HYPERFLEET-1336 - chore: replace bingo with Go 1.24 tool directives#223
Merged
openshift-merge-bot[bot] merged 4 commits intoJul 21, 2026
Conversation
|
Skipping CI for Draft Pull Request. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe change replaces Bingo-managed tool files with a dedicated Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant Makefile
participant GoTool as Go tool runner
participant ToolsModule as tools/go.mod
participant DeveloperTool as pinned developer tool
Makefile->>GoTool: invoke tool with -modfile=tools/go.mod
GoTool->>ToolsModule: resolve pinned tool
ToolsModule-->>GoTool: return tool metadata
GoTool->>DeveloperTool: execute generation, lint, docs, or validation
DeveloperTool-->>Makefile: return command result
🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
kuudori
force-pushed
the
chore/replace-bingo-with-go-tool-directives
branch
3 times, most recently
from
July 10, 2026 19:31
1aaf732 to
4e82b0e
Compare
kuudori
marked this pull request as ready for review
July 10, 2026 19:40
Risk Score: 2 —
|
| Signal | Detail | Points |
|---|---|---|
| PR size | 3106 lines (>500) | +2 |
| Sensitive paths | none | +0 |
Computed by hyperfleet-risk-scorer
kuudori
marked this pull request as draft
July 13, 2026 03:33
kuudori
force-pushed
the
chore/replace-bingo-with-go-tool-directives
branch
from
July 13, 2026 18:52
4e82b0e to
e8bb11f
Compare
kuudori
force-pushed
the
chore/replace-bingo-with-go-tool-directives
branch
from
July 13, 2026 18:55
e8bb11f to
453e076
Compare
kuudori
force-pushed
the
chore/replace-bingo-with-go-tool-directives
branch
from
July 14, 2026 01:52
453e076 to
ed1e8ab
Compare
kuudori
force-pushed
the
chore/replace-bingo-with-go-tool-directives
branch
2 times, most recently
from
July 14, 2026 02:52
4fdcd15 to
9b30f80
Compare
kuudori
changed the title
kuudori
force-pushed
the
chore/replace-bingo-with-go-tool-directives
branch
from
July 20, 2026 16:53
9b30f80 to
7d073ee
Compare
kuudori
marked this pull request as ready for review
July 20, 2026 16:53
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 10: Restore the github.com/openshift-hyperfleet/hyperfleet-api-spec
dependency in go.mod to v1.0.26; do not retain the downgrade to v1.0.25, and
preserve the schema version used by hack/tools.go and Makefile for generating
openapi/openapi.yaml.
In `@Makefile`:
- Around line 295-296: Update the Makefile tools target to run from the tools
module context by changing into tools, disabling workspace resolution with
GOWORK=off, and invoking $(GO) install tool there. Preserve the target’s
existing purpose of installing the pinned tool versions from tools/go.mod.
In `@tools/go.mod`:
- Around line 8-9: Update the require entries in tools/go.mod for
github.com/oapi-codegen/oapi-codegen/v2 and github.com/yannh/kubeconform to pin
versions v2.5.1 and v0.7.0 respectively, while preserving the existing tool
directives.
- Line 235: Upgrade the vulnerable tool dependencies in tools/go.mod: change
golang.org/x/crypto to v0.44.0 or later and helm.sh/helm/v3 to v3.17.3 or later,
preserving the existing module declarations and updating related checksums or
dependency metadata as needed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 92b0109b-3e18-479e-8222-cce90bfcbbb8
⛔ Files ignored due to path filters (6)
.bingo/golangci-lint.sumis excluded by!**/*.sum.bingo/helm-docs.sumis excluded by!**/*.sum.bingo/kubeconform.sumis excluded by!**/*.sum.bingo/oapi-codegen.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sum,!**/go.sumtools/go.sumis excluded by!**/*.sum,!**/go.sum
📒 Files selected for processing (12)
.bingo/.gitignore.bingo/README.md.bingo/Variables.mk.bingo/go.mod.bingo/golangci-lint.mod.bingo/helm-docs.mod.bingo/kubeconform.mod.bingo/oapi-codegen.mod.bingo/variables.envMakefilego.modtools/go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual) → reviewed against branchchore/replace-bingo-with-go-tool-directivesinstead of the default branchopenshift-hyperfleet/hyperfleet-broker(manual) → reviewed against open PR#26chore/replace-bingo-with-go-tool-directivesinstead of the default branch
💤 Files with no reviewable changes (9)
- .bingo/helm-docs.mod
- .bingo/variables.env
- .bingo/README.md
- .bingo/.gitignore
- .bingo/kubeconform.mod
- .bingo/Variables.mk
- .bingo/golangci-lint.mod
- .bingo/go.mod
- .bingo/oapi-codegen.mod
kuudori
force-pushed
the
chore/replace-bingo-with-go-tool-directives
branch
2 times, most recently
from
July 20, 2026 18:38
1626627 to
26c2269
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Makefile`:
- Around line 163-164: Update the verify-tools target to compare tools/go.mod
and tools/go.sum against HEAD, including staged and committed-state differences
and failing when either module file is missing or untracked. Preserve the
existing failure message and exit behavior while replacing the working-tree-only
git diff check.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2796f71c-b6ab-4c03-835a-c6a0ed85deee
⛔ Files ignored due to path filters (6)
.bingo/golangci-lint.sumis excluded by!**/*.sum.bingo/helm-docs.sumis excluded by!**/*.sum.bingo/kubeconform.sumis excluded by!**/*.sum.bingo/oapi-codegen.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sum,!**/go.sumtools/go.sumis excluded by!**/*.sum,!**/go.sum
📒 Files selected for processing (12)
.bingo/.gitignore.bingo/README.md.bingo/Variables.mk.bingo/go.mod.bingo/golangci-lint.mod.bingo/helm-docs.mod.bingo/kubeconform.mod.bingo/oapi-codegen.mod.bingo/variables.envMakefilego.modtools/go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual) → reviewed against branchchore/replace-bingo-with-go-tool-directivesinstead of the default branchopenshift-hyperfleet/hyperfleet-broker(manual) → reviewed against open PR#26chore/replace-bingo-with-go-tool-directivesinstead of the default branch
💤 Files with no reviewable changes (9)
- .bingo/golangci-lint.mod
- .bingo/.gitignore
- .bingo/oapi-codegen.mod
- .bingo/README.md
- .bingo/kubeconform.mod
- .bingo/helm-docs.mod
- .bingo/Variables.mk
- .bingo/go.mod
- .bingo/variables.env
🚧 Files skipped from review as they are similar to previous changes (1)
- go.mod
kuudori
force-pushed
the
chore/replace-bingo-with-go-tool-directives
branch
from
July 20, 2026 18:54
26c2269 to
5d5e51d
Compare
- Quote Make variables in gotool and tool recipes (CWE-78) - Add GOWORK=off to gotool definition - Compare tool files against HEAD in verify-tools - Upgrade golang.org/x/crypto v0.43.0 -> v0.54.0 (CVE fix) - Upgrade helm.sh/helm/v3 v3.15.2 -> v3.21.3 (CVE fix)
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Makefile`:
- Line 245: Replace the hardcoded user:pass credentials in the
broker.rabbitmq.url value on the kubeconform command with a credential-free AMQP
test URI, preserving the existing RabbitMQ host, port, and vhost used for
validation.
- Line 60: Harden the Makefile recipes against shell injection from GO and
HELM_CHART_DIR overrides. Quote these variable expansions wherever used,
including the OpenAPI command substitution and all Helm-docs recipes around the
referenced lines, and validate that each value is an expected executable or
directory path before execution.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: c9a387fc-5732-498d-bd88-57837675b614
⛔ Files ignored due to path filters (6)
.bingo/golangci-lint.sumis excluded by!**/*.sum.bingo/helm-docs.sumis excluded by!**/*.sum.bingo/kubeconform.sumis excluded by!**/*.sum.bingo/oapi-codegen.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sum,!**/go.sumtools/go.sumis excluded by!**/*.sum,!**/go.sum
📒 Files selected for processing (13)
.bingo/.gitignore.bingo/README.md.bingo/Variables.mk.bingo/go.mod.bingo/golangci-lint.mod.bingo/helm-docs.mod.bingo/kubeconform.mod.bingo/oapi-codegen.mod.bingo/variables.envAGENTS.mdMakefilego.modtools/go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual) → reviewed against branchchore/replace-bingo-with-go-tool-directivesinstead of the default branchopenshift-hyperfleet/hyperfleet-broker(manual) → reviewed against open PR#26chore/replace-bingo-with-go-tool-directivesinstead of the default branch
💤 Files with no reviewable changes (9)
- .bingo/go.mod
- .bingo/kubeconform.mod
- .bingo/variables.env
- .bingo/.gitignore
- .bingo/golangci-lint.mod
- .bingo/helm-docs.mod
- .bingo/oapi-codegen.mod
- .bingo/README.md
- .bingo/Variables.mk
🚧 Files skipped from review as they are similar to previous changes (2)
- tools/go.mod
- go.mod
kuudori
force-pushed
the
chore/replace-bingo-with-go-tool-directives
branch
from
July 20, 2026 20:36
970da34 to
0d6ffad
Compare
kuudori
force-pushed
the
chore/replace-bingo-with-go-tool-directives
branch
from
July 20, 2026 21:06
0d6ffad to
e0c8c1c
Compare
Contributor
|
/lgtm |
Contributor
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rh-amarin The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
merged commit Jul 21, 2026
043306f
into
openshift-hyperfleet:main
10 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
HYPERFLEET-1336
Replace Bingo / standalone
go installwith a singletools/go.modusing Go 1.24+ tool directives.Tools are pinned in
tools/go.modand invoked via$(call gotool,<name>)in the Makefile.Tools:
Also adds
tidy-toolsandverify-toolsMake targets.Follow-up changes (review comment fixes)
$(GO)and$(TOOL_MOD)in Makefilegotooland tool recipes to prevent shell injection (CWE-78)verify-toolsnow compares againstHEAD(git diff HEAD --) instead of the working treegolang.org/x/cryptov0.54.0,helm.sh/helm/v3v3.21.3