR}
+      upstream_image_mirror:
+      - registry.ci.openshift.org/ocp-private/builder-priv:rhel-9-golang-{GO_EXTRA}-openshift-{MAJOR}.{MINOR}
+    modifications:
+    - action: replace
+      match: "ENV CI_RPM_SVC=base-MAJOR-MINOR-rhelX.ocp.svc"
+      replacement: "ENV CI_RPM_SVC=base-{MAJOR}-{MINOR}-rhel9.ocp.svc"
+
+from:
+  stream: rhel-9-golang-{GO_EXTRA}
+labels:
+  io.k8s.description: golang {GO_EXTRA} builder image for Red Hat CI
+distgit:
+  branch: rhaos-{MAJOR}.{MINOR}-rhel-9
+  component: ci-openshift-golang-builder-extra-container
+
+# Repos enabled in the builder image will be ultimately be injected as repos
+# in the builder image. This means that engineers who download the image and
+# run it connected to the VPN will be able to access the content. This is
+# desirable since it allows Dockerfile builds requiring RPMs to work as long
+# as the host is connected to the VPN.
+enabled_repos:
+- rhel-9-baseos-rpms
+- rhel-9-appstream-rpms
+- rhel-9-codeready-builder-rpms
+- rhel-9-server-ose-rpms
+- rhel-9-fast-datapath-rpms
+
+name: openshift/ci-openshift-golang-builder-extra-rhel9
+for_payload: false
+for_release: false
+owners:
+- [email protected]
+maintainer:
+  component: Release
+
+# The from: stanza is exactly what we want to use. So ignore anything in
+# the Dockerfile.
+canonical_builders_from_upstream: false
+
+scan_sources:
+  exempt_rpms:
+  - '*'
+konflux:
+  network_mode: open

streams.yml

@@ -35,6 +35,15 @@ rhel-8-golang:
   # upstream_image informs reconciliation PRs which upstream image to use for CI when this stream is referenced.
   upstream_image: registry.ci.openshift.org/ocp/builder:rhel-8-golang-{GO_LATEST}-openshift-{MAJOR}.{MINOR}
 
+rhel-9-golang-1.25:
+  aliases:
+    - rhel-9-golang-{GO_EXTRA}
+  image: quay.io/redhat-user-workloads/ocp-art-tenant/art-images:golang-builder-v1.25.3-202511260833.g5015a16.el9
+  mirror: false
+  # Since mirror: false, an images/ci-openshift-golang-builder* metadata must push to this location.
+  # upstream_image informs reconciliation PRs which upstream image to use for CI when this stream is referenced.
+  upstream_image: registry.ci.openshift.org/ocp/builder:rhel-9-golang-{GO_EXTRA}-openshift-{MAJOR}.{MINOR}
+
 partner-rhel-8-golang-1.24:
   image: quay.io/redhat-user-workloads/ocp-art-tenant/art-images:golang-builder-v1.24.6-202511041143.gc784618.el8
   mirror: true