chore(deps): switch back to dependabot - #306
Conversation
Signed-off-by: Calum Murray <cmurray@redhat.com>
✅ Deploy Preview for mcp-lifecycle-operator ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Cali0707 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
kubernetes-prow
Bot
added
approved
kubernetes-prow
Bot
added
the
size/L
📝 WalkthroughWalkthroughThe pull request replaces Renovate with Dependabot, updates Go builder images to 1.26.5, adds a Go version validation script and Make target, and runs the validation in the verification workflow. ChangesDependency automation and Go version validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #306 +/- ##
=======================================
Coverage ? 71.77%
=======================================
Files ? 22
Lines ? 2172
Branches ? 0
=======================================
Hits ? 1559
Misses ? 558
Partials ? 55 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/verify.yml:
- Around line 29-30: Update both actions/checkout steps in the workflow jobs to
explicitly set persist-credentials to false, while preserving the existing
checkout configuration and contents: read permissions.
In `@hack/verify-go-version.sh`:
- Around line 20-21: Update the image_versions extraction in the verification
script to inspect every case-insensitive, whitespace-tolerant FROM instruction
referencing golang, including tags like latest and ${GO_VERSION}. Validate each
extracted tag as a supported pinned version and fail the verification when any
tag is unpinned or unsupported, while retaining deduplication for valid
versions.
- Around line 55-65: The required-version selection in the verification logic
must account for GOTOOLCHAIN=local: use only the go directive when local mode is
selected, rather than elevating the requirement to the toolchain directive. Keep
the higher toolchain requirement for automatic switching modes, and ensure the
failure diagnostic reflects the selected GOTOOLCHAIN policy.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4d24e77a-fd07-4a9d-94a0-2c1ddbbdc89e
📒 Files selected for processing (7)
.github/dependabot.yml.github/renovate-config.js.github/workflows/renovate.yml.github/workflows/verify.ymlDockerfileMakefilehack/verify-go-version.sh
💤 Files with no reviewable changes (2)
- .github/workflows/renovate.yml
- .github/renovate-config.js
| - name: Clone the code | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/verify.yml
printf '%s\n' '--- referenced verification files ---'
for f in Makefile hack/verify-go-version.sh; do
if [ -f "$f" ]; then
printf '\n--- %s ---\n' "$f"
cat -n "$f"
fi
done
printf '%s\n' '--- workflow-related references ---'
rg -n --hidden -S \
'verify-go-version|persist-credentials|permissions:|pull_request|pull_request_target|actions/checkout@' \
.github Makefile hack 2>/dev/null || true
printf '%s\n' '--- checkout pin metadata ---'
git ls-remote --tags https://github.com/actions/checkout.git \
'refs/tags/v6.0.3' 'refs/tags/v6.0.3^{}' 2>/dev/null || trueRepository: kubernetes-sigs/mcp-lifecycle-operator
Length of output: 25010
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
path = Path(".github/workflows/verify.yml")
lines = path.read_text().splitlines()
# Read the workflow as data and report the security-relevant fields without
# executing YAML, Make, or repository scripts.
print("--- pull_request trigger and permissions ---")
for i, line in enumerate(lines, 1):
if re.match(r"^(on:| pull_request:|permissions:| contents:)", line):
print(f"{i}: {line}")
print("--- checkout steps and following inputs ---")
for i, line in enumerate(lines):
if re.match(r"^\s+uses:\s+actions/checkout@", line):
job = next(
(lines[j].strip() for j in range(i - 1, -1, -1)
if re.match(r"^ [A-Za-z0-9_-]+:$", lines[j])),
"<unknown job>",
)
print(f"line {i+1}, job {job}, {line.strip()}")
j = i + 1
inputs = []
while j < len(lines) and (lines[j].startswith(" ") or not lines[j].strip()):
if re.match(r"^\s{10}\S", lines[j]) or re.match(r"^\s{8}with:$", lines[j]):
inputs.append(f"{j+1}: {lines[j]}")
j += 1
for item in inputs:
print(item)
if not any("persist-credentials:" in item for item in inputs):
print("persist-credentials: <action default applies>")
print("--- commands after checkout ---")
for i, line in enumerate(lines, 1):
if re.match(r"^\s+run:\s+", line):
print(f"{i}: {line.strip()}")
PY
printf '%s\n' '--- pinned checkout action default ---'
curl -fsSL \
https://raw.githubusercontent.com/actions/checkout/df4cb1c069e1874edd31b4311f1884172cec0e10/action.yml |
grep -n -A3 -B2 'persist-credentials'
printf '%s\n' '--- other verification workflow permissions and checkout settings ---'
for f in .github/workflows/test.yml .github/workflows/lint.yml \
.github/workflows/test-e2e.yml .github/workflows/govulncheck.yml \
.github/workflows/build-mcp-everything.yml; do
if [ -f "$f" ]; then
printf '\n--- %s ---\n' "$f"
rg -n -A3 -B2 'permissions:|contents:|actions/checkout@|persist-credentials:|run:' "$f"
fi
doneRepository: kubernetes-sigs/mcp-lifecycle-operator
Length of output: 4294
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- checkout credential handling at the pinned commit ---'
curl -fsSL \
https://raw.githubusercontent.com/actions/checkout/df4cb1c069e1874edd31b4311f1884172cec0e10/src/git-auth-helper.ts |
rg -n -A8 -B8 \
'persist-credentials|extraheader|configureAuth|removeGitConfigAuth'
printf '%s\n' '--- workflow permission keys ---'
python3 - <<'PY'
from pathlib import Path
import re
lines = Path(".github/workflows/verify.yml").read_text().splitlines()
start = next(i for i, line in enumerate(lines) if line == "permissions:")
end = next((i for i in range(start + 1, len(lines))
if lines[i] and not lines[i].startswith(" ")), len(lines))
print("\n".join(f"{i+1}: {lines[i]}" for i in range(start, end)))
print("--- checkout count and explicit credential settings ---")
checkouts = [i + 1 for i, line in enumerate(lines)
if "uses: actions/checkout@" in line]
explicit = [i + 1 for i, line in enumerate(lines)
if "persist-credentials:" in line]
print("checkout_lines=", checkouts)
print("explicit_persist_credentials_lines=", explicit)
PYRepository: kubernetes-sigs/mcp-lifecycle-operator
Length of output: 2280
Disable persisted checkout credentials in both jobs.
Both actions/checkout steps use the default persist-credentials: true, while pull_request jobs execute repository-controlled Make targets. Set persist-credentials: false on both steps. The workflow already grants only contents: read, which is sufficient for checkout.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 29-30: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/verify.yml around lines 29 - 30, Update both
actions/checkout steps in the workflow jobs to explicitly set
persist-credentials to false, while preserving the existing checkout
configuration and contents: read permissions.
Sources: MCP tools, Linters/SAST tools
| mapfile -t image_versions < <(grep -oE '^FROM.* golang:[0-9]+(\.[0-9]+)*' "${DOCKERFILE}" | | ||
| sed -E 's/.*golang://' | sort -u) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- script ---'
cat -n hack/verify-go-version.sh
printf '%s\n' '--- related files ---'
git ls-files | rg '(^|/)(Dockerfile|.*Dockerfile.*|verify-go-version\.sh)$' || true
printf '%s\n' '--- references ---'
rg -n --glob '!node_modules' --glob '!dist' 'verify-go-version|golang:' . || true
printf '%s\n' '--- regex behavior ---'
python3 - <<'PY'
import re
text = """FROM golang:1.25.4 AS build
from golang:1.26.4 AS second
FROM alpine:3.20
FROM golang:latest AS latest
FROM golang:1.27 AS numeric
\tFrOm\tgolang:1.28.1 AS mixed
FROM golang:1.29.0@sha256:abc AS digest
"""
patterns = {
"current": r"^FROM.* golang:[0-9]+(\.[0-9]+)*",
"proposed": r"^[ \t]*FROM[ \t]+.*golang:[0-9]+(\.[0-9]+)*",
}
for name, pattern in patterns.items():
flags = re.I if name == "proposed" else 0
print(f"{name}:")
for line in text.splitlines():
match = re.search(pattern, line, flags)
if match:
print(f" {line!r} -> {match.group(0)!r}")
PYRepository: kubernetes-sigs/mcp-lifecycle-operator
Length of output: 5756
🏁 Script executed:
#!/bin/bash
set -eu
cat -n hack/verify-go-version.sh
printf '\n--- references ---\n'
rg -n 'verify-go-version|golang:' . --glob '!node_modules' --glob '!dist' || true
printf '\n--- regex behavior ---\n'
python3 - <<'PY'
import re
lines = [
"FROM golang:1.25.4 AS build",
" from golang:1.26.4 AS second",
"FROM golang:latest AS latest",
"\tFrOm\tgolang:1.28.1 AS mixed",
]
patterns = {
"current": (r"^FROM.* golang:[0-9]+(\.[0-9]+)*", 0),
"proposed": (r"^[ \t]*FROM[ \t]+.*golang:[0-9]+(\.[0-9]+)*", re.I),
}
for name, (pattern, flags) in patterns.items():
print(name)
for line in lines:
match = re.search(pattern, line, flags)
if match:
print(" ", repr(line), "=>", repr(match.group(0)))
PYRepository: kubernetes-sigs/mcp-lifecycle-operator
Length of output: 5409
🏁 Script executed:
#!/bin/bash
set -eu
input='
FROM golang:1.26.5 AS builder
from golang:1.26.4 AS whitespace
FrOm golang:1.26.3 AS mixed
FROM golang:latest AS unpinned
FROM golang:${GO_VERSION} AS variable
FROM golang:1.26.5@sha256:deadbeef AS digest
FROM alpine:3.20
'
printf '%s\n' '--- current extraction ---'
printf '%s\n' "$input" |
grep -oE '^FROM.* golang:[0-9]+(\.[0-9]+)*' |
sed -E 's/.*golang://' |
sort -u || true
printf '%s\n' '--- proposed extraction ---'
printf '%s\n' "$input" |
grep -Eio '^[[:space:]]*FROM[[:space:]]+.*golang:[0-9]+(\.[0-9]+)*' |
sed -E 's/.*golang://' |
sort -u || true
printf '%s\n' '--- golang references on FROM lines ---'
printf '%s\n' "$input" |
grep -Ein '^[[:space:]]*FROM[[:space:]].*golang:' || trueRepository: kubernetes-sigs/mcp-lifecycle-operator
Length of output: 517
🏁 Script executed:
#!/bin/bash
set -eu
input='
FROM golang:1.26.5 AS builder
from golang:1.26.4 AS whitespace
FrOm golang:1.26.3 AS mixed
FROM golang:latest AS unpinned
FROM golang:${GO_VERSION} AS variable
FROM golang:1.26.5@sha256:deadbeef AS digest
FROM alpine:3.20
'
printf '%s\n' "$input" |
grep -oE '^FROM.* golang:[0-9]+(\.[0-9]+)*' |
sed -E 's/.*golang://' |
sort -u || true
printf '%s\n' "$input" |
grep -Eio '^[[:space:]]*FROM[[:space:]]+.*golang:[0-9]+(\.[0-9]+)*' |
sed -E 's/.*golang://' |
sort -u || true
printf '%s\n' "$input" |
grep -Ein '^[[:space:]]*FROM[[:space:]].*golang:' || trueRepository: kubernetes-sigs/mcp-lifecycle-operator
Length of output: 422
Scan and validate every FROM golang: stage.
The current expression skips lowercase instructions and instructions with leading whitespace. It also ignores unpinned or unsupported tags such as latest and ${GO_VERSION}. Inspect every golang: reference and fail when its tag is not a supported pinned version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/verify-go-version.sh` around lines 20 - 21, Update the image_versions
extraction in the verification script to inspect every case-insensitive,
whitespace-tolerant FROM instruction referencing golang, including tags like
latest and ${GO_VERSION}. Validate each extracted tag as a supported pinned
version and fail the verification when any tag is unpinned or unsupported, while
retaining deduplication for valid versions.
Source: MCP tools
| # Highest of the two is what go.mod effectively demands of the toolchain. | ||
| required="${go_directive}" | ||
| required_from="go directive" | ||
| if [[ -n "${toolchain}" ]]; then | ||
| highest="$(printf '%s\n%s\n' "$(normalise "${go_directive}")" "$(normalise "${toolchain}")" | | ||
| sort -V | tail -n1)" | ||
| if [[ "${highest}" == "$(normalise "${toolchain}")" && "${toolchain}" != "${go_directive}" ]]; then | ||
| required="${toolchain}" | ||
| required_from="toolchain directive" | ||
| fi | ||
| fi |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target script ---'
cat -n hack/verify-go-version.sh | sed -n '1,120p'
printf '%s\n' '--- repository Go declarations ---'
find . -name go.mod -type f -print -exec sed -n '1,20p' {} \;
printf '%s\n' '--- relevant references ---'
rg -n 'GOTOOLCHAIN|verify-go-version|toolchain directive|automatic toolchain|bundled toolchain' . --glob '!vendor/**' --glob '!node_modules/**' | head -200
printf '%s\n' '--- local Go availability ---'
if command -v go >/dev/null 2>&1; then go version; else echo 'go: unavailable'; fiRepository: kubernetes-sigs/mcp-lifecycle-operator
Length of output: 5031
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- Go toolchain documentation ---'
go help toolchain 2>&1 | sed -n '1,220p' || true
printf '%s\n' '--- Go environment ---'
go env GOTOOLCHAIN GOROOT GOVERSION
printf '%s\n' '--- Go source references ---'
goroot="$(go env GOROOT)"
rg -n 'GOTOOLCHAIN|toolchain.*directive|local toolchain|Newer Go version|go directive' \
"${goroot}/src/cmd/go" "${goroot}/src/cmd/go/internal" 2>/dev/null | head -240Repository: kubernetes-sigs/mcp-lifecycle-operator
Length of output: 28599
🌐 Web query:
Go official documentation GOTOOLCHAIN=local toolchain directive go.mod suggested toolchain bundled toolchain
💡 Result:
The GOTOOLCHAIN environment variable and the toolchain directive in go.mod provide a mechanism for managing and automatically switching Go toolchain versions [1][2][3]. GOTOOLCHAIN Environment Variable The GOTOOLCHAIN environment variable controls which Go toolchain is used when you run the go command [1][4]. - Default: For standard Go releases, the default is GOTOOLCHAIN=auto [1][2][4]. - GOTOOLCHAIN=local: Directs the go command to always use the bundled toolchain (the one currently running) [4][3][5]. If this bundled toolchain is older than what the project requires (specified in go.mod), the go command will fail rather than attempt to switch [1][4][5]. - GOTOOLCHAIN=auto: Allows the go command to automatically switch to a newer toolchain if the current project (via go.mod or go.work) requests a version newer than the bundled toolchain [1][2][4]. - GOTOOLCHAIN=: For example, GOTOOLCHAIN=go1.23.0. The go command will always use that specific version [4][5]. It will look in the system PATH first; if not found, it will download and verify the requested version [4][5]. Toolchain Directive in go.mod The toolchain directive is used in the main module's go.mod (or in go.work) to suggest a specific Go toolchain version [6][5]. - Purpose: It allows a project to specify a minimum toolchain version that is distinct from the go directive, which primarily specifies language semantics [2][5]. - Interaction: If the toolchain directive is present and suggests a version newer than the default (bundled) toolchain, the go command (provided GOTOOLCHAIN=auto or similar) will switch to that newer toolchain [1][6][4]. - Writing: The go command automatically updates the toolchain directive in go.mod whenever it updates the go version, ensuring reproducibility [6]. Bundled Toolchain The bundled toolchain refers to the specific Go distribution that you currently have installed and are executing [4][5]. When GOTOOLCHAIN=local is set, the system is constrained to only use this specific binary, disabling any automatic downloads or switching functionality [4][3][5]. In summary, these features work together to provide "extended forwards compatibility," allowing developers to specify required toolchains in their code while the go command manages the underlying binaries automatically, unless explicitly restricted by the user [2][3].
Citations:
- 1: https://go.dev/doc/toolchain
- 2: https://go.googlesource.com/proposal/+/refs/heads/master/design/57001-gotoolchain.md
- 3: https://go.googlesource.com/proposal/+/master/design/57001-gotoolchain.md
- 4: https://go.googlesource.com/website/+/refs/heads/master/_content/doc/toolchain.md
- 5: https://alexbozhenko.github.io/posts/2024-12-19-understand-go-toolchain-directive-or-your-money-back/
- 6: https://go.dev/ref/mod
🏁 Script executed:
#!/bin/bash
set -eu
goroot="$(go env GOROOT)"
printf '%s\n' '--- toolchain selection implementation ---'
cat -n "${goroot}/src/cmd/go/internal/toolchain/select.go" | sed -n '175,280p'
printf '%s\n' '--- local-policy test cases ---'
cat -n "${goroot}/src/cmd/go/testdata/script/gotoolchain_local.txt" | sed -n '45,115p'
printf '%s\n' '--- local-policy failure test cases ---'
cat -n "${goroot}/src/cmd/go/testdata/script/gotoolchain_path.txt" | sed -n '20,70p'
printf '%s\n' '--- relevant official documentation source ---'
cat -n "${goroot}/src/cmd/go/alldocs.go" | sed -n '2440,2475p'Repository: kubernetes-sigs/mcp-lifecycle-operator
Length of output: 11743
Correct the GOTOOLCHAIN=local diagnostic.
When GOTOOLCHAIN=local is selected, Go uses the bundled toolchain and enforces the go directive. It does not switch to a newer toolchain suggestion. If the bundled version satisfies the go directive but is below the toolchain suggestion, local mode can still build. Limit the failure message to automatic switching or compare against the selected GOTOOLCHAIN policy.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/verify-go-version.sh` around lines 55 - 65, The required-version
selection in the verification logic must account for GOTOOLCHAIN=local: use only
the go directive when local mode is selected, rather than elevating the
requirement to the toolchain directive. Keep the higher toolchain requirement
for automatic switching modes, and ensure the failure diagnostic reflects the
selected GOTOOLCHAIN policy.
Source: MCP tools
|
@Cali0707: The following test failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Fixes #264
The original reasoning for renovate was that it allows us to bump go deps and the go version in dockerfiles together.
However it is not working, due to a lot of complicated branch protection rules. Looking at other kubernetes-sigs/kubernetes repos, all of the rest use simply Dependabot. external-dns uses renovate as well and are facing the same issue, but they use dependabot for their go deps and renovate only for some other minor deps bumps.
With this in mind, I've reverted back to using dependabot in this PR. This also adds a job to check if the dockerfile go version matches the go.mod version, to avoid the issue we had in the past.
Summary by CodeRabbit
New Features
Bug Fixes
Chores