chore(deps): update google.golang.org/genproto/googleapis/api digest to 87f3d3e#218
Conversation
|
📝 WalkthroughSummary by CodeRabbit
Walkthrough
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Supply chain flag — CWE-1357 / CWE-829.
🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)level=error msg="Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: err: exit status 1: stderr: go: updates to go.mod needed, disabled by -mod=readonly; to update it:\n\tgo mod tidy\n" Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 149: The google.golang.org/genproto/googleapis/api module revision has
been updated in go.mod to the new version shown at line 149, but go.sum still
contains the checksum for the old revision (v0.0.0-20260401024825-9d38bb4040a9),
creating a module resolution mismatch. Run go mod tidy to regenerate go.sum and
ensure it includes the correct checksum for the new revision, which will restore
module integrity and reproducibility.
- Line 149: The version for the google.golang.org/genproto/googleapis/api
dependency is malformed and violates Go module version syntax. The current
pseudo-version 7ab31c22f7ad is missing the required v0.0.0- prefix and
timestamp. Update this dependency entry to follow the correct pseudo-version
format of v0.0.0-<YYYYMMDDHHMMSS>-<COMMITHASH>, such as
v0.0.0-20260401024825-7ab31c22f7ad, to resolve go mod tidy and build failures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: e7ed6f4c-c143-4cf9-acb5-7fd101858e7c
📒 Files selected for processing (1)
go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual)
| golang.org/x/sys v0.42.0 // indirect | ||
| golang.org/x/text v0.35.0 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect | ||
| google.golang.org/genproto/googleapis/api 7ab31c22f7ad // indirect |
There was a problem hiding this comment.
go.sum/go.mod sync failure — reproducibility broken (CWE-829).
go.sum still contains checksums for the old revision (v0.0.0-20260401024825-9d38bb4040a9), not the new one. This mismatch breaks module resolution integrity. Update go.sum to include the checksum entry for the new revision, or run go mod tidy to regenerate.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 149, The google.golang.org/genproto/googleapis/api module
revision has been updated in go.mod to the new version shown at line 149, but
go.sum still contains the checksum for the old revision
(v0.0.0-20260401024825-9d38bb4040a9), creating a module resolution mismatch. Run
go mod tidy to regenerate go.sum and ensure it includes the correct checksum for
the new revision, which will restore module integrity and reproducibility.
Malformed pseudo-version: missing v0.0.0- prefix and timestamp.
Line 149 contains google.golang.org/genproto/googleapis/api 7ab31c22f7ad // indirect. This violates Go module version syntax. The correct format is v0.0.0-<YYYYMMDDHHMMSS>-<COMMITHASH> (e.g., v0.0.0-20260401024825-7ab31c22f7ad). The current syntax will cause go mod tidy and build failures.
🐛 Proposed fix
- google.golang.org/genproto/googleapis/api 7ab31c22f7ad // indirect
+ google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-7ab31c22f7ad // indirect📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| google.golang.org/genproto/googleapis/api 7ab31c22f7ad // indirect | |
| google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-7ab31c22f7ad // indirect |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 149, The version for the
google.golang.org/genproto/googleapis/api dependency is malformed and violates
Go module version syntax. The current pseudo-version 7ab31c22f7ad is missing the
required v0.0.0- prefix and timestamp. Update this dependency entry to follow
the correct pseudo-version format of v0.0.0-<YYYYMMDDHHMMSS>-<COMMITHASH>, such
as v0.0.0-20260401024825-7ab31c22f7ad, to resolve go mod tidy and build
failures.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR. I'm waiting for a openshift-hyperfleet member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
…to 87f3d3e Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
red-hat-konflux-kflux-prd-rh02
Bot
force-pushed
the
konflux/mintmaker/main/google.golang.org-genproto-googleapis-api-digest
branch
from
b4fcb2b to
c14f1e6
Compare
red-hat-konflux-kflux-prd-rh02
Bot
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
go.mod (1)
149-149:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winMalformed pseudo-version breaks module resolution (CWE-829).
Line 149 specifies
87f3d3e198d3as a bare commit hash, violating Go module version syntax. Go requires pseudo-versions in the formatv0.0.0-<YYYYMMDDHHMMSS>-<commithash>. This malformed entry will failgo mod tidy,go build, and dependency resolution. Example:v0.0.0-20260401024825-87f3d3e198d3.[critical_blocker]
🔧 Proposed fix
- google.golang.org/genproto/googleapis/api 87f3d3e198d3 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-87f3d3e198d3 // indirect🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 149, The dependency google.golang.org/genproto/googleapis/api at line 149 uses a bare commit hash (87f3d3e198d3) which violates Go module version syntax. Replace the bare commit hash with a properly formatted pseudo-version following the pattern v0.0.0-<YYYYMMDDHHMMSS>-<commithash>, for example v0.0.0-20260401024825-87f3d3e198d3, to ensure Go module resolution works correctly with go mod tidy and go build commands.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 149: The dependency google.golang.org/genproto/googleapis/api on line 149
uses a bare commit hash `87f3d3e198d3` which is not a valid Go module version
format. Replace this with a proper Go pseudo-version in the format
`v0.0.0-YYYYMMDDHHMMSS-COMMITHASH` where the timestamp and commit hash
correspond to the actual commit. After updating the version string in go.mod,
run `go mod tidy` to regenerate the go.sum file with the correct checksums that
match the updated dependency declarations and ensure build reproducibility.
---
Duplicate comments:
In `@go.mod`:
- Line 149: The dependency google.golang.org/genproto/googleapis/api at line 149
uses a bare commit hash (87f3d3e198d3) which violates Go module version syntax.
Replace the bare commit hash with a properly formatted pseudo-version following
the pattern v0.0.0-<YYYYMMDDHHMMSS>-<commithash>, for example
v0.0.0-20260401024825-87f3d3e198d3, to ensure Go module resolution works
correctly with go mod tidy and go build commands.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: b827670b-edfa-4d9c-87c8-a5debd0ec0b1
📒 Files selected for processing (1)
go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual)
| golang.org/x/sys v0.42.0 // indirect | ||
| golang.org/x/text v0.35.0 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect | ||
| google.golang.org/genproto/googleapis/api 87f3d3e198d3 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify go.sum contains entry for the corrected pseudo-version once fixed
rg -A2 'google.golang.org/genproto/googleapis/api' go.sumRepository: openshift-hyperfleet/hyperfleet-api
Length of output: 593
🏁 Script executed:
#!/bin/bash
# Check actual go.mod around line 149
echo "=== go.mod line 145-155 ==="
sed -n '145,155p' go.mod
echo -e "\n=== Full go.mod google.golang.org/genproto entries ==="
rg 'google\.golang\.org/genproto' go.mod
echo -e "\n=== Full go.sum google.golang.org/genproto entries ==="
rg 'google\.golang\.org/genproto' go.sum | head -20Repository: openshift-hyperfleet/hyperfleet-api
Length of output: 2078
go.mod/go.sum sync broken — invalid version format prevents build verification (CWE-829).
Line 149 declares google.golang.org/genproto/googleapis/api 87f3d3e198d3 using a bare commit hash, which is not a valid Go module version. Go requires pseudo-version format (v0.0.0-YYYYMMDDHHMMSS-COMMITHASH). Additionally, go.sum contains only entries for v0.0.0-20260401024825-9d38bb4040a9, creating a sync mismatch — no checksums exist for the declared dependency. This breaks reproducible builds and prevents integrity verification.
Correct the version to a proper pseudo-version and run go mod tidy to regenerate go.sum checksums.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 149, The dependency google.golang.org/genproto/googleapis/api
on line 149 uses a bare commit hash `87f3d3e198d3` which is not a valid Go
module version format. Replace this with a proper Go pseudo-version in the
format `v0.0.0-YYYYMMDDHHMMSS-COMMITHASH` where the timestamp and commit hash
correspond to the actual commit. After updating the version string in go.mod,
run `go mod tidy` to regenerate the go.sum file with the correct checksums that
match the updated dependency declarations and ensure build reproducibility.
Source: Coding guidelines
This PR contains the following updates:
9d38bb4→87f3d3eWarning
Some dependencies could not be looked up. Check the warning logs for more information.
Configuration
📅 Schedule: Branch creation - "on monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.