chore: container-based Go module updates (update_go) and Renovate Go config

[VietND96]

What

Adds a container-based mechanism to keep the two in-repo Go modules — .monitoring/exporter and .keda-external-scaler — on the latest Go toolchain and dependencies, and applies a first update.

make update_go

Updates both Go modules using the official Go container (no host Go install required), so updates always track the latest stable release:

• GO_IMAGE (default golang:latest) provides the toolchain; override e.g. make update_go GO_IMAGE=golang:1.27.
• For each module: bumps the go directive to the container's Go version, runs go get -u ./... + go mod tidy, running as the invoking --user so go.mod/go.sum are not written root-owned.
• Aligns the .keda-external-scaler Dockerfile golang: base image to the same Go minor so the container build stays in sync.

Renovate

• postUpdateOptions: [gomodTidy, gomodUpdateImportPaths] so gomod PRs are tidied automatically.
• A rule to keep the Go toolchain (go.mod go directive and golang base image) on the latest release.

Applied update (make update_go, Go 1.26.5 from golang:latest)

• Fixes a pre-existing corrupt pseudo-version in the exporter go.mod (github.com/munnerz/goautoneg v0.0.0-2.20.110083416-a7dc8b61c822 → canonical v0.0.0-20191010083416-a7dc8b61c822) that was blocking go mod tidy/get.
• exporter: prometheus/common 0.67.5 → 0.70.0, procfs 0.20.1 → 0.21.1, x/sys 0.45.0 → 0.47.0; go directive 1.26.3 → 1.26.5.
• keda-external-scaler: grpc 1.71.0 → 1.82.0, protobuf 1.36.5 → 1.36.11, go-logr 1.4.2 → 1.4.3, plus x/net, x/sys, x/text, genproto; go directive 1.26.0 → 1.26.5.

Verify

• make update_go runs cleanly (Go 1.26.5 from golang:latest); resulting files owned by the invoking user, not root.
• .keda-external-scaler: go build ./... + go test ./internal/... -race pass.
• .monitoring/exporter: go build passes.

Notes

• Renovate already opened renovate/google.golang.org/grpc-update and .../protobuf-update; those overlap with the grpc/protobuf bumps here, so one side may supersede the other.

🤖 Generated with Claude Code

[qodo-code-review]

PR Summary by Qodo

Add containerized Go module updater and Renovate rules; bump in-repo Go deps

✨ Enhancement ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Add make update_go to update in-repo Go modules via official Go container.
• Configure Renovate to tidy gomod updates and track latest Go toolchain.
• Apply Go 1.26.5 toolchain bump and refresh exporter/scaler dependencies.

Diagram

graph TD
  U(["Developer / CI"]) --> M["make update_go"] --> G[["GO_IMAGE (golang) "] ] --> MODS[("Go modules\n(go.mod/go.sum)")]
  M --> A["Align scaler base"] --> D[".keda-external-scaler/Dockerfile"]

  subgraph Legend
    direction LR
    _u(["Invoker"]) ~~~ _p["Make target"] ~~~ _c[["Container image"]] ~~~ _f[("Module files")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin GO_IMAGE to a specific minor by default

• ➕ Avoids surprise updates when golang:latest advances
• ➕ Makes CI/local updates more reproducible
• ➖ Requires periodic manual bump of the default
• ➖ Slightly reduces the “always latest” convenience

2. Use Renovate-only for module updates (drop `go get -u ./...`)

• ➕ Smaller, more reviewable dependency PRs
• ➕ Centralizes update policy and scheduling in Renovate
• ➖ Harder to keep go directive and Docker base aligned in one step
• ➖ Less convenient for manual “bring everything current now” runs

3. Introduce a Go workspace (go.work) to manage both modules together

• ➕ More coherent multi-module workflows
• ➕ Potentially simpler tooling around shared version alignment
• ➖ Extra repo-level Go metadata to maintain
• ➖ Not necessary if modules remain largely independent

Recommendation: The container-based make update_go approach is a good fit for keeping two independent in-repo modules current without requiring host Go installs. Consider pinning the default GO_IMAGE (or documenting a recommended pinned value for CI) to balance reproducibility with freshness; Renovate can still handle ongoing incremental updates.

Files changed (6) +88 / -50

Enhancement (1) +25 / -0

MakefileAdd 'update_go' target to update modules via Go container +25/-0

Add 'update_go' target to update modules via Go container

• Introduces 'GO_IMAGE'/'GO_MODULES' and a 'make update_go' target that runs 'go mod edit', 'go get -u', and 'go mod tidy' inside a container as the invoking user. Also aligns the external scaler Dockerfile 'golang:' base tag to the same Go minor derived from the container toolchain.

Makefile

Other (5) +63 / -50

go.modBump scaler Go directive and direct/indirect dependencies +8/-8

Bump scaler Go directive and direct/indirect dependencies

• Updates the 'go' directive to 1.26.5 and bumps core dependencies (grpc, protobuf, go-logr). Refreshes several indirect 'x/*' and 'genproto' dependencies to newer versions.

.keda-external-scaler/go.mod

go.sumRefresh scaler dependency checksums after upgrades +32/-28

Refresh scaler dependency checksums after upgrades

• Regenerates module checksums to match upgraded dependencies (grpc/protobuf ecosystem and related transitive deps). Adds/removes sums consistent with the updated module graph.

.keda-external-scaler/go.sum

go.modFix invalid pseudo-version and bump exporter deps and Go directive +5/-6

Fix invalid pseudo-version and bump exporter deps and Go directive

• Updates the 'go' directive to 1.26.5, bumps Prometheus-related indirect deps, and updates 'x/sys'. Corrects a corrupted 'github.com/munnerz/goautoneg' pseudo-version to the canonical timestamped form.

.monitoring/exporter/go.mod

go.sumUpdate exporter checksums for corrected pseudo-version and bumps +8/-8

Update exporter checksums for corrected pseudo-version and bumps

• Updates sums to reflect the corrected 'goautoneg' pseudo-version and the bumped Prometheus/x/sys dependencies. Removes obsolete checksums for replaced versions.

.monitoring/exporter/go.sum

renovate.jsonConfigure Renovate to tidy gomod updates and track Go toolchain +10/-0

Configure Renovate to tidy gomod updates and track Go toolchain

• Adds 'postUpdateOptions' to run 'gomodTidy' and update import paths automatically. Introduces a package rule to keep both the 'go' directive and 'golang' base image on the latest release via bumping strategy.

renovate.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. update_go masks failures 🐞 Bug ☼ Reliability

Description

update_go runs a backslash-continued multi-command shell block without set -e or explicit status
checks, so a failing docker run ... go get/tidy inside the loop can be ignored and the target can
still exit 0 if the final sed ... && rm succeeds. This can leave partially-updated
go.mod/go.sum while printing success messages.

Code

Makefile[R163-173]

+	@GO_VERSION="$$(docker run --rm $(GO_IMAGE) go env GOVERSION | sed 's/go//')"; \
+	GO_MM="$$(echo $$GO_VERSION | sed -E 's/([0-9]+\.[0-9]+).*/\1/')"; \
+	echo "==> Using Go $$GO_VERSION from $(GO_IMAGE)"; \
+	for dir in $(GO_MODULES); do \
+		echo "==> Updating Go module in $$dir"; \
+		docker run --rm -v "$(PWD)":/src -w "/src/$$dir" \
+			--user "$$(id -u):$$(id -g)" -e HOME=/tmp -e GOFLAGS=-mod=mod \
+			$(GO_IMAGE) sh -c "go mod edit -go=$$GO_VERSION && go get -u ./... && go mod tidy"; \
+	done; \
+	echo "==> Aligning .keda-external-scaler Dockerfile base to golang:$$GO_MM"; \
+	sed -i.bak -E "s#(golang:)[0-9]+\.[0-9]+#\1$$GO_MM#g" .keda-external-scaler/Dockerfile && rm -f .keda-external-scaler/Dockerfile.bak

Evidence

The update_go recipe’s main body (lines 163–173) is executed as one shell script due to \
continuations and uses ; separators; without set -e/checks, a non-zero exit from the `docker
run` in the loop does not stop the script, and the overall exit status becomes that of the final
sed ... && rm ... command.

Makefile[161-173]
Makefile[147-173]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The `update_go` Makefile recipe executes many commands in a single shell invocation (via `\` line continuations) but does not enable fail-fast behavior. As a result, a failure during module updates can be masked by later successful commands (notably the final `sed ... && rm ...`), causing `make update_go` to report success even when updates did not complete.

### Issue Context
- `docker pull $(GO_IMAGE)` (line 162) is a separate recipe line and will fail the target as expected.
- The masking happens inside the subsequent shell block (lines 163–173) because commands are separated with `;` and there is no `set -e` or equivalent.

### Fix Focus Areas
- Makefile[161-173]

### Suggested fix
Within the `@GO_VERSION=...; \` shell block, add fail-fast behavior, for example:
- Prefix the block with `set -e;` (or `set -eu;`), and/or
- Ensure the loop exits on failure (e.g., append `|| exit 1` to the `docker run ...` line), and/or
- Rewrite the block to use `&&` chaining for commands whose failure should stop the target.

Example pattern:
```make
@set -e; \
GO_VERSION=...; \
...; \
for dir in ...; do \
 docker run ... || exit 1; \
done; \
...
```

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[qodo-code-review]

1. Update_go masks failures 🐞 Bug ☼ Reliability

update_go runs a backslash-continued multi-command shell block without set -e or explicit status
checks, so a failing docker run ... go get/tidy inside the loop can be ignored and the target can
still exit 0 if the final sed ... && rm succeeds. This can leave partially-updated
go.mod/go.sum while printing success messages.

Agent Prompt

### Issue description
The `update_go` Makefile recipe executes many commands in a single shell invocation (via `\` line continuations) but does not enable fail-fast behavior. As a result, a failure during module updates can be masked by later successful commands (notably the final `sed ... && rm ...`), causing `make update_go` to report success even when updates did not complete.

### Issue Context
- `docker pull $(GO_IMAGE)` (line 162) is a separate recipe line and will fail the target as expected.
- The masking happens inside the subsequent shell block (lines 163–173) because commands are separated with `;` and there is no `set -e` or equivalent.

### Fix Focus Areas
- Makefile[161-173]

### Suggested fix
Within the `@GO_VERSION=...; \` shell block, add fail-fast behavior, for example:
- Prefix the block with `set -e;` (or `set -eu;`), and/or
- Ensure the loop exits on failure (e.g., append `|| exit 1` to the `docker run ...` line), and/or
- Rewrite the block to use `&&` chaining for commands whose failure should stop the target.

Example pattern:
```make
@set -e; \
GO_VERSION=...; \
...; \
for dir in ...; do \
  docker run ... || exit 1; \
done; \
...
```

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools