update vendor with https://github.com/openshift/library-go/pull/2001#941
update vendor with https://github.com/openshift/library-go/pull/2001#941lance5890 wants to merge 1 commit into
Conversation
WalkthroughThe pull request updates the Go module dependencies in ChangesDependency versions and replacements
🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Hi @lance5890. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 137: The PR replaces module github.com/openshift/library-go with the fork
github.com/lance5890/library-go (v0.0.0-20260605001424-f7fd773c8ec4) in go.mod
but lacks supply-chain evidence; update the PR with a brief fork justification
(why upstream wasn’t used), the fork maintainer identity, license compatibility
check against the original module, and links to provenance artifacts (SBOM,
build/release provenance or attestation) for the forked release; also include
any Sigstore/cosign signing details or verification steps for published
artifacts and call out the exact replace statement in go.mod and the required
version github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720 so
reviewers can verify the changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fcf29fde-d777-4a6a-b326-eae39885764a
⛔ Files ignored due to path filters (88)
go.sumis excluded by!**/*.sumvendor/github.com/openshift/api/config/v1/types_apiserver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_authentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_cluster_operator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_infrastructure.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_kmsencryption.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_network.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/console/v1/types_console_plugin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/console/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/features.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/features/features.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/features/legacyfeaturegates.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/install.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1beta1/types_machineset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/route/v1/generated.protois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/route/v1/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/route/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/security/v1/generated.protois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/security/v1/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/security/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/security/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverencryption.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsdnsspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awskmsconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/kmsconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/kmspluginconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/registrysources.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultapproleauthentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultauthentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultconfigmapreference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultkmspluginconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultsecretreference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaulttlsconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vsphereplatformspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/alertmanagercustomconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clustermonitoringspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/containerresource.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metricsserverconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/monitoringpluginconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorbuddyinfoconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorcpufreqconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorethtoolconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorksmdconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectormountstatsconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclasscollectconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclassconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetdevconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorprocessesconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsoftirqsconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdcollectconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectortcpstatconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexporterconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/openshiftstatemetricsconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatoradmissionwebhookconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatorconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/telemeterclientconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/awscsidriverconfigspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollertuningoptions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/config/serving/server.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/controller/controllercmd/builder.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/controller/controllercmd/cmd.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/certrotation/target.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/state/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/events/recorder_in_memory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/management/management_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/staticpod/controller/installer/manifests/installer-pod.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/staticpod/controller/prune/manifests/pruner-pod.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/staticpod/installerpod/cmd.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/staticpod/internal/atomicdir/sync.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/staticpod/internal/fsutil/fsutil.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (1)
go.mod
| // Upstream ginkgo does not export these symbols (e.g. `Suite`); see https://github.com/openshift/onsi-ginkgo. | ||
| replace github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1 | ||
|
|
||
| replace github.com/openshift/library-go => github.com/lance5890/library-go v0.0.0-20260605001424-f7fd773c8ec4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "1) Show the replacement in go.mod"
rg -n '^replace github.com/openshift/library-go' go.mod
echo
echo "2) Inspect the replaced module checksums in go.sum (hash pinning evidence)"
rg -n 'github.com/lance5890/library-go|github.com/openshift/library-go' go.sum
echo
echo "3) Query OSV for known vulns on both module names"
curl -s https://api.osv.dev/v1/query -d '{"package":{"ecosystem":"Go","name":"github.com/openshift/library-go"}}' | jq .
curl -s https://api.osv.dev/v1/query -d '{"package":{"ecosystem":"Go","name":"github.com/lance5890/library-go"}}' | jq .
echo
echo "4) Capture fork module metadata (license/provenance pointers) from GitHub API"
curl -s https://api.github.com/repos/lance5890/library-go | jq '{full_name,private,fork,default_branch,license,parent,html_url,created_at,updated_at,pushed_at}'
echo
echo "5) Check for Sigstore/cosign-related release artifacts or attestations (if any)"
curl -s https://api.github.com/repos/lance5890/library-go/releases | jq '.[0:5] | map({tag_name,created_at,published_at,assets: [.assets[]?.name]})'Repository: openshift/cluster-kube-controller-manager-operator
Length of output: 1063
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== GitHub API repo metadata (first 1k chars) =="
resp_repo="$(curl -sS https://api.github.com/repos/lance5890/library-go)"
echo "$resp_repo" | head -c 1000
echo
echo "== Parsed keys present =="
echo "$resp_repo" | jq 'keys'
echo
echo
echo "== GitHub API releases endpoint (first 1k chars) =="
resp_releases="$(curl -sS https://api.github.com/repos/lance5890/library-go/releases)"
echo "$resp_releases" | head -c 1000
echo
echo "== Parsed top-level type =="
echo "$resp_releases" | jq 'type'
echo
echo
echo "== OSV query raw (openshift path) =="
curl -sS https://api.osv.dev/v1/query \
-d '{"package":{"ecosystem":"Go","name":"github.com/openshift/library-go"}}' | head -c 500
echo
echo "== OSV parsed (openshift path) =="
curl -sS https://api.osv.dev/v1/query \
-d '{"package":{"ecosystem":"Go","name":"github.com/openshift/library-go"}}' | jq .
echo
echo
echo "== OSV query raw (lance fork path) =="
curl -sS https://api.osv.dev/v1/query \
-d '{"package":{"ecosystem":"Go","name":"github.com/lance5890/library-go"}}' | head -c 500
echo
echo "== OSV parsed (lance fork path) =="
curl -sS https://api.osv.dev/v1/query \
-d '{"package":{"ecosystem":"Go","name":"github.com/lance5890/library-go"}}' | jq .Repository: openshift/cluster-kube-controller-manager-operator
Length of output: 1022
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod around line 137 =="
sed -n '120,155p' go.mod | cat -n
echo
echo "== go.sum entries for the forked module =="
rg -n 'github.com/(openshift/library-go|lance5890/library-go)\s+v0\.0\.0-20260605001424-f7fd773c8ec4' go.sum || true
echo
echo "== Count of replace directives touching openshift/library-go =="
rg -n '^replace .*openshift/library-go' go.mod || trueRepository: openshift/cluster-kube-controller-manager-operator
Length of output: 1779
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "1) Replacement in go.mod"
rg -n '^replace github.com/openshift/library-go' go.mod
echo
echo "2) Hash pins in go.sum"
rg -n 'github.com/(lance5890/library-go|openshift/library-go)\s+v0\.0\.0-20260605001424-f7fd773c8ec4' go.sum
echo
echo "3) OSV query (by module name)"
curl -sS https://api.osv.dev/v1/query \
-d '{"package":{"ecosystem":"Go","name":"github.com/openshift/library-go"}}' | jq .
curl -sS https://api.osv.dev/v1/query \
-d '{"package":{"ecosystem":"Go","name":"github.com/lance5890/library-go"}}' | jq .
echo
echo "4) Fork metadata + license/provenance pointers (use token to avoid rate limits if needed)"
AUTH=""
if [ -n "${GITHUB_TOKEN:-}" ]; then
AUTH="Authorization: Bearer ${GITHUB_TOKEN}"
fi
curl -sS ${AUTH:+-H "$AUTH"} https://api.github.com/repos/lance5890/library-go | jq '{full_name,private,fork,default_branch,license,parent,html_url,created_at,updated_at,pushed_at}'
echo
echo "5) Releases/artifacts (check for signing/attestations if any)"
releases="$(curl -sS ${AUTH:+-H "$AUTH"} https://api.github.com/repos/lance5890/library-go/releases)"
echo "$releases" | jq 'if type=="array" then .[0:5] | map({tag_name,created_at,published_at,assets:[.assets[]?.name]}) else . end'Repository: openshift/cluster-kube-controller-manager-operator
Length of output: 706
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n 'library-go|lance5890' go.modRepository: openshift/cluster-kube-controller-manager-operator
Length of output: 279
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Replacement (go.mod):"
rg -n '^replace github.com/openshift/library-go' go.mod
echo
echo "Hashes for replacement version (go.sum):"
rg -n 'github.com/(openshift/library-go|lance5890/library-go)\s+v0\.0\.0-20260605001424-f7fd773c8ec4' go.sum
echo
echo "OSV (openshift):"
curl -sS https://api.osv.dev/v1/query -d '{"package":{"ecosystem":"Go","name":"github.com/openshift/library-go"}}' | jq .
echo
echo "OSV (lance):"
curl -sS https://api.osv.dev/v1/query -d '{"package":{"ecosystem":"Go","name":"github.com/lance5890/library-go"}}' | jq .Repository: openshift/cluster-kube-controller-manager-operator
Length of output: 555
Add supply-chain evidence for the github.com/openshift/library-go fork replacement (go.mod line 137)
go.modreplacesgithub.com/openshift/library-gowithgithub.com/lance5890/library-go v0.0.0-20260605001424-f7fd773c8ec4, changing the upstream source of a widely used dependency.- The module is also explicitly required at
github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720, so the trust anchor is altered by this replace. go.sumincludes hash pins for the replaced fork version, and OSV lookups for both module names returned no vulnerability records ({}), but the PR still lacks required supply-chain evidence: fork justification, license compatibility, provenance/SBOM/provenance-attestation info, and any Sigstore/cosign signing details for produced artifacts.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 137, The PR replaces module github.com/openshift/library-go
with the fork github.com/lance5890/library-go
(v0.0.0-20260605001424-f7fd773c8ec4) in go.mod but lacks supply-chain evidence;
update the PR with a brief fork justification (why upstream wasn’t used), the
fork maintainer identity, license compatibility check against the original
module, and links to provenance artifacts (SBOM, build/release provenance or
attestation) for the forked release; also include any Sigstore/cosign signing
details or verification steps for published artifacts and call out the exact
replace statement in go.mod and the required version
github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720 so reviewers
can verify the changes.
|
There was IMO no need to replace the previous testing PR, but doesn't matter. /ok-to-test |
|
@lance5890: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
replace #899
related to openshift/library-go#2001
Summary by CodeRabbit