Update google.golang.org/genproto/googleapis/api digest to 7ab31c2#176
Conversation
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR. I'm waiting for a openshift-hyperfleet member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
📝 WalkthroughSummary by CodeRabbit
Walkthrough
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Supply chain flag (CWE-1357 / CWE-829): 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)level=error msg="Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: err: exit status 1: stderr: go: updates to go.mod needed, disabled by -mod=readonly; to update it:\n\tgo mod tidy\n" Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 139: The google.golang.org/genproto/googleapis/api dependency on line 139
of go.mod has a malformed version string (7ab31c22f7ad) that lacks the required
v prefix and pseudo-version format (should be v0.0.0-20260401024825-9d38bb4040a9
per go.sum). Fix this by replacing the truncated hash with the complete
pseudo-version string. Additionally, synchronize the genproto version across all
affected modules in the workspace (hyperfleet-api, hyperfleet-adapter, and
hyperfleet-broker) to use a consistent version to prevent protobuf message type
incompatibilities during gRPC interface marshaling, particularly for the Pub/Sub
message types constructed in hyperfleet-broker.
- Line 139: The google.golang.org/genproto/googleapis/api module declaration
uses a bare commit hash instead of the Go module version format. Replace the
bare commit hash with the properly formatted version string that matches the
entry in go.sum, which should follow the v0.0.0-<yyyymmddhhmmss>-<hash> format
to ensure consistency between go.mod and go.sum and allow go mod tidy to work
correctly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 497f1dc5-fadd-4c19-8dfc-2f8682a29c04
📒 Files selected for processing (1)
go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual)
| google.golang.org/api v0.266.0 // indirect | ||
| google.golang.org/genproto v0.0.0-20260209200024-4cfbd4190f57 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect | ||
| google.golang.org/genproto/googleapis/api 7ab31c22f7ad // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify genproto version alignment across hyperfleet repositories
# Check go.sum files to confirm actual resolved versions
# List all genproto-related entries across workspace
fd -e 'go.sum' --exec grep 'google.golang.org/genproto' {} + | sort -u
# Extract unique versions
fd -e 'go.sum' --exec grep 'google.golang.org/genproto/googleapis/api' {} + | awk '{print $NF}' | sort -uRepository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 66
🏁 Script executed:
#!/bin/bash
# Check go.mod and go.sum directly for genproto entries
echo "=== hyperfleet-sentinel go.mod ==="
if [ -f go.mod ]; then
cat -n go.mod | grep -A2 -B2 'genproto' || echo "No genproto found in go.mod"
else
echo "go.mod not found"
fi
echo -e "\n=== hyperfleet-sentinel go.sum ==="
if [ -f go.sum ]; then
grep 'google.golang.org/genproto' go.sum | head -20 || echo "No genproto found in go.sum"
else
echo "go.sum not found"
fi
echo -e "\n=== Full go.mod content (first 150 lines) ==="
if [ -f go.mod ]; then
head -150 go.mod | cat -n
fiRepository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 9655
🏁 Script executed:
#!/bin/bash
# Check hyperfleet-api go.mod and go.sum for genproto
echo "=== hyperfleet-api go.mod ==="
if [ -f go.mod ]; then
grep -n 'genproto' go.mod || echo "No genproto found"
fi
echo -e "\n=== hyperfleet-api go.sum ==="
if [ -f go.sum ]; then
grep 'google.golang.org/genproto/googleapis/api' go.sum
fiRepository: openshift-hyperfleet/hyperfleet-api
Length of output: 585
🏁 Script executed:
#!/bin/bash
# Check hyperfleet-adapter go.mod and go.sum for genproto
echo "=== hyperfleet-adapter go.mod ==="
if [ -f go.mod ]; then
grep -n 'genproto' go.mod || echo "No genproto found"
fi
echo -e "\n=== hyperfleet-adapter go.sum ==="
if [ -f go.sum ]; then
grep 'google.golang.org/genproto/googleapis/api' go.sum
fiRepository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 676
🏁 Script executed:
#!/bin/bash
# Check hyperfleet-broker go.mod and go.sum for genproto
echo "=== hyperfleet-broker go.mod ==="
if [ -f go.mod ]; then
grep -n 'genproto' go.mod || echo "No genproto found"
fi
echo -e "\n=== hyperfleet-broker go.sum ==="
if [ -f go.sum ]; then
grep 'google.golang.org/genproto/googleapis/api' go.sum
fiRepository: openshift-hyperfleet/hyperfleet-broker
Length of output: 673
Malformed genproto version string in go.mod — CWE-829 (supply chain integrity).
Line 139 contains a truncated/malformed version: 7ab31c22f7ad lacks the required v prefix and pseudo-version format (go.sum shows the correct version as v0.0.0-20260401024825-9d38bb4040a9). This will fail Go's module validation.
Beyond the syntax error, genproto versions differ across the workspace:
- hyperfleet-sentinel/api:
v0.0.0-20260401024825-9d38bb4040a9 - hyperfleet-adapter:
v0.0.0-20260526163538-3dc84a4a5aaa - hyperfleet-broker:
v0.0.0-20260209200024-4cfbd4190f57
The pseudo-version dates span February–May 2026. hyperfleet-broker actively constructs Google Cloud Pub/Sub protobuf messages (Topic, Subscription, ExpirationPolicy, RetryPolicy, DeadLetterPolicy). Misaligned genproto versions across the dependency chain (adapter → broker v1.1.0) risk protobuf message type incompatibilities during gRPC interface marshaling.
Fix the malformed version string and synchronize genproto versions across hyperfleet-api, hyperfleet-adapter, and hyperfleet-broker.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 139, The google.golang.org/genproto/googleapis/api dependency
on line 139 of go.mod has a malformed version string (7ab31c22f7ad) that lacks
the required v prefix and pseudo-version format (should be
v0.0.0-20260401024825-9d38bb4040a9 per go.sum). Fix this by replacing the
truncated hash with the complete pseudo-version string. Additionally,
synchronize the genproto version across all affected modules in the workspace
(hyperfleet-api, hyperfleet-adapter, and hyperfleet-broker) to use a consistent
version to prevent protobuf message type incompatibilities during gRPC interface
marshaling, particularly for the Pub/Sub message types constructed in
hyperfleet-broker.
Source: Linked repositories
🧩 Analysis chain
🌐 Web query:
What is the correct Go pseudo-version format for a module versioned by git commit hash?
💡 Result:
The Go pseudo-version format for a module versioned by a git commit hash follows the structure [1][2]: baseVersionPrefix-timestamp-revisionIdentifier This format consists of three parts separated by dashes [1][2]: 1. baseVersionPrefix: A value derived from either the latest semantic version tag preceding the commit (e.g., vX.Y.Z-0 or vX.Y.Z-pre.0) or vX.0.0 if no such tag exists [1][3][2]. 2. timestamp: The UTC time the revision was created, in the format yyyymmddhhmmss (based on the Git commit time, not author time) [1][3][2]. 3. revisionIdentifier: A 12-character prefix of the git commit hash [1][2]. For example, a pseudo-version might appear as v0.0.0-20191109021931-daa7c04131f5 [3][2]. It is considered a best practice to allow Go tools to generate these versions automatically rather than creating them manually [4]. The go command automatically converts revision identifiers into this canonical format when necessary [3].
Citations:
- 1: https://tip.golang.org/doc/modules/version-numbers
- 2: https://go.dev/ref/mod
- 3: https://tip.golang.org/ref/mod
- 4: https://go.dev/doc/modules/version-numbers
🏁 Script executed:
#!/bin/bash
# Read the go.mod file around line 139 to verify the claimed syntax error
sed -n '135,145p' go.modRepository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 559
🏁 Script executed:
#!/bin/bash
# Check if the go.mod file is syntactically valid by attempting to parse it
# and verify the module line format more broadly
head -20 go.mod && echo "---" && tail -5 go.mod && echo "---" && wc -l go.modRepository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 1134
🏁 Script executed:
#!/bin/bash
# Check if go.mod can be parsed and verify the syntax validity
# The file appears valid structurally, but let's check if the version string is acceptable
# by looking at the actual format more carefully and checking go.sum for corresponding entry
echo "=== Line 139 from go.mod ===" && sed -n '139p' go.mod
echo "=== Checking go.sum for this module ===" && grep "google.golang.org/genproto/googleapis/api" go.sum | head -3
echo "=== Module format check ===" && grep -n "google.golang.org/genproto" go.modRepository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 751
Malformed version string in go.mod — go.mod/go.sum mismatch violates Go module format (CWE-829).
Line 139 declares google.golang.org/genproto/googleapis/api 7ab31c22f7ad, a bare commit hash without version prefix. Go module syntax requires v0.0.0-<yyyymmddhhmmss>-<hash>.
The go.sum file declares the same module as v0.0.0-20260401024825-9d38bb4040a9 — a different, properly formatted version. This mismatch will cause go mod tidy to fail or auto-correct unpredictably. Fix go.mod line 139 to match go.sum's version:
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
This is a supply chain integrity issue: mismatched versions between go.mod and go.sum can lead to different dependencies being resolved during builds, creating type incompatibilities with hyperfleet-broker's Pub/Sub protobuf usage (cloud.google.com/go/pubsub transitively depends on genproto API structures).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 139, The google.golang.org/genproto/googleapis/api module
declaration uses a bare commit hash instead of the Go module version format.
Replace the bare commit hash with the properly formatted version string that
matches the entry in go.sum, which should follow the
v0.0.0-<yyyymmddhhmmss>-<hash> format to ensure consistency between go.mod and
go.sum and allow go mod tidy to work correctly.
Source: Coding guidelines
This PR contains the following updates:
9d38bb4→7ab31c2Configuration
📅 Schedule: Branch creation - "on monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.