Update google.golang.org/genproto/googleapis/rpc digest to 87f3d3e#177
Conversation
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR. I'm waiting for a openshift-hyperfleet member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
📝 WalkthroughSummary by CodeRabbit
Walkthrough
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Supply chain flag — CWE-1395 / SLSA L0. Commit hash pseudo-version
🚥 Pre-merge checks | ✅ 10 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)level=error msg="Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: err: exit status 1: stderr: go: updates to go.mod needed, disabled by -mod=readonly; to update it:\n\tgo mod tidy\n" Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 140: The dependency entry for google.golang.org/genproto/googleapis/rpc
at line 140 in go.mod uses a malformed pseudo-version format with only a bare
commit hash instead of the required Go pseudo-version syntax. Replace the
current entry with the proper pseudo-version format that includes the version
prefix, timestamp, and commit hash in the format
v0.0.0-YYYYMMDDHHMMSS-commitHash. The corrected version should be
v0.0.0-20260610172136-7ab31c22f7ad to ensure the Go parser accepts the version
and the dependency resolves correctly for the gRPC error handling and pub/sub
functionality that depends on genproto RPC definitions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2ffc51cc-d471-485b-9867-2195d822e561
📒 Files selected for processing (1)
go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual)
| google.golang.org/genproto v0.0.0-20260209200024-4cfbd4190f57 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect | ||
| google.golang.org/genproto/googleapis/rpc 7ab31c22f7ad // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Validate go.mod syntax and fetch genproto commit details
# Test 1: Check if go.mod parses (should fail with current syntax)
echo "=== Testing go.mod syntax ==="
cd /tmp && git clone --depth 1 https://github.com/openshift-hyperfleet/hyperfleet-sentinel.git 2>/dev/null || true
if [ -f /tmp/hyperfleet-sentinel/go.mod ]; then
cd /tmp/hyperfleet-sentinel && go mod tidy -e 2>&1 | head -20
fi
# Test 2: Find the correct pseudo-version format for commit 7ab31c22f7ad
echo "=== Fetching genproto commit metadata ==="
cd /tmp && git clone --depth 1 https://github.com/googleapis/go-genproto.git 2>/dev/null || true
if [ -d /tmp/go-genproto ]; then
cd /tmp/go-genproto
git log --oneline --all | grep -i "7ab31c2" || echo "Commit not found in shallow clone"
# Get full metadata for the commit
git log --format="%H %aI" | head -1 || echo "Unable to retrieve commit timestamp"
fi
# Test 3: Validate format against other genproto dependencies in the same file
echo "=== Comparing version formats in provided go.mod ==="
rg 'google.golang.org/genproto' 2>/dev/null | head -5Repository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 2143
🏁 Script executed:
#!/bin/bash
# Verify actual go.mod line 140 and surrounding context
echo "=== go.mod lines 135-145 ==="
sed -n '135,145p' go.mod
echo ""
echo "=== All google.golang.org/genproto entries ==="
grep -n 'google.golang.org/genproto' go.modRepository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 881
🏁 Script executed (no clone):
#!/bin/bash
# Check Go module pseudo-version format specification
echo "=== Verify commit hash 7ab31c22f7ad format ==="
# A valid Go pseudo-version is: vX.Y.Z-prerelease.0.<timestamp>-<commit>
# But bare commit hashes are also valid in some contexts. Let's verify.
cat <<'EOF'
Go module versions can be:
1. Semantic version: v1.2.3
2. Pre-release: v1.2.3-beta.1
3. Pseudo-version: v0.0.0-20260610172136-7ab31c22f7ad (format: v0.0.0-<timestamp>-<commit>)
4. Bare commit hash in replace directives (but not in require/require)
The line shown in review (google.golang.org/genproto/googleapis/rpc 7ab31c22f7ad)
appears to use bare commit hash syntax.
Checking Go 1.11+ module specification for validity...
EOF
Length of output: 506
🏁 Script executed:
#!/bin/bash
# Verify hyperfleet-broker's dependency on genproto and RPC status usage
echo "=== Checking broker/googlepubsub.go for gRPC status code usage ==="
grep -n "status\|codes\.NotFound\|codes\.AlreadyExists" broker/googlepubsub.go | head -20
echo ""
echo "=== Checking go.mod for genproto dependency ==="
grep -i 'genproto' go.modRepository: openshift-hyperfleet/hyperfleet-broker
Length of output: 729
🏁 Script executed:
#!/bin/bash
# Test if the bare commit hash causes actual build failure
echo "=== Attempting go build (should fail or show warnings) ==="
go build ./... 2>&1 | head -50
echo ""
echo "=== Check go mod graph for genproto/rpc version ==="
go mod graph | grep 'genproto/rpc' || echo "No match found"Repository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 3019
🏁 Script executed:
#!/bin/bash
# Check go.sum for the actual resolved version
echo "=== go.sum entries for genproto/googleapis/rpc ==="
grep 'genproto/googleapis/rpc' go.sum | head -5
echo ""
echo "=== Verify if Go accepts bare commit hash format ==="
# Check if the bare hash was normalized to a pseudo-version
go mod edit -json | jq '.Require[] | select(.Path | contains("genproto/googleapis/rpc"))'Repository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 634
Malformed pseudo-version at line 140 blocks build and prevents dependency update. [CWE-829]
Line 140 uses bare commit hash 7ab31c22f7ad instead of proper Go pseudo-version format. Go parser rejects this with error: version "7ab31c22f7ad" invalid: must be of the form v1.2.3. The intended update to google.golang.org/genproto/googleapis/rpc is blocked; go.sum still resolves to the old version v0.0.0-20260401024825-9d38bb4040a9.
Use proper pseudo-version format with timestamp: google.golang.org/genproto/googleapis/rpc v0.0.0-20260610172136-7ab31c22f7ad // indirect (based on commit 7ab31c22f7ad from 2026-06-10T17:21:36).
This matters because hyperfleet-broker depends on genproto RPC definitions for gRPC error handling in health checks (NotFound vs connectivity failures at lines 95–110) and pub/sub topic verification (AlreadyExists/NotFound checks at lines 140–170). The dependency version must resolve correctly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 140, The dependency entry for
google.golang.org/genproto/googleapis/rpc at line 140 in go.mod uses a malformed
pseudo-version format with only a bare commit hash instead of the required Go
pseudo-version syntax. Replace the current entry with the proper pseudo-version
format that includes the version prefix, timestamp, and commit hash in the
format v0.0.0-YYYYMMDDHHMMSS-commitHash. The corrected version should be
v0.0.0-20260610172136-7ab31c22f7ad to ensure the Go parser accepts the version
and the dependency resolves correctly for the gRPC error handling and pub/sub
functionality that depends on genproto RPC definitions.
Source: Coding guidelines
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
red-hat-konflux-kflux-prd-rh02
Bot
force-pushed
the
konflux/mintmaker/main/google.golang.org-genproto-googleapis-rpc-digest
branch
from
ff8f119 to
ef467b0
Compare
red-hat-konflux-kflux-prd-rh02
Bot
changed the title
There was a problem hiding this comment.
♻️ Duplicate comments (1)
go.mod (1)
140-140:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winRestore a valid Go pseudo-version.
87f3d3e198d3is not a legalgo.modversion token; this keeps the indirect dependency unresolved and can break module resolution/builds. Use a proper pseudo-version (v0.0.0-YYYYMMDDHHMMSS-<hash>) forgoogle.golang.org/genproto/googleapis/rpc.🔧 Proposed fix
- google.golang.org/genproto/googleapis/rpc 87f3d3e198d3 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-YYYYMMDDHHMMSS-87f3d3e198d3 // indirectVerification:
#!/bin/bash set -euo pipefail go mod edit -json >/tmp/go.mod.json go list -m -json google.golang.org/genproto/googleapis/rpcExpected:
go mod edit -jsonsucceeds and the module resolves to a validv0.0.0-...pseudo-version.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 140, In the go.mod file, the google.golang.org/genproto/googleapis/rpc dependency has an invalid pseudo-version token `87f3d3e198d3` which is not a legal version format. Replace this invalid token with a proper Go pseudo-version following the format v0.0.0-YYYYMMDDHHMMSS-<hash>, where the hash is the commit hash (the 12-character hash can be the full commit identifier). This will resolve the module properly and prevent build and module resolution issues.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@go.mod`:
- Line 140: In the go.mod file, the google.golang.org/genproto/googleapis/rpc
dependency has an invalid pseudo-version token `87f3d3e198d3` which is not a
legal version format. Replace this invalid token with a proper Go pseudo-version
following the format v0.0.0-YYYYMMDDHHMMSS-<hash>, where the hash is the commit
hash (the 12-character hash can be the full commit identifier). This will
resolve the module properly and prevent build and module resolution issues.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 20bf5ab3-21da-4bda-b078-50103d1474ef
📒 Files selected for processing (1)
go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual)
This PR contains the following updates:
9d38bb4→87f3d3eWarning
Some dependencies could not be looked up. Check the warning logs for more information.
Configuration
📅 Schedule: Branch creation - "on monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.