build: upgrade to Go 1.26.5 - #543
Conversation
also, update modules to get rid of known vulnerabilities also, convert `README.adoc` to `README.md` also, remove the `check-format` target and move the formatting logic into `go.mk` Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe pull request updates the repository to Go 1.26, changes module dependencies, adds a formatting target, updates the lint workflow, replaces the README, and removes the previous AsciiDoc README and formatting makefile. ChangesRepository maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
coderabbitai
Bot
added
chore
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 97-103: Update the golang.org/x/crypto dependency in go.mod from
v0.51.0 to v0.52.0 or later, then refresh the module checksums and dependency
metadata as needed while preserving the existing indirect dependency
declaration.
In `@make/go.mk`:
- Around line 10-15: Update the GOFORMAT_FILES and format-go-code flow so
discovered Go filenames are passed as literal arguments rather than expanded
shell syntax. Use a safe find -exec or NUL-delimited xargs pipeline while
preserving the existing gofmt flags and exclusion behavior.
In `@README.md`:
- Around line 7-8: Update the external repository links in the README
description to use absolute HTTPS URLs, including the host-operator,
member-operator, and toolchain-e2e links, while preserving their visible link
text and surrounding wording.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: c5c113d8-7d3e-41ac-87dc-0ae4c1cef276
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (7)
.govulncheck.yamlREADME.adocREADME.mdgo.modmake/format.mkmake/go.mkmake/gofmt_exclude
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
codeready-toolchain/api(manual)codeready-toolchain/toolchain-common(manual)codeready-toolchain/host-operator(manual)codeready-toolchain/toolchain-e2e(manual)
💤 Files with no reviewable changes (2)
- make/format.mk
- README.adoc
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Verify Dependencies
- GitHub Check: test
⚠️ CI failures not shown inline (2)
GitHub Actions: ci-build / GolangCI Lint: build: upgrade to Go 1.26.5
Conclusion: failure
##[group]run golangci-lint
Running [/home/runner/golangci-lint-2.1.6-linux-amd64/golangci-lint config path --config=./.golangci.yml] in [/home/runner/work/toolchain-common/toolchain-common] ...
Running [/home/runner/golangci-lint-2.1.6-linux-amd64/golangci-lint run --config=./.golangci.yml --verbose] in [/home/runner/work/toolchain-common/toolchain-common] ...
level=info msg="golangci-lint has version 2.1.6 built with go1.24.2 from eabc2638 on "
level=info msg="[config_reader] Used config file .golangci.yml"
level=info msg="[config_reader] Module name \"github.com/codeready-toolchain/toolchain-common\""
Error: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.26.5)
Failed executing command with error: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.26.5)
##[error]golangci-lint exit with code 3
GitHub Actions: ci-build / 0_GolangCI Lint.txt: build: upgrade to Go 1.26.5
Conclusion: failure
##[group]run golangci-lint
Running [/home/runner/golangci-lint-2.1.6-linux-amd64/golangci-lint config path --config=./.golangci.yml] in [/home/runner/work/toolchain-common/toolchain-common] ...
Running [/home/runner/golangci-lint-2.1.6-linux-amd64/golangci-lint run --config=./.golangci.yml --verbose] in [/home/runner/work/toolchain-common/toolchain-common] ...
level=info msg="golangci-lint has version 2.1.6 built with go1.24.2 from eabc2638 on "
level=info msg="[config_reader] Used config file .golangci.yml"
level=info msg="[config_reader] Module name \"github.com/codeready-toolchain/toolchain-common\""
Error: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.26.5)
Failed executing command with error: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.26.5)
##[error]golangci-lint exit with code 3
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
README.mdmake/gofmt_excludemake/go.mkgo.mod
🪛 GitHub Actions: ci-check-gomod / 0_go.mod replacements.txt
go.mod
[error] 1-1: Dependency replacement is not allowed for protected module 'github.com/codeready-toolchain/api'. Remove or update the replacement: github.com/codeready-toolchain/api => github.com/xcoulon/api.
🪛 GitHub Actions: ci-check-gomod / go.mod replacements
go.mod
[error] 1-1: CI check failed: go.mod contains a disallowed module replacement for protected module github.com/codeready-toolchain/api, replacing it with github.com/xcoulon/api. Command failed with exit code 1.
🪛 markdownlint-cli2 (0.23.2)
README.md
[warning] 12-12: Link text should be descriptive
(MD059, descriptive-link-text)
🪛 OSV Scanner (2.4.0)
go.mod
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
(GO-2026-5005)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(GO-2026-5006)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
(GO-2026-5013)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
(GO-2026-5014)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
(GO-2026-5015)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
(GO-2026-5016)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(GO-2026-5017)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
(GO-2026-5018)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(GO-2026-5019)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
(GO-2026-5020)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(GO-2026-5021)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(GO-2026-5023)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
(GO-2026-5033)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
(GO-2026-5932)
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking pathological inputs can lead to client panic
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto doesn't enforce invoking key constraints
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto vulnerable to infinite loop on large channel writes
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
[CRITICAL] 97-97: golang.org/x/crypto 0.51.0: golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
🔇 Additional comments (3)
go.mod (1)
3-5: LGTM!Also applies to: 28-29
make/gofmt_exclude (1)
1-1: LGTM!.govulncheck.yaml (1)
1-1: LGTM!
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
| sigs.k8s.io/controller-runtime v0.21.0 | ||
| ) | ||
|
|
||
| replace github.com/codeready-toolchain/api => github.com/xcoulon/api v0.0.0-20260805080027-7512d38caa3b |
There was a problem hiding this comment.
I think this is a leftover from your testing
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@make/go.mk`:
- Around line 13-16: Update the format-go-code target’s find expression to
exclude third_party, builtin, and examples in addition to vendor and .git,
matching the exclusions defined by the repository’s formatter configuration.
Preserve the existing gofmt invocation and batched execution.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: c3366c74-22f3-4771-8794-4c2f85234a62
📒 Files selected for processing (1)
make/go.mk
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
codeready-toolchain/api(manual) → reviewed against open PR#521upgrade-go-1.26-apiinstead of the default branchcodeready-toolchain/toolchain-common(manual)codeready-toolchain/host-operator(manual) → reviewed against open PR#1290upgrade-go-1.26-hostinstead of the default branchcodeready-toolchain/toolchain-e2e(manual) → reviewed against open PR#1313upgrade-go-1.26-e2einstead of the default branch
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: govulncheck
- GitHub Check: GolangCI Lint
- GitHub Check: Verify Dependencies
- GitHub Check: test
⚠️ CI failures not shown inline (2)
GitHub Actions: ci-check-gomod / go.mod replacements: build: upgrade to Go 1.26.5
Conclusion: failure
##[group]Run set -e
�[36;1mset -e�[0m
�[36;1mREGEX="("�[0m
�[36;1mfor m in $(IFS=,; echo $PROTECTED_MODULES); do�[0m
�[36;1m REGEX="${REGEX}${m}|"�[0m
�[36;1mdone�[0m
�[36;1mREGEX="${REGEX%?})"�[0m
�[36;1m�[0m
�[36;1mif go list -m all | grep --color=never -E "${REGEX}.*\s*=>"; then�[0m
�[36;1m echo "the above replacement(s) are not allowed in go.mod"�[0m
�[36;1m exit 1�[0m
�[36;1mfi�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
PROTECTED_MODULES: github.com/codeready-toolchain/,github.com/kubesaw/
##[endgroup]
go: downloading go1.26.5 (linux/amd64)
github.com/codeready-toolchain/api v0.0.0-20260731065234-734640c901d2 => github.com/xcoulon/api v0.0.0-20260805080027-7512d38caa3b
the above replacement(s) are not allowed in go.mod
##[error]Process completed with exit code 1.
GitHub Actions: ci-check-gomod / 0_go.mod replacements.txt: build: upgrade to Go 1.26.5
Conclusion: failure
##[group]Run set -e
�[36;1mset -e�[0m
�[36;1mREGEX="("�[0m
�[36;1mfor m in $(IFS=,; echo $PROTECTED_MODULES); do�[0m
�[36;1m REGEX="${REGEX}${m}|"�[0m
�[36;1mdone�[0m
�[36;1mREGEX="${REGEX%?})"�[0m
�[36;1m�[0m
�[36;1mif go list -m all | grep --color=never -E "${REGEX}.*\s*=>"; then�[0m
�[36;1m echo "the above replacement(s) are not allowed in go.mod"�[0m
�[36;1m exit 1�[0m
�[36;1mfi�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
PROTECTED_MODULES: github.com/codeready-toolchain/,github.com/kubesaw/
##[endgroup]
go: downloading go1.26.5 (linux/amd64)
github.com/codeready-toolchain/api v0.0.0-20260731065234-734640c901d2 => github.com/xcoulon/api v0.0.0-20260805080027-7512d38caa3b
the above replacement(s) are not allowed in go.mod
##[error]Process completed with exit code 1.
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
make/go.mk
🔀 Multi-repo context codeready-toolchain/host-operator, codeready-toolchain/toolchain-e2e
Linked repositories findings
- No downstream references to the removed
check-format/check-go-formattargets were found in the inspected repositories. host-operator(branchrefs/pull/1290/head) andtoolchain-e2e(branchrefs/pull/1313/head) already use Go 1.26.0/toolchain 1.26.5 and the coordinatedgithub.com/xcoulon/apireplacement. [::codeready-toolchain/host-operator::] [::codeready-toolchain/toolchain-e2e::]- Both downstream repositories continue importing
github.com/codeready-toolchain/api/api/v1alpha1, preserving the existing API import path. [::codeready-toolchain/host-operator::] [::codeready-toolchain/toolchain-e2e::]
| # The + tells find to batch multiple found files into a single gofmt invocation (like xargs), | ||
| # which is much faster than the alternative \;, which runs gofmt once per file. Removing it | ||
| # would be a syntax error — find -exec requires either + or \; as a terminator. | ||
| $(Q)find . -name '*.go' -not -path '*/vendor/*' -not -path '*/.git/*' -exec gofmt -s -l -w {} + |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Align the formatting scope with .golangci.yml.
format-go-code excludes only vendor and .git, but .golangci.yml:55-63 also excludes third_party, builtin, and examples. This target can rewrite files that the repository’s formatter contract intentionally excludes. Add matching find exclusions, or document why this target must use a broader scope.
As per path instructions, this review focuses on major maintainability and cross-file tooling risks.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@make/go.mk` around lines 13 - 16, Update the format-go-code target’s find
expression to exclude third_party, builtin, and examples in addition to vendor
and .git, matching the exclusions defined by the repository’s formatter
configuration. Preserve the existing gofmt invocation and batched execution.
Source: Path instructions
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
also, `remove check-go-format` make goal Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
|
3 participants
also, update modules to get rid of known vulnerabilities
also, convert
README.adoctoREADME.mdalso, remove the
check-formattarget and move the formatting logic intogo.mksee also:
Signed-off-by: Xavier Coulon xcoulon@redhat.com
Summary by CodeRabbit
Documentation
Developer Experience
Maintenance