UPSTREAM: <carry>: Bump openshift/client-go and openshift/api to release-4.23 - #450
Conversation
…ase-4.23 Bump openshift/client-go and openshift/api from 2023/2024 commits to release-4.23 (k8s v0.36.x) to resolve structured-merge-diff/v4 vs v6 type incompatibility that breaks go vet after velero rebase. Also bumps controller-runtime v0.17.2 -> v0.24.0, k8s deps v0.29.0 -> v0.36.2, and adds exclude for kcp/sdk zero-version pseudo-version. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Joseph <jvaikath@redhat.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Walkthrough
ChangesDependency refresh
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
go.mod (1)
17-35: 🔒 Security & Privacy | 🔵 TrivialAdd release-time supply-chain controls
go.sumalready pins the module hashes, but the repository still doesn’t show OSV scanning, SBOM/provenance attestations, or artifact signing in release automation. Add or point to the job that handles those controls if these artifacts are shipped.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 17 - 35, Add release automation for shipped artifacts that performs OSV dependency scanning, generates SBOM and provenance attestations, and signs release artifacts; if these controls already exist elsewhere, reference the responsible job from the release workflow. Ensure the workflow covers every released artifact and runs during the release process.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 139: Replace the unapproved timestamped pseudo-versions for
github.com/vmware-tanzu/velero/pkg/apis at go.mod lines 139-139 and the
github.com/openshift/velero replacement at go.mod lines 239-239 with stable
signed releases; if no suitable releases exist, document an approved exception
covering license compatibility, OSV results, provenance/SBOM generation, and
artifact signing for both entries.
- Around line 118-140: Update the k8s.io/apiextensions-apiserver dependency in
the go.mod require block from v0.36.0 to v0.36.2, matching k8s.io/api,
k8s.io/apimachinery, and k8s.io/client-go while leaving other dependencies
unchanged.
---
Nitpick comments:
In `@go.mod`:
- Around line 17-35: Add release automation for shipped artifacts that performs
OSV dependency scanning, generates SBOM and provenance attestations, and signs
release artifacts; if these controls already exist elsewhere, reference the
responsible job from the release workflow. Ensure the workflow covers every
released artifact and runs during the release process.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fd502c8a-ffd9-4681-8915-1c829c17a360
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| sigs.k8s.io/yaml v1.6.0 | ||
| ) | ||
|
|
||
| require github.com/vmware-tanzu/velero/pkg/apis v0.0.0-20260713215154-c825e3c136bc |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Do not ship unapproved prerelease pseudo-versions.
Both Velero entries use timestamped pseudo-versions, which conflicts with the production supply-chain policy. Prefer stable signed releases; otherwise document an approved exception covering license compatibility, OSV results, provenance/SBOM generation, and artifact signing.
go.mod#L139-L139: replace or approve thegithub.com/vmware-tanzu/velero/pkg/apispseudo-version.go.mod#L239-L239: replace or approve thegithub.com/openshift/veleroreplacement pseudo-version.
📍 Affects 1 file
go.mod#L139-L139(this comment)go.mod#L239-L239
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 139, Replace the unapproved timestamped pseudo-versions for
github.com/vmware-tanzu/velero/pkg/apis at go.mod lines 139-139 and the
github.com/openshift/velero replacement at go.mod lines 239-239 with stable
signed releases; if no suitable releases exist, document an approved exception
covering license compatibility, OSV results, provenance/SBOM generation, and
artifact signing for both entries.
Source: Path instructions
Point velero/pkg/apis to the downstream fork at the same commit as the main velero replace directive. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Joseph <jvaikath@redhat.com>
…36.2 Align with k8s.io/api, k8s.io/apimachinery, and k8s.io/client-go. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Joseph <jvaikath@redhat.com>
|
@Joeavaikath: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Joeavaikath, kaovilai, weshayutin The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
Summary
openshift/client-goandopenshift/apifrom 2023/2024 commits torelease-4.23(k8s v0.36.x)controller-runtimev0.17.2 → v0.24.0 and k8s deps v0.29.0 → v0.36.2excludeforkcp-dev/kcp/sdkzero-version pseudo-version (monorepo local replace)veleroreplace directive to latestoadp-devheadWhy
The velero rebase to upstream v1.16+ pulled in
structured-merge-diff/v6via k8s v0.36.x deps. The oldopenshift/client-go(2023 commit) usesstructured-merge-diff/v4, causing type incompatibility errors duringgo vet:This blocks the auto-rebase CI.
Test plan
go build ./...passes (withcontainers_image_openpgptag for local macOS)go mod tidyis cleango test -short ./...passes (except pre-existing envtest failures requiring etcd)Posted via Claude Code
Summary by CodeRabbit