HYPERFLEET-1333 - chore: replace bingo with Go 1.24 tool directives by kuudori · Pull Request #14 · openshift-hyperfleet/hyperfleet-credential-provider

kuudori · 2026-07-10T18:58:36Z

HYPERFLEET-1333

Remove bingo tool management in favor of native tool directives in go.mod (Go 1.24+).
Tool versions are pinned in go.mod/go.sum and resolved via go tool <name>.

Pinned versions (unchanged from bingo):

golangci-lint v2.7.0

openshift-ci · 2026-07-10T18:58:40Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2026-07-10T18:58:41Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ma-hill for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-07-10T18:58:45Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: f8e0eaf2-c6e0-4921-b540-10ef9df02bc1

📥 Commits

Reviewing files that changed from the base of the PR and between 1289d38 and c32494e.

📒 Files selected for processing (1)

cmd/provider/version/version.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

openshift-hyperfleet/architecture (manual)
openshift-hyperfleet/hyperfleet-api (manual)
openshift-hyperfleet/hyperfleet-sentinel (manual)
openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against branch chore/replace-bingo-with-go-tool-directives instead of the default branch
openshift-hyperfleet/hyperfleet-broker (manual) → reviewed against open PR #26 chore/replace-bingo-with-go-tool-directives instead of the default branch

📝 Walkthrough

Summary by CodeRabbit

Development Updates
- Updated the project and container build environment to Go 1.26+.
- Improved linting by routing tool execution through a dedicated tools module.
- Added tool synchronization checks to help ensure development tooling stays consistent.
- Updated the version command to report the active Go toolchain dynamically.
Documentation
- Updated development prerequisites in the README to require Go 1.26 or newer.
Maintenance
- Refreshed module dependencies and removed outdated generated Bingo setup/configuration.

Walkthrough

The project moves to Go 1.26 across the Go module, Docker builder image, and development prerequisites. Dependencies are reorganized between direct and indirect requirements. The Makefile replaces Bingo-generated lint configuration with a dedicated tools/go.mod, runs golangci-lint through Go tooling, and adds tool synchronization and drift verification targets. The version command now reports the runtime Go version.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: ruclo, ma-hill

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main change, replacing Bingo with Go tool directives, though the Go version cited is outdated.
Description check	✅ Passed	The description matches the PR objective of replacing Bingo with native tool directives and pinning golangci-lint.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	No token/password/credential/secret fields or interpolations were added; version.go only prints fixed text and build metadata. CWE-532 not triggered.
No Hardcoded Secrets	✅ Passed	Scans of PR files found no API keys/tokens/passwords, base64 blobs, or embedded-credential URLs. No CWE-798/321 indicators.
No Weak Cryptography	✅ Passed	Patch only swaps a version string for runtime.Version(); no banned primitives, secret compares, or custom crypto (CWE-327/CWE-328).
No Injection Vectors	✅ Passed	Changed runtime code only prints runtime.Version(); no CWE-89/78/79/502 sinks or user-controlled input paths in touched files.
No Privileged Containers	✅ Passed	PASS: Dockerfile ends with USER 1001; no privileged/hostNetwork/SYS_ADMIN/runAsUser:0 settings appear in touched files (CWE-250/CWE-269).
No Pii Or Sensitive Data In Logs	✅ Passed	Only version output changed; it prints static build metadata and runtime.Version(), with no PII/session/body/hostname leakage or secret logging (CWE-532/CWE-200).

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

✨ Simplify code

Create PR with simplified code

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Around line 147-149: Replace the curl-piped installer in the $(GOLANGCI_LINT)
target with a checksum-verified installation approach, preferably a pinned Go
module install consistent with the project’s native Go tool directives. Ensure
the target still installs the requested golangci-lint version into ./bin without
executing an unverified remote script.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 6f893cf8-502e-423a-b076-d7ca8e2aec0c

📥 Commits

Reviewing files that changed from the base of the PR and between df6016b and 7bc6c3c.

⛔ Files ignored due to path filters (1)

.bingo/golangci-lint.sum is excluded by !**/*.sum

📒 Files selected for processing (4)

.bingo/.gitignore
.bingo/Variables.mk
.bingo/golangci-lint.mod
Makefile

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

openshift-hyperfleet/architecture (manual)
openshift-hyperfleet/hyperfleet-api (manual)
openshift-hyperfleet/hyperfleet-sentinel (manual)
openshift-hyperfleet/hyperfleet-adapter (manual)
openshift-hyperfleet/hyperfleet-broker (manual) → reviewed against open PR #26 chore/replace-bingo-with-go-tool-directives instead of the default branch

💤 Files with no reviewable changes (3)

.bingo/.gitignore
.bingo/golangci-lint.mod
.bingo/Variables.mk

coderabbitai

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Line 3: Update the Dockerfile builder image reference in the FROM instruction
to pin golang:1.26.0 by its verified sha256 digest, preserving the existing
builder stage name.

In `@go.mod`:
- Around line 19-21: Update the OpenTelemetry dependencies declared in go.mod,
including go.opentelemetry.io/otel,
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, and
go.opentelemetry.io/otel/sdk, to fixed releases that address CVE-2026-29181 and
CVE-2026-39883. If upgrading is not feasible, add a documented
govulncheck-backed reachability exception instead.

In `@README.md`:
- Line 386: Synchronize the CLI prerequisite version by updating the hardcoded
Go version reported in the version implementation near the version output logic,
or derive it from runtime.Version(). Ensure the CLI reports Go 1.26+
consistently with the README requirement.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 67dc9947-c175-417c-babc-a7e89f4fff0b

📥 Commits

Reviewing files that changed from the base of the PR and between 7bc6c3c and 1289d38.

⛔ Files ignored due to path filters (2)

go.sum is excluded by !**/*.sum, !**/go.sum
tools/go.sum is excluded by !**/*.sum, !**/go.sum

📒 Files selected for processing (8)

.bingo/.gitignore
.bingo/Variables.mk
.bingo/golangci-lint.mod
Dockerfile
Makefile
README.md
go.mod
tools/go.mod

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

openshift-hyperfleet/architecture (manual)
openshift-hyperfleet/hyperfleet-api (manual)
openshift-hyperfleet/hyperfleet-sentinel (manual)
openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against branch chore/replace-bingo-with-go-tool-directives instead of the default branch
openshift-hyperfleet/hyperfleet-broker (manual) → reviewed against open PR #26 chore/replace-bingo-with-go-tool-directives instead of the default branch

💤 Files with no reviewable changes (3)

.bingo/Variables.mk
.bingo/golangci-lint.mod
.bingo/.gitignore

kuudori · 2026-07-21T16:13:59Z

/retest-required

openshift-ci Bot added the do-not-merge/work-in-progress label Jul 10, 2026

kuudori force-pushed the chore/replace-bingo-with-go-tool-directives branch 3 times, most recently from 870d2af to 7bc6c3c Compare July 10, 2026 19:30

kuudori marked this pull request as ready for review July 10, 2026 19:40

openshift-ci Bot removed the do-not-merge/work-in-progress label Jul 10, 2026

openshift-ci Bot requested review from Ruclo and ma-hill July 10, 2026 19:40

coderabbitai Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread Makefile Outdated

kuudori marked this pull request as draft July 13, 2026 03:33

openshift-ci Bot added the do-not-merge/work-in-progress label Jul 13, 2026

kuudori force-pushed the chore/replace-bingo-with-go-tool-directives branch 3 times, most recently from f84545a to f8fdcd8 Compare July 14, 2026 02:09

kuudori changed the title ~~chore: replace bingo with Go 1.24 tool directives~~ HYPERFLEET-1333 - chore: replace bingo with Go 1.24 tool directives Jul 14, 2026

kuudori force-pushed the chore/replace-bingo-with-go-tool-directives branch 4 times, most recently from 2e129ac to 2df9ae5 Compare July 20, 2026 18:37

HYPERFLEET-1333 - chore: replace bingo with Go 1.24 tool directives

f260cf5

kuudori force-pushed the chore/replace-bingo-with-go-tool-directives branch from 2df9ae5 to f260cf5 Compare July 20, 2026 18:38

chore: bump Go to 1.26.0

1289d38

kuudori marked this pull request as ready for review July 21, 2026 15:49

openshift-ci Bot removed the do-not-merge/work-in-progress label Jul 21, 2026

coderabbitai Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread Dockerfile

Comment thread go.mod

Comment thread README.md

fix: use runtime.Version() instead of hardcoded Go version

c32494e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

HYPERFLEET-1333 - chore: replace bingo with Go 1.24 tool directives#14

HYPERFLEET-1333 - chore: replace bingo with Go 1.24 tool directives#14
kuudori wants to merge 3 commits into
openshift-hyperfleet:mainfrom
kuudori:chore/replace-bingo-with-go-tool-directives

kuudori commented Jul 10, 2026

Uh oh!

openshift-ci Bot commented Jul 10, 2026

Uh oh!

openshift-ci Bot commented Jul 10, 2026

Uh oh!

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kuudori commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

kuudori commented Jul 10, 2026

Uh oh!

openshift-ci Bot commented Jul 10, 2026

Uh oh!

openshift-ci Bot commented Jul 10, 2026

Uh oh!

coderabbitai Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kuudori commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading