ci: scan every nested module with Dependabot and pin the update window (#1020)

The gomod entries listed only `directory: "/"`, so osprom, osotel, cmd/osgen,
and cmd/osapilint were never scanned. cmd/osgen sat on kin-openapi 0.142.0
that way until its stale transitive golang.org/x/text picked up
CVE-2026-56852. Dependabot has no equivalent of the Makefile's SUBMODULES
discovery or lint.yml's discover-submodules job, so each module needs an
explicit entry.

Both gomod entries now use the plural `directories` key, listing the modules
that exist on their respective target branch: all five on main, root plus
cmd/osgen on v4. Paths are enumerated rather than globbed so the osapilint
testdata corpus fixtures, which pin old dependency versions deliberately, stay
out of scope.

All four entries also pin day, time, and timezone. A bare `interval: weekly`
lets Dependabot choose the day and reads any time as UTC. Tuesday 14:00 in
Seattle is Wednesday morning in Melbourne, so the batch lands in work hours at
both ends; 07:00 Pacific is the floor, since the two cities are 17 hours apart
for part of the year and anything earlier puts Melbourne back on Tuesday.

Document the workspace in DEVELOPER_GUIDE.md while here: what each nested
module keeps out of the core dependency graph, that go.work is committed so a
clone needs no setup, and that it is load-bearing rather than a convenience.
osprom and osotel require v5.0.0-rc3, a tag predating the observer API they
compile against, so the workspace is what points them at the local root and
GOWORK=off fails to build their tests until that require is bumped.

Note for future readers: Dependabot reads this file only from the default
branch, so the target-branch: "v4" entries here govern v4. Editing
.github/dependabot.yml on the v4 branch itself has no effect.

Signed-off-by: Ryan Yuan <ryan.yuan@crowdstrike.com>

Author: ryanyuan

.github/dependabot.yml

@@ -1,11 +1,26 @@
 version: 2
+
+# Nested Go modules need an explicit directories entry. Dependabot has no
+# equivalent of the Makefile's SUBMODULES discovery or the discover-submodules
+# job in lint.yml, so a module absent from the lists below is never scanned. A
+# new nested module has to be added here as well as to the Makefile and CI. The
+# paths are enumerated rather than globbed so the linter testdata corpus
+# fixtures, which pin old dependency versions on purpose, stay out of scope.
 updates:
   # --- v5 (default branch: main) ---
   - package-ecosystem: "gomod"
-    directory: "/"
+    directories:
+      - "/"
+      - "/cmd/osapilint"
+      - "/cmd/osgen"
+      - "/osotel"
+      - "/osprom"
     target-branch: "main"
     schedule:
       interval: "weekly"
+      day: "tuesday"
+      time: "14:00"
+      timezone: "America/Los_Angeles"
     labels:
       - "dependabot"
       - "dependencies"
@@ -15,17 +30,25 @@ updates:
     target-branch: "main"
     schedule:
       interval: "weekly"
+      day: "tuesday"
+      time: "14:00"
+      timezone: "America/Los_Angeles"
     labels:
       - "dependabot"
       - "dependencies"
       - "v5"
 
-  # --- v4 maintenance branch ---
+  # --- v4 maintenance branch: only the root module and cmd/osgen exist there ---
   - package-ecosystem: "gomod"
-    directory: "/"
+    directories:
+      - "/"
+      - "/cmd/osgen"
     target-branch: "v4"
     schedule:
       interval: "weekly"
+      day: "tuesday"
+      time: "14:00"
+      timezone: "America/Los_Angeles"
     labels:
       - "dependabot"
       - "dependencies"
@@ -35,6 +58,9 @@ updates:
     target-branch: "v4"
     schedule:
       interval: "weekly"
+      day: "tuesday"
+      time: "14:00"
+      timezone: "America/Los_Angeles"
     labels:
       - "dependabot"
       - "dependencies"

CHANGELOG.md

@@ -177,6 +177,8 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
 ### Changed
 
+- Configure Dependabot to scan the nested Go modules (`osprom`, `osotel`, `cmd/osgen`, `cmd/osapilint`) alongside the root module, and pin the weekly schedule to Tuesday 14:00 `America/Los_Angeles` rather than leaving the day to Dependabot and the time to UTC
+- Document the Go workspace and its nested modules in `DEVELOPER_GUIDE.md`
 - **BREAKING**: `cmd/osgen` now types enum-like `oneOf`-of-const fields and query parameters across `opensearchapi` and the plugin packages, so fields and params that were `string` change to named enum types (e.g. `Roles []string` -> `Roles []NodeRole`, `Result string` -> `Result Result`, the `cat` `time` param `string` -> `TimeUnit`, and similarly `OpType`, `SearchType`, `VersionType`, ...). Values still assign and compare as strings through the named type, so most call sites are unaffected; only type-strict comparisons against untyped string literals need the const (e.g. `require.Equal(t, opensearchapi.ResultUpdated, resp.Result)` instead of `"updated"`). ([#998](https://github.com/opensearch-project/opensearch-go/pull/998))
 - `cmd/osapilint`: map the v4 -> v5 partial-failure type renames from `opensearchapi/UPGRADING_V4_TO_V5.md` in the v4 -> v5 hop, so code walking the per-shard failure slice migrates instead of silently breaking. `ResponseShards` -> `ShardStatistics` and `ResponseShardsFailure` -> `ShardSearchFailure` (dropping the removed `Primary`/`Status` fields) are rewritten; `DocumentError` -> `ErrorRespBase` is reported as a manual semantic followup because the two types share no fields. ([#963](https://github.com/opensearch-project/opensearch-go/pull/963))
 - Add a first-class container-provider abstraction to the test harness `Makefile`. `CONTAINER_PROVIDER` is auto-detected by CLI presence in the order Colima -> Rancher Desktop (`rdctl`) -> Docker, and overridable with `CONTAINER_PROVIDER=colima|rancher|docker`. Selecting a provider pins the docker context (`colima` / `rancher-desktop`; the Docker provider leaves the active context alone, and a pre-set `DOCKER_CONTEXT` in the environment is respected), resolves the CLI runtime `$(CTR)` (now `docker` by default for every provider, with `CONTAINER_RUNTIME=nerdctl` as an advanced override), ensures the backing VM/daemon is running via the new `cluster.provider.ensure` target (wired into `cluster.start`), and sets `vm.max_map_count` through the provider's VM (`colima ssh` / `rdctl shell`) or a privileged helper container. Previously `$(CTR)` preferred `nerdctl` whenever it was on `PATH`, so a Rancher-installed `nerdctl` could hijack a Colima session. `make cluster.runtime` now reports the detected provider, docker context, and runtime

DEVELOPER_GUIDE.md

@@ -5,6 +5,7 @@
       - [Go 1.24](#go-124)
       - [Docker](#docker)
       - [Windows](#windows)
+    - [Go Workspace and Nested Modules](#go-workspace-and-nested-modules)
     - [Unit Testing](#unit-testing)
     - [Integration Testing](#integration-testing)
     - [Composing an OpenSearch Docker Container](#composing-an-opensearch-docker-container)
@@ -73,6 +74,28 @@ Install `make`
 sudo apt install make
 ```
 
+### Go Workspace and Nested Modules
+
+The repository is a Go workspace. Alongside the root client module there are four nested modules, each with its own `go.mod`, so that heavier dependencies stay out of the client's dependency graph:
+
+| Module          | Purpose                    | Keeps out of the core graph                                  |
+| --------------- | -------------------------- | ------------------------------------------------------------ |
+| `osprom`        | Prometheus metrics sink    | `github.com/prometheus/client_golang`                        |
+| `osotel`        | OpenTelemetry metrics sink | `go.opentelemetry.io/otel`, `otel/metric`, `otel/sdk/metric` |
+| `cmd/osgen`     | API code generator         | `github.com/getkin/kin-openapi`                              |
+| `cmd/osapilint` | API migration linter       | `golang.org/x/tools`                                         |
+
+`go.work` and `go.work.sum` are committed, so a fresh clone builds across every module with no setup step. From the repository root, `go build ./...` and `go test ./...` span all of them, and `make test-unit` and `make lint.local` additionally run each nested module on its own. Both discover the nested modules by searching for `go.mod`, so adding a module needs no Makefile or workflow change -- but it does need an entry in [`.github/dependabot.yml`](.github/dependabot.yml), which has no such discovery.
+
+The workspace is load-bearing rather than a convenience. `osprom` and `osotel` import `opensearchtransport` from the root module while declaring `require github.com/opensearch-project/opensearch-go/v5 v5.0.0-rc3`, and that tag predates the observer API they are written against. The workspace is what resolves them against the local root instead of the published version, so disabling it fails to compile their tests:
+
+```
+GOWORK=off go -C osprom test ./...
+# *Registry does not implement opensearchtransport.ConnectionObserver
+```
+
+This clears once a root tag carrying the current observer API is published and the two `require` lines are bumped to it. Until then, leave `go.work` in place and do not run the suite with `GOWORK=off`. Reach for the workspace rather than a `replace` directive when a nested module needs local root changes: a `replace` in a committed `go.mod` would follow the module to consumers.
+
 ### Unit Testing
 
 Go has a simple tool for running tests, and we simplified it further by creating this make command: