HYPERFLEET-1331 - chore: replace bingo with Go 1.24 tool directives#239
HYPERFLEET-1331 - chore: replace bingo with Go 1.24 tool directives#239kuudori wants to merge 3 commits into
Conversation
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe repository replaces Bingo-managed development tools with a pinned Sequence Diagram(s)sequenceDiagram
participant Developer
participant Makefile
participant GoTool
participant ToolsModule
Developer->>Makefile: run tool or verification target
Makefile->>GoTool: invoke gotool
GoTool->>ToolsModule: load pinned tool definitions
ToolsModule-->>GoTool: resolve development tool
GoTool-->>Makefile: execute tool or report module drift
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
c3b37e9 to
5667250
Compare
Risk Score: 2 —
|
| Signal | Detail | Points |
|---|---|---|
| PR size | 1648 lines (>500) | +2 |
| Sensitive paths | none | +0 |
Computed by hyperfleet-risk-scorer
5667250 to
36bf83c
Compare
36bf83c to
559c885
Compare
559c885 to
1c13c93
Compare
1c13c93 to
c36c63f
Compare
kuudori
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 194: Upgrade the indirect helm.sh/helm/v3 dependency from v3.15.2 to
v3.18.4 or a newer patched release in the module dependency declarations,
including any version constraint introduced by the helm-docs tool directive.
Verify the resolved dependency graph contains no older Helm version or
downgrade.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 0c341fe7-86b8-440f-b8a1-a89f0beb50f5
⛔ Files ignored due to path filters (5)
.bingo/goimports.sumis excluded by!**/*.sum.bingo/golangci-lint.sumis excluded by!**/*.sum.bingo/helm-docs.sumis excluded by!**/*.sum.bingo/kubeconform.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sum,!**/go.sum
📒 Files selected for processing (11)
.bingo/.gitignore.bingo/README.md.bingo/Variables.mk.bingo/go.mod.bingo/goimports.mod.bingo/golangci-lint.mod.bingo/helm-docs.mod.bingo/kubeconform.mod.bingo/variables.envMakefilego.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual) → reviewed against open PR#26chore/replace-bingo-with-go-tool-directivesinstead of the default branch
💤 Files with no reviewable changes (9)
- .bingo/go.mod
- .bingo/goimports.mod
- .bingo/helm-docs.mod
- .bingo/variables.env
- .bingo/.gitignore
- .bingo/golangci-lint.mod
- .bingo/README.md
- .bingo/kubeconform.mod
- .bingo/Variables.mk
906d064 to
183ee2f
Compare
183ee2f to
856f798
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 43-47: Update the go.mod dependency entries for
cloud.google.com/go/auth and github.com/go-openapi/jsonreference to restore
their previous patched versions rather than downgrading them, unless a
documented compatibility or security justification requires the older versions.
Then validate the module graph and available updates with go mod graph and go
list -m -u all, and run govulncheck ./....
In `@Makefile`:
- Around line 381-383: Update the Makefile tools target to execute from the
tools directory with workspace mode disabled, so $(GO) install tool uses the
pinned directives in tools/go.mod; preserve the target’s existing installation
behavior.
In `@tools/go.mod`:
- Line 219: Update the tool dependency declarations in tools/go.mod, including
golang.org/x/crypto and helm.sh/helm/v3, to patched versions that resolve the
cited vulnerabilities; regenerate the corresponding tools/go.sum entries and
rerun the vulnerability scan to verify no findings remain.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 4a84c721-bd98-4bb6-a3e6-be9928b4f07f
⛔ Files ignored due to path filters (5)
.bingo/goimports.sumis excluded by!**/*.sum.bingo/helm-docs.sumis excluded by!**/*.sum.bingo/kubeconform.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sum,!**/go.sumtools/go.sumis excluded by!**/*.sum,!**/go.sum
📒 Files selected for processing (12)
.bingo/.gitignore.bingo/README.md.bingo/Variables.mk.bingo/go.mod.bingo/goimports.mod.bingo/golangci-lint.mod.bingo/helm-docs.mod.bingo/kubeconform.mod.bingo/variables.envMakefilego.modtools/go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual) → reviewed against open PR#26chore/replace-bingo-with-go-tool-directivesinstead of the default branch
💤 Files with no reviewable changes (9)
- .bingo/golangci-lint.mod
- .bingo/Variables.mk
- .bingo/go.mod
- .bingo/helm-docs.mod
- .bingo/goimports.mod
- .bingo/kubeconform.mod
- .bingo/README.md
- .bingo/.gitignore
- .bingo/variables.env
3d5074d to
85a99ed
Compare
|
/retest |
85a99ed to
2d1b65a
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
tools/go.mod (1)
219-219: 🔒 Security & Privacy | 🟠 MajorRemove vulnerable tool dependencies before merge.
golang.org/x/crypto v0.43.0remains affected by CVE-2025-58181 / GO-2025-4134 (CWE-770); the issue is fixed before v0.45.0.helm.sh/helm/v3 v3.15.2remains affected by CVE-2025-53547 / GO-2025-3802 and CVE-2025-55198 / GO-2025-3888, including chart-driven code injection and panic conditions. (pkg.go.dev)Upgrade both modules to patched versions, regenerate
tools/go.sum, and rerun the vulnerability scan before merging. This repeats the previous review finding; the vulnerable pins are still present.As per path instructions: verify new dependency security and prioritize critical and major findings.
#!/bin/bash set -euo pipefail cd tools go list -m -json golang.org/x/crypto helm.sh/helm/v3 govulncheck ./... git diff --exit-code -- go.mod go.sumAlso applies to: 230-230
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/go.mod` at line 219, Upgrade the golang.org/x/crypto dependency to at least v0.45.0 and helm.sh/helm/v3 to patched versions in tools/go.mod, regenerate tools/go.sum, then run the provided module inspection and govulncheck commands. Confirm the vulnerability scan passes and commit the resulting go.mod/go.sum changes.Sources: Path instructions, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@tools/go.mod`:
- Line 219: Upgrade the golang.org/x/crypto dependency to at least v0.45.0 and
helm.sh/helm/v3 to patched versions in tools/go.mod, regenerate tools/go.sum,
then run the provided module inspection and govulncheck commands. Confirm the
vulnerability scan passes and commit the resulting go.mod/go.sum changes.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: da4e849c-c9eb-414c-976e-6e395307ee11
⛔ Files ignored due to path filters (5)
.bingo/goimports.sumis excluded by!**/*.sum.bingo/helm-docs.sumis excluded by!**/*.sum.bingo/kubeconform.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sum,!**/go.sumtools/go.sumis excluded by!**/*.sum,!**/go.sum
📒 Files selected for processing (14)
.bingo/.gitignore.bingo/README.md.bingo/Variables.mk.bingo/go.mod.bingo/goimports.mod.bingo/golangci-lint.mod.bingo/helm-docs.mod.bingo/kubeconform.mod.bingo/variables.envAGENTS.mdMakefiledocs/development.mdgo.modtools/go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual) → reviewed against open PR#26chore/replace-bingo-with-go-tool-directivesinstead of the default branch
💤 Files with no reviewable changes (9)
- .bingo/helm-docs.mod
- .bingo/goimports.mod
- .bingo/go.mod
- .bingo/golangci-lint.mod
- .bingo/Variables.mk
- .bingo/README.md
- .bingo/variables.env
- .bingo/.gitignore
- .bingo/kubeconform.mod
🚧 Files skipped from review as they are similar to previous changes (1)
- go.mod
2d1b65a to
053e57d
Compare
|
@coderabbitai review |
✅ Action performedReview finished.
|
- Quote Make variables in gotool and tool recipes (CWE-78) - Compare tool files against HEAD in verify-tools - Upgrade helm.sh/helm/v3 v3.15.2 -> v3.21.3 in tools/go.mod (11 HIGH CVEs)
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Makefile`:
- Line 111: Update the test-helm target and its prerequisite setup to remove any
curl-pipe-bash Helm installation. Use an available package-manager prerequisite
or install a pinned Helm archive with checksum or signature verification before
running the existing Helm checks.
- Line 133: Update the Makefile’s helm template-to-kubeconform pipelines,
including the target containing the broker.googlepubsub.topic setting and all
repeated instances, so helm template failures propagate instead of being masked
by a successful kubeconform exit. Either split rendering and validation into
separate steps or configure the recipe to use bash with pipefail, while
preserving the existing validation behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2df2a12a-fcd2-43a6-b172-024ed9c3b952
⛔ Files ignored due to path filters (5)
.bingo/goimports.sumis excluded by!**/*.sum.bingo/helm-docs.sumis excluded by!**/*.sum.bingo/kubeconform.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sum,!**/go.sumtools/go.sumis excluded by!**/*.sum,!**/go.sum
📒 Files selected for processing (14)
.bingo/.gitignore.bingo/README.md.bingo/Variables.mk.bingo/go.mod.bingo/goimports.mod.bingo/golangci-lint.mod.bingo/helm-docs.mod.bingo/kubeconform.mod.bingo/variables.envAGENTS.mdMakefiledocs/development.mdgo.modtools/go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual) → reviewed against open PR#26chore/replace-bingo-with-go-tool-directivesinstead of the default branch
💤 Files with no reviewable changes (9)
- .bingo/golangci-lint.mod
- .bingo/goimports.mod
- .bingo/kubeconform.mod
- .bingo/go.mod
- .bingo/helm-docs.mod
- .bingo/Variables.mk
- .bingo/.gitignore
- .bingo/README.md
- .bingo/variables.env
🚧 Files skipped from review as they are similar to previous changes (4)
- AGENTS.md
- docs/development.md
- tools/go.mod
- go.mod
|
|
||
| .PHONY: test-helm | ||
| test-helm: $(KUBECONFORM) verify-helm-docs ## Test Helm charts (lint, template, validate, kubeconform) | ||
| test-helm: verify-helm-docs ## Test Helm charts (lint, template, validate, kubeconform) |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove the curl-pipe-bash Helm installer (CWE-494).
At Line [115], this target instructs users to execute a mutable GitHub script without checksum or signature verification. Replace it with a package-manager prerequisite or a pinned, checksum-verified Helm archive.
🧰 Tools
🪛 checkmake (0.3.2)
[warning] 111-111: Target body for "test-helm" exceeds allowed length of 5 lines (214).
(maxbodylength)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Makefile` at line 111, Update the test-helm target and its prerequisite setup
to remove any curl-pipe-bash Helm installation. Use an available package-manager
prerequisite or install a pinned Helm archive with checksum or signature
verification before running the existing Helm checks.
Source: Path instructions
af0c8f7 to
756ced0
Compare
1 participant
HYPERFLEET-1331
Replace Bingo / standalone
go installwith a singletools/go.modusing Go 1.24+ tool directives.Tools are pinned in
tools/go.modand invoked via$(call gotool,<name>)in the Makefile.Tools:
Also adds
tidy-toolsandverify-toolsMake targets.Follow-up changes (review comment fixes)
$(GO)and$(TOOL_MOD)in Makefilegotooland tool recipes to prevent shell injection (CWE-78)verify-toolsnow compares againstHEAD(git diff HEAD --) instead of the working treehelm.sh/helm/v3v3.21.3