HYPERFLEET-1334 - chore: replace bingo with Go 1.24 tool directives

[kuudori]

HYPERFLEET-1334

Replace Bingo / standalone go install with a single tools/go.mod using Go 1.24+ tool directives.
Tools are pinned in tools/go.mod and invoked via $(call gotool,<name>) in the Makefile.

Tools:

• golangci-lint v2.7.0
• oapi-codegen v2.7.1

Also adds tidy-tools and verify-tools Make targets.

Follow-up changes (review comment fixes)

• Quote $(GO) and $(TOOL_MOD) in Makefile gotool and tool recipes to prevent shell injection (CWE-78)
• verify-tools now compares against HEAD (git diff HEAD --) instead of the working tree
• Bumped oapi-codegen v2.5.1 -> v2.7.1 (GHSA-rjwr-m7qx-3fjr fix)

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign pnguyen44 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change replaces Bingo-generated tool configuration with a tools/go.mod module declaring golangci-lint, oapi-codegen, and pinned transitive dependencies. The Makefile runs lint through this module, adds tidy and drift-verification targets, and includes tool verification in check.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: mbrudnoy, crizzo71, sherine-k, tirthct

Sequence Diagram(s)

sequenceDiagram
  participant Makefile
  participant ToolsModule
  participant GolangCILint
  Makefile->>ToolsModule: Run golangci-lint with tools/go.mod
  ToolsModule->>GolangCILint: Resolve pinned tool
  GolangCILint->>Makefile: Lint ./...

Loading

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title matches the main change: replacing Bingo with Go tool directives.
Description check	✅ Passed	Description is directly related to the Bingo-to-tools/go.mod migration and Makefile updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	No log statements in the PR files reference token/password/credential/secret; CWE-532 not introduced.
No Hardcoded Secrets	✅ Passed	No CWE-798 hardcoded secrets or credential literals found; touched files only add tool metadata, Make targets, and docs.
No Weak Cryptography	✅ Passed	Only Makefile/tools manifests changed; no banned primitives, custom crypto, or secret comparisons were added. CWE-327.
No Injection Vectors	✅ Passed	No CWE-89/78/79/502 patterns appear in touched files; Makefile quotes GO/TOOL_MOD and uses literal tool names only.
No Privileged Containers	✅ Passed	No manifests/templates/Dockerfiles changed; diff is limited to Makefile and tools/go.mod|go.sum, with no privileged settings found.
No Pii Or Sensitive Data In Logs	✅ Passed	Tooling-only patch; no slog/logr/zap/fmt.Print logging of customer data or credentials, so no CWE-532 exposure.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Around line 130-132: Update the Makefile targets verify and/or check so the
default verification flow invokes verify-tools, ensuring stale tools/go.mod or
tools/go.sum files fail normal make check execution. Preserve the existing
verification steps and dependency structure while wiring verify-tools into the
gate.
- Around line 5-6: Update the Makefile’s GO usage in the gotool helper and
tidy-tools recipe so GO is treated as one executable path rather than raw shell
syntax. Quote or otherwise validate the GO value before expansion, while
preserving the existing tool and tidy behavior.
- Around line 5-6: Update the gotool Makefile definition to export GOWORK=off
when invoking go tool, matching the environment handling used by tidy-tools.
Preserve the existing TOOL_MOD and argument forwarding so commands such as lint
can run successfully outside workspace mode.

In `@tools/go.mod`:
- Line 7: Update the github.com/oapi-codegen/oapi-codegen/v2 dependency in
tools/go.mod from v2.5.1 to v2.7.1, then regenerate tools/go.sum so it reflects
the upgraded module and checksums.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 73cc2ea7-5ddb-4251-8180-f05718a8419e

📥 Commits

Reviewing files that changed from the base of the PR and between 3ad187a and db9475a.

⛔ Files ignored due to path filters (1)

• tools/go.sum is excluded by !**/*.sum, !**/go.sum

📒 Files selected for processing (8)

• .bingo/.gitignore
• .bingo/README.md
• .bingo/Variables.mk
• .bingo/go.mod
• .bingo/golangci-lint.mod
• .bingo/variables.env
• Makefile
• tools/go.mod

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against branch chore/replace-bingo-with-go-tool-directives instead of the default branch
• openshift-hyperfleet/hyperfleet-broker (manual) → reviewed against open PR #26 chore/replace-bingo-with-go-tool-directives instead of the default branch

💤 Files with no reviewable changes (6)

• .bingo/README.md
• .bingo/.gitignore
• .bingo/golangci-lint.mod
• .bingo/go.mod
• .bingo/Variables.mk
• .bingo/variables.env

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@AGENTS.md`:
- Line 17: Update the make check entry in AGENTS.md to include verify-tools in
the documented sequence, matching the Makefile implementation while preserving
the existing generate, fmt-check, vet, lint, and test steps.

In `@Makefile`:
- Around line 130-132: Update the verify-tools target to detect untracked
tools/go.mod and tools/go.sum files using git ls-files --others
--exclude-standard, and fail with the existing out-of-date guidance when either
manifest is untracked. Preserve the current git diff validation for tracked
manifest changes.
- Around line 126-132: Expose a `tidy-tools` Make target for the tool-module
tidy operation currently defined by `tools`, either by renaming it or adding an
alias. Update `verify-tools` to depend on `tidy-tools` while preserving its
existing drift check and failure message.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 887a0ded-59af-48b4-9ba7-8266b071cf44

📥 Commits

Reviewing files that changed from the base of the PR and between 88ac768 and 42f2a93.

⛔ Files ignored due to path filters (1)

• tools/go.sum is excluded by !**/*.sum, !**/go.sum

📒 Files selected for processing (9)

• .bingo/.gitignore
• .bingo/README.md
• .bingo/Variables.mk
• .bingo/go.mod
• .bingo/golangci-lint.mod
• .bingo/variables.env
• AGENTS.md
• Makefile
• tools/go.mod

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against branch chore/replace-bingo-with-go-tool-directives instead of the default branch
• openshift-hyperfleet/hyperfleet-broker (manual) → reviewed against open PR #26 chore/replace-bingo-with-go-tool-directives instead of the default branch

💤 Files with no reviewable changes (6)

• .bingo/.gitignore
• .bingo/README.md
• .bingo/variables.env
• .bingo/golangci-lint.mod
• .bingo/go.mod
• .bingo/Variables.mk

🚧 Files skipped from review as they are similar to previous changes (1)

• tools/go.mod

[openshift-ci]

@kuudori: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/lint	265f742	link	true	/test lint

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.