build: upgrade to Go 1.26.5 - #615
Conversation
also, build image using `registry.access.redhat.com/ubi10/ubi:latest` also, convert `README.adoc` to `README.md` also, remove the `check-format` target and move the formatting logic into `go.mk` Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
💤 Files with no reviewable changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📜 Recent review details⏰ Context from checks skipped due to timeout. (4)
WalkthroughThe change upgrades the Go toolchain and dependencies, updates the build image, adds a Go formatting target, converts the README to Markdown, and clears vulnerability ignores. ChangesRepository maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
coderabbitai
Bot
added
chore
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
openshift-ci/Dockerfile.tools (1)
1-1: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSecurity Misconfiguration (CWE-829): Inclusion of Functionality from Untrusted Control Sphere
Reachability: External
Pin the UBI base image by digest.
The
latesttag can change the build environment without a reviewed Dockerfile change. Use an approved immutable digest to preserve reproducibility and supply-chain control.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@openshift-ci/Dockerfile.tools` at line 1, Update the build-tools stage’s UBI base image reference to use the approved immutable image digest instead of the mutable latest tag, preserving the existing registry and image while ensuring reproducible builds.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@make/go.mk`:
- Line 9: Change GOFORMAT_FILES from immediate to deferred evaluation so the
find/grep discovery runs only when format-go-code expands it, while preserving
the existing exclusions and allowing files generated earlier in the invocation
to be included.
In `@README.md`:
- Line 12: Update the Go download link in the README to replace the vague “here”
text with descriptive link text such as “Go downloads page,” while preserving
the existing destination URL.
---
Nitpick comments:
In `@openshift-ci/Dockerfile.tools`:
- Line 1: Update the build-tools stage’s UBI base image reference to use the
approved immutable image digest instead of the mutable latest tag, preserving
the existing registry and image while ensuring reproducible builds.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 21199964-a75c-49a6-ab5b-f387eeff161d
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (7)
.govulncheck.yamlREADME.mdgo.modmake/format.mkmake/go.mkmake/gofmt_excludeopenshift-ci/Dockerfile.tools
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
codeready-toolchain/api(manual)codeready-toolchain/toolchain-common(manual)codeready-toolchain/host-operator(manual)codeready-toolchain/toolchain-e2e(manual)
💤 Files with no reviewable changes (1)
- make/format.mk
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: GolangCI Lint
- GitHub Check: test
- GitHub Check: govulncheck
- GitHub Check: Build & push operator bundles & dashboard image for e2e tests
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
make/gofmt_excludeopenshift-ci/Dockerfile.toolsmake/go.mkgo.modREADME.md
🪛 GitHub Actions: ci-check-gomod / 0_go.mod replacements.txt
go.mod
[error] 1-1: Go module replacement(s) are not allowed in go.mod. The pipeline detected forbidden replacements via: go list -m all | grep --color=never -E "${REGEX}.*\s*=>" and exited with code 1. Log: the above replacement(s) are not allowed in go.mod.
🪛 GitHub Actions: ci-check-gomod / go.mod replacements
go.mod
[error] 1-1: Dependency replacement check failed. Protected modules are replaced with unapproved modules: github.com/codeready-toolchain/api => github.com/xcoulon/api and github.com/codeready-toolchain/toolchain-common => github.com/xcoulon/toolchain-common. The command exited with code 1.
🪛 markdownlint-cli2 (0.23.2)
README.md
[warning] 12-12: Link text should be descriptive
(MD059, descriptive-link-text)
🪛 OSV Scanner (2.4.0)
go.mod
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
(GO-2026-5005)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(GO-2026-5006)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
(GO-2026-5013)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
(GO-2026-5014)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
(GO-2026-5015)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
(GO-2026-5016)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(GO-2026-5017)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
(GO-2026-5018)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(GO-2026-5019)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
(GO-2026-5020)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(GO-2026-5021)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(GO-2026-5023)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
(GO-2026-5033)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
(GO-2026-5932)
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking pathological inputs can lead to client panic
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto doesn't enforce invoking key constraints
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto vulnerable to infinite loop on large channel writes
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
[CRITICAL] 163-163: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
🪛 Trivy (0.72.0)
openshift-ci/Dockerfile.tools
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🔇 Additional comments (9)
README.md (1)
1-11: LGTM!Also applies to: 13-14, 24-24, 38-38, 48-48
make/gofmt_exclude (1)
1-1: LGTM!make/go.mk (1)
11-15: 🎯 Functional CorrectnessThis review comment is not applicable to the current code state.
check-formatdoes not exist in this repository and has no git history. Theformat-go-codetarget is already a formatter with-wflag. No CI workflow runs any formatting checks, so there is no gate to protect. The concern about replacing a required CI check does not apply here.> Likely an incorrect or invalid review comment..govulncheck.yaml (1)
1-1: 🩺 Stability & AvailabilityKeep the empty suppression list.
The updated Go toolchain and dependencies meet the fixed versions for all removed vulnerability IDs, including Go 1.26.5,
golang.org/x/netv0.55.0,golang.org/x/textv0.39.0, andgoogle.golang.org/grpcv1.82.1.go.mod (3)
3-5: LGTM!Also applies to: 107-115, 164-171
163-163: 🔒 Security & PrivacyDo not block this change on the reported
golang.org/x/cryptoadvisories.The advisories affect
golang.org/x/crypto/ssh,ssh/agent,ssh/knownhosts, andopenpgp. The dependency graph does not include these packages, so the reported findings are not reachable in this build.
22-25: 🗄️ Data Integrity & IntegrationConfirm approval of the forked modules.
The replacements preserve the original module identities. The affected source changes are comment-only, and
go mod verifypasses. Confirm thatgithub.com/xcoulonis an approved and intentional source before merging.openshift-ci/Dockerfile.tools (2)
12-13: LGTM!
1-1: 🔒 Security & PrivacyRun pull-request builds as a non-root user when this image is used by OpenShift CI.
registry.access.redhat.com/ubi10/ubi:latestdefaults to root, and this Dockerfile sets/bin/bashas the entrypoint without aUSERinstruction. Add a non-root user with access to${GOPATH}and${GOPATH}/src/${GO_PACKAGE_PATH}. Confirm the external OpenShift CI configuration uses this image for untrusted pull-request code.
| ## Build | ||
|
|
||
| Requires Go version 1.24.x (1.24.13 or higher) - download for your development environment https://golang.org/dl/[here]. | ||
| Requires Go version 1.26.x (1.26.5 or higher) - download for your development environment [here](https://golang.org/dl/). |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use descriptive link text for the Go download link.
Line 12 uses here as the link text. Replace it with text such as Go downloads page so the destination is clear in link lists and screen readers.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 12-12: Link text should be descriptive
(MD059, descriptive-link-text)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 12, Update the Go download link in the README to replace
the vague “here” text with descriptive link text such as “Go downloads page,”
while preserving the existing destination URL.
Source: Linters/SAST tools
|
|
||
| replace github.com/codeready-toolchain/api => github.com/xcoulon/api v0.0.0-20260805080027-7512d38caa3b | ||
|
|
||
| replace github.com/codeready-toolchain/toolchain-common => github.com/xcoulon/toolchain-common v0.0.0-20260805080255-7db4efab1c46 |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: MatousJobanek, MikelAlejoBR, rajivnathan, xcoulon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@make/go.mk`:
- Around line 20-26: Update the check-go-format target’s gofmt pipeline so it
preserves the formatter command’s exit status and fails when gofmt reports an
error or $(OUT_DIR)/gofmt-errors contains output. Remove the unconditional
success masking from the current read/tee/exit flow, while retaining the
existing diagnostic message and error-file display for formatting differences.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: aeb95837-9f4d-4d6f-9270-61227f801a51
📒 Files selected for processing (2)
make/format.mkmake/go.mk
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
codeready-toolchain/api(manual) → reviewed against open PR#521upgrade-go-1.26-apiinstead of the default branchcodeready-toolchain/toolchain-common(manual) → reviewed against open PR#543upgrade-go-1.26-commoninstead of the default branchcodeready-toolchain/host-operator(manual) → reviewed against open PR#1290upgrade-go-1.26-hostinstead of the default branchcodeready-toolchain/toolchain-e2e(manual) → reviewed against open PR#1313upgrade-go-1.26-e2einstead of the default branch
💤 Files with no reviewable changes (1)
- make/format.mk
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: test
- GitHub Check: GolangCI Lint
- GitHub Check: Generate SBOM
- GitHub Check: govulncheck
- GitHub Check: Build & push operator bundles & dashboard image for e2e tests
⚠️ CI failures not shown inline (2)
GitHub Actions: ci-check-gomod / go.mod replacements: build: upgrade to Go 1.26.5
Conclusion: failure
##[group]Run set -e
�[36;1mset -e�[0m
�[36;1mREGEX="("�[0m
�[36;1mfor m in $(IFS=,; echo $PROTECTED_MODULES); do�[0m
�[36;1m REGEX="${REGEX}${m}|"�[0m
�[36;1mdone�[0m
�[36;1mREGEX="${REGEX%?})"�[0m
�[36;1m�[0m
�[36;1mif go list -m all | grep --color=never -E "${REGEX}.*\s*=>"; then�[0m
�[36;1m echo "the above replacement(s) are not allowed in go.mod"�[0m
�[36;1m exit 1�[0m
�[36;1mfi�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
PROTECTED_MODULES: github.com/codeready-toolchain/,github.com/kubesaw/
##[endgroup]
github.com/codeready-toolchain/api v0.0.0-20260731065234-734640c901d2 => github.com/xcoulon/api v0.0.0-20260805080027-7512d38caa3b
github.com/codeready-toolchain/toolchain-common v0.0.0-20260804130313-0d4161d82454 => github.com/xcoulon/toolchain-common v0.0.0-20260805080255-7db4efab1c46
the above replacement(s) are not allowed in go.mod
##[error]Process completed with exit code 1.
GitHub Actions: ci-check-gomod / 0_go.mod replacements.txt: build: upgrade to Go 1.26.5
Conclusion: failure
##[group]Run set -e
�[36;1mset -e�[0m
�[36;1mREGEX="("�[0m
�[36;1mfor m in $(IFS=,; echo $PROTECTED_MODULES); do�[0m
�[36;1m REGEX="${REGEX}${m}|"�[0m
�[36;1mdone�[0m
�[36;1mREGEX="${REGEX%?})"�[0m
�[36;1m�[0m
�[36;1mif go list -m all | grep --color=never -E "${REGEX}.*\s*=>"; then�[0m
�[36;1m echo "the above replacement(s) are not allowed in go.mod"�[0m
�[36;1m exit 1�[0m
�[36;1mfi�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
PROTECTED_MODULES: github.com/codeready-toolchain/,github.com/kubesaw/
##[endgroup]
github.com/codeready-toolchain/api v0.0.0-20260731065234-734640c901d2 => github.com/xcoulon/api v0.0.0-20260805080027-7512d38caa3b
github.com/codeready-toolchain/toolchain-common v0.0.0-20260804130313-0d4161d82454 => github.com/xcoulon/toolchain-common v0.0.0-20260805080255-7db4efab1c46
the above replacement(s) are not allowed in go.mod
##[error]Process completed with exit code 1.
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
make/go.mk
🔇 Additional comments (1)
make/go.mk (1)
12-15: LGTM!Also applies to: 17-19
| $(Q)find . -name '*.go' -not -path '*/vendor/*' -not -path '*/.git/*' -exec gofmt -s -l {} + 2>&1 \ | ||
| | tee $(OUT_DIR)/gofmt-errors \ | ||
| | read \ | ||
| && echo "ERROR: These files differ from gofmt's style (run 'make format-go-code' to fix this):" \ | ||
| && cat $(OUT_DIR)/gofmt-errors \ | ||
| && exit 1 \ | ||
| || true |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
if bash -c 'false | tee "$1" | read && exit 1 || true' bash "$tmp"; then
echo "Confirmed: the producer failure was masked."
else
exit 1
fiRepository: codeready-toolchain/registration-service
Length of output: 259
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- make/go.mk lines 1-45 ---'
cat -n make/go.mk | sed -n '1,45p'
printf '%s\n' '--- related make settings and targets ---'
rg -n -C 3 'SHELL|PIPEFAIL|gofmt-errors|format-go-code|gofmt' Makefile make .github 2>/dev/null | head -240 || true
printf '%s\n' '--- standalone pipeline behavior ---'
bash -c '
set -o pipefail
tmp=$(mktemp)
trap "rm -f \"$tmp\"" EXIT
set +e
false | tee "$tmp" | read
pipeline_status=$?
set -e
printf "pipeline_status=%s file_size=%s\\n" "$pipeline_status" "$(wc -c < "$tmp")"
'Repository: codeready-toolchain/registration-service
Length of output: 4054
🏁 Script executed (no clone):
#!/bin/bash
set -u
sink() {
local file=$1 line
while IFS= read -r line; do
printf '%s\n' "$line" >> "$file"
done
}
run_case() {
local name=$1
shift
local file rc
file=$(mktemp)
set +e
"$@" | sink "$file" | read
rc=$?
if [ "$rc" -eq 0 ]; then
echo "ERROR: format differences detected"
cat "$file"
exit 1
fi
true
rc=$?
set -e
printf '%s: recipe_status=%s output_bytes=%s\n' \
"$name" "$rc" "$(wc -c < "$file")"
rm -f "$file"
}
no_output_success() { return 0; }
no_output_failure() { return 7; }
one_output_success() { printf '%s\n' 'bad.go'; return 0; }
one_output_failure() { printf '%s\n' 'gofmt: failure'; return 7; }
run_case no_output_success no_output_success
run_case no_output_failure no_output_failure
run_case one_output_success one_output_success
run_case one_output_failure one_output_failure
Length of output: 328
Make check-go-format fail on formatter and output errors.
read is the last pipeline command, and || true masks both empty-output failures and the explicit exit 1. The target therefore returns success for formatting differences and gofmt failures. Capture the formatter status and fail when it is nonzero or gofmt-errors is non-empty.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@make/go.mk` around lines 20 - 26, Update the check-go-format target’s gofmt
pipeline so it preserves the formatter command’s exit status and fails when
gofmt reports an error or $(OUT_DIR)/gofmt-errors contains output. Remove the
unconditional success masking from the current read/tee/exit flow, while
retaining the existing diagnostic message and error-file display for formatting
differences.
Source: Path instructions
also, `remove check-go-format` make goal Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
|
4 participants
also, build image using
registry.access.redhat.com/ubi10/ubi:latestalso, convert
README.adoctoREADME.mdalso, remove the
check-formattarget and move the formatting logic intogo.mkSee also:
Signed-off-by: Xavier Coulon xcoulon@redhat.com
Summary by CodeRabbit
Documentation
Maintenance
Developer Experience
Security