chore(deps): update k8s.io/kube-openapi digest to 8f3fa49

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
k8s.io/kube-openapi	indirect	digest	8b0f38b → 8f3fa49

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 14 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.21 -> 1.23.0
golang.org/x/tools	v0.21.0 -> v0.36.0
k8s.io/klog/v2	v2.120.1 -> v2.130.1
github.com/emicklei/go-restful/v3	v3.9.0 -> v3.11.0
github.com/go-openapi/jsonpointer	v0.19.6 -> v0.21.0
github.com/go-openapi/swag	v0.22.3 -> v0.23.0
golang.org/x/crypto	v0.23.0 -> v0.41.0
golang.org/x/mod	v0.17.0 -> v0.27.0
golang.org/x/net	v0.25.0 -> v0.43.0
golang.org/x/sync	v0.7.0 -> v0.16.0
golang.org/x/sys	v0.29.0 -> v0.35.0
golang.org/x/term	v0.20.0 -> v0.34.0
golang.org/x/text	v0.15.0 -> v0.28.0
google.golang.org/protobuf	v1.33.0 -> v1.35.1
k8s.io/utils	v0.0.0-20230726121419-3b25d923346b -> v0.0.0-20240711033017-18e509b52bc8

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 36.96%. Comparing base (794dda6) to head (a6a1845).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #168   +/-   ##
=======================================
  Coverage   36.96%   36.96%           
=======================================
  Files          23       23           
  Lines        1220     1220           
=======================================
  Hits          451      451           
  Misses        744      744           
  Partials       25       25           

Flag	Coverage Δ
e2e-tests	15.16% <ø> (ø)
unit-tests	31.96% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 794dda6...a6a1845. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[red-hat-konflux]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 18 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.23.0 -> 1.24.0
golang.org/x/tools	v0.30.0 -> v0.42.0
k8s.io/klog/v2	v2.120.1 -> v2.140.0
sigs.k8s.io/yaml	v1.4.0 -> v1.6.0
github.com/emicklei/go-restful/v3	v3.9.0 -> v3.13.0
github.com/go-openapi/jsonpointer	v0.19.6 -> v0.21.0
github.com/go-openapi/jsonreference	v0.20.1 -> v0.20.2
github.com/go-openapi/swag	v0.22.3 -> v0.25.4
github.com/google/go-cmp	v0.6.0 -> v0.7.0
golang.org/x/crypto	v0.33.0 -> v0.48.0
golang.org/x/mod	v0.23.0 -> v0.33.0
golang.org/x/net	v0.35.0 -> v0.50.0
golang.org/x/sync	v0.11.0 -> v0.19.0
golang.org/x/sys	v0.30.0 -> v0.41.0
golang.org/x/term	v0.29.0 -> v0.40.0
golang.org/x/text	v0.22.0 -> v0.34.0
google.golang.org/protobuf	v1.33.0 -> v1.35.1
k8s.io/utils	v0.0.0-20230726121419-3b25d923346b -> v0.0.0-20260210185600-b8788abfbbc2
sigs.k8s.io/json	v0.0.0-20221116044647-bc3834ca7abd -> v0.0.0-20250730193827-2d320260d730

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:31 AM UTC · Completed 5:41 AM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [api-contract] go.mod:3 — The PR bumps go.mod from go 1.23.0 to go 1.24.0, but CI (.github/workflows/test.yml) is hardcoded to Go 1.23.x (line 15 matrix and line 53 e2e job). Since Go 1.21+, if go.mod declares a Go version higher than the installed toolchain and GOTOOLCHAIN is set to local (as actions/setup-go does by default), the build will fail with a version mismatch error.
  Remediation: Update .github/workflows/test.yml to use go-version: 1.24.x (line 15 matrix and line 53 e2e job) to match the new go.mod directive, or add a toolchain go1.24.0 directive to go.mod to enable automatic toolchain switching.

Medium

• [api-contract] Dockerfile:1 — The Dockerfile uses ubi9/go-toolset:9.8-1780373831, which ships a fixed Go version (likely 1.22 or 1.23 based on UBI9 go-toolset releases). With go.mod bumped to go 1.24.0, the container build may fail if the bundled Go toolchain is older than 1.24 and automatic toolchain downloading is not available in the container build environment.
  Remediation: Verify that the pinned go-toolset image tag provides Go >= 1.24, or update the image tag to one that ships Go 1.24+. Alternatively, add a toolchain go1.24.0 directive to go.mod and ensure GOTOOLCHAIN=auto is set in the Dockerfile build.

Previous run

Review

Findings

Medium

• [Go version compatibility] go.mod:3 — The go directive is bumped from 1.22.0 to 1.24.0, but CI workflows (.github/workflows/test.yml and .github/workflows/lint.yml) are hardcoded to use Go 1.22.x. Since Go enforces the go directive as a minimum version requirement, Go 1.22 will refuse to build a module that declares go 1.24.0. This will cause CI failures in both test and lint workflows unless they are updated.
  Remediation: Update .github/workflows/test.yml go-version matrix from [1.22.x] to [1.24.x] and .github/workflows/lint.yml go-version from 1.22 to 1.24.

Low

• [API contract / version skew] go.mod — The PR bumps k8s.io/kube-openapi to a June 2026 digest while keeping k8s.io/api at v0.27.4 and k8s.io/client-go at v0.25.9. However, kube-openapi is a purely indirect dependency with zero direct imports in any Go source file in this repository. The version skew risk is limited to transitive compilation compatibility, not runtime API contract issues. Verify that CI builds pass.

• [API contract / behavioral change] go.mod:33 — sigs.k8s.io/yaml is bumped from v1.4.0 to v1.6.0, which switches the underlying YAML parser from v2 to v3. The codebase uses yaml.Unmarshal in two places (cmd/prowjob/createReport.go and pkg/prow/prow.go). Both consume well-structured, machine-generated data from Prow, so the risk is low, but the v3 parser is stricter about duplicate keys and certain edge cases.

Previous run (2)

Review

Findings

Critical

• [build compatibility] go.mod:3 — The go directive is bumped from 1.22.0 to 1.24.0, but all CI workflows and the Dockerfile are pinned to Go 1.22. Since Go 1.21+, the go directive acts as a minimum version requirement — Go 1.22 toolchains will refuse to build a module declaring go 1.24.0 with an error like note: module requires Go >= 1.24.0. This will break every CI job (test.yml, lint.yml, pre-commit.yml, release.yml, slack-message.yml) and the container build (Dockerfile uses ubi9/go-toolset:9.8 which ships Go 1.22.x).
  Remediation: Either (a) update all CI workflow Go versions and the Dockerfile base image to Go >= 1.24.0 in this PR, or (b) keep the go directive at 1.22.0 and add a toolchain go1.24.0 line if the intent is to allow newer toolchains without raising the minimum.

Low

• [stale reference] go.mod:82 — The PR replaces github.com/google/gnostic with github.com/google/gnostic-models. Verified: no Go source files in this repository import gnostic directly — it is purely a transitive dependency. No action required.

• [transitive-dependency-scope] go.mod — The PR updates many transitive dependencies beyond k8s.io/kube-openapi, but these are mechanical consequences of the kube-openapi digest update processed by Go's module system. The Go version bump to 1.24.0 is the only genuinely unexpected change (covered above).

---

Labels: PR updates Go module dependencies (go.mod/go.sum)

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 6:10 PM UTC · Completed 6:15 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-retro]

Retro: PR #168 — MintMaker dependency update (k8s.io/kube-openapi)

Workflow quality: Review was accurate but effort was wasted on a churning bot PR.

This was an automated dependency update PR created by red-hat-konflux[bot] (MintMaker/Renovate) that churned for ~8 months with 30+ autoclose/reopen cycles and 40+ force-pushes as the upstream digest kept changing. No human ever interacted with the PR.

What went well

• The review agent correctly identified a critical Go version incompatibility (go 1.22.0 → go 1.24.0 in go.mod would break CI running Go 1.22). This was the real blocker and matched the CI failures (pre-commit and golangci-lint both failed).
• The review completed in ~14.5 minutes with a clear, actionable CHANGES_REQUESTED verdict.

What was wasted

• The review agent spent tokens reviewing a PR that had been churning for 8 months and was autoclosed 2 days later. No human ever acted on the review findings.
• A retro agent was dispatched on the autoclose event, spending additional tokens analyzing a bot PR with no human interaction.

Existing issues cover the improvements

The following open issues in fullsend-ai/fullsend already propose changes that would prevent this waste:

• #1358 / #2639 — Lightweight/fast-path review for trivial bot dependency bumps
• #1355 — Skip re-review when bot dep-bump PR is rebased with no semantic change
• #2461 — Skip retro dispatch for autoclosed bot-authored PRs
• #2586 — Review agent should recommend closing unfixable dependency-bot PRs
• #1870 — Skip review/fix dispatch when PR action is 'closed'

No new proposals are warranted — implementing the existing issues above would address the waste observed in this workflow.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:20 PM UTC · Completed 9:28 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:47 AM UTC · Completed 10:54 AM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] api-contract

The PR bumps go.mod from go 1.23.0 to go 1.24.0, but CI (.github/workflows/test.yml) is hardcoded to Go 1.23.x (line 15 matrix and line 53 e2e job). Since Go 1.21+, if go.mod declares a Go version higher than the installed toolchain and GOTOOLCHAIN is set to local (as actions/setup-go does by default), the build will fail with a version mismatch error.

Suggested fix: Update .github/workflows/test.yml to use go-version 1.24.x (line 15 matrix and line 53 e2e job) to match the new go.mod directive, or add a toolchain go1.24.0 directive to go.mod to enable automatic toolchain switching.