Update google.golang.org/genproto/googleapis/api digest to f61a6ca - #1230
red-hat-konflux[bot] wants to merge 1 commit into
Conversation
red-hat-konflux
Bot
added
approved
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
1 similar comment
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @red-hat-konflux[bot]. Thanks for your PR. I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift-online/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review. WalkthroughThe pull request updates the indirect ChangesGo module version update
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: Merge Risk: ⚪ Minimal · up to This PR updates an indirect Go dependency digest without introducing a documented product or runtime behavior risk; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) Full details: No-Weak-CryptoExplanation PASS: The PR changes only Full details: Container-PrivilegesExplanation PASS. The pull request changes only Full details: No-Sensitive-Data-In-LogsExplanation PASS. The pull request changes only dependency metadata in Full details: No-Hardcoded-SecretsExplanation PASS. The commit changes only indirect Full details: Ai-AttributionExplanation PASS. The pull request contains one dependency-update commit. Its message mentions no AI tool and has only a Signed-off-by trailer. The authored PR description also contains no AI-tool mention, no Co-Authored-By trailer, and no missing Red Hat AI attribution is therefore triggered. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 149-150: Update the release workflow around the binary and SHA256
artifact publishing steps to generate and attach provenance attestations, and
sign release artifacts with Sigstore/cosign. Ensure the CycloneDX SBOM is
included in the attested or signed release outputs, and retain the indirect
genproto RPC dependency only when the regenerated module graph requires it.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e2ea97f4-d0a7-463b-b6cd-2369a7bea61c
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260729162451-8efbd57d26e0 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
versions=(
"google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d"
"google.golang.org/genproto/googleapis/rpc v0.0.0-20260729162451-8efbd57d26e0"
)
for entry in "${versions[@]}"; do
read -r module version <<< "$entry"
jq -n \
--arg name "$module" \
--arg version "$version" \
'{package:{name:$name,ecosystem:"Go"},version:$version}' |
curl -fsS -X POST \
-H 'Content-Type: application/json' \
--data-binary `@-` \
https://api.osv.dev/v1/query |
jq --arg module "$module" --arg version "$version" \
'{module:$module,version:$version,vulnerabilities:(.vulns // [])}'
done
rg -n -i 'sbom|spdx|cyclonedx|provenance|attest|slsa|cosign|sigstore' \
--glob '!vendor/**' --glob '!go.sum' .Repository: openshift-online/ocm-cli
Length of output: 501
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- go.mod context ---'
sed -n '135,160p' go.mod
printf '%s\n' '--- matching go.sum records ---'
rg -n '^google\.golang\.org/genproto/(googleapis/(api|rpc)) v0\.0\.0-(20260803160001-6ac0973c030d|20260729162451-8efbd57d26e0)( |/go\.mod )' go.sum
printf '%s\n' '--- references and module graph declarations ---'
rg -n 'google\.golang\.org/genproto|genproto/googleapis/(api|rpc)' --glob '!go.sum' --glob '!vendor/**' .
printf '%s\n' '--- build and release supply-chain controls ---'
rg -n -i 'sbom|spdx|cyclonedx|provenance|attest|slsa|cosign|sigstore|ghcr|release' \
--glob '!vendor/**' --glob '!go.sum' \
.github hack Makefile* 2>/dev/null || true
printf '%s\n' '--- tracked workflow and build files ---'
git ls-files '.github/**' 'hack/**' 'Makefile*' '*Dockerfile*' | head -200Repository: openshift-online/ocm-cli
Length of output: 5432
🌐 Web query:
Find the upstream license files and license identifiers for google.golang.org/genproto/googleapis/api and google.golang.org/genproto/googleapis/rpc at commits 6ac0973c030d and 8efbd57d26e0, and determine whether the modules are Apache-2.0 licensed.
💡 Result:
The modules google.golang.org/genproto/googleapis/api and google.golang.org/genproto/googleapis/rpc are licensed under the Apache License, Version 2.0 [1][2][3]. The license information for these modules is maintained in the upstream repository, googleapis/go-genproto [2][4]. The project includes a LICENSE file at the root of the repository [1], and the source files within the module typically contain a header indicating that they are licensed under the Apache License, Version 2.0 [5]. The license identifier used for these modules is Apache-2.0 [4][6][3]. For the specified commits (6ac0973c030d and 8efbd57d26e0), the modules are governed by the Apache-2.0 license, consistent with the overall licensing of the googleapis/go-genproto repository [2][4][3].
Citations:
- 1: https://github.com/googleapis/go-genproto/blob/main/LICENSE
- 2: https://github.com/googleapis/go-genproto
- 3: https://guide.sonatype.com/component/golang/google.golang.org%2Fgenproto%2Fgoogleapis%2Fapi/v0.0.0-20260729162451-8efbd57d26e0/versions
- 4: https://pkg.go.dev/google.golang.org/genproto/googleapis/api@v0.0.0-20260729162451-8efbd57d26e0
- 5: https://github.com/googleapis/go-genproto/blob/master/googleapis/rpc/status/status.pb.go
- 6: https://pkg.go.dev/google.golang.org/genproto@v0.0.0-20260729162451-8efbd57d26e0
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- release workflow ---'
cat -n .github/workflows/publish-release.yaml
printf '%s\n' '--- build scripts ---'
cat -n hack/build_hermetic_image.sh
cat -n hack/build_release_images.sh
cat -n Makefile
printf '%s\n' '--- module metadata from the Go proxy ---'
for module_version in \
'google.golang.org/genproto/googleapis/api/@v/v0.0.0-20260803160001-6ac0973c030d.info' \
'google.golang.org/genproto/googleapis/rpc/@v/v0.0.0-20260729162451-8efbd57d26e0.info'; do
printf '%s\n' "--- $module_version ---"
curl -fsS "https://proxy.golang.org/$module_version"
done
printf '%s\n' '--- upstream commit existence and license paths ---'
for sha in 6ac0973c030d 8efbd57d26e0; do
curl -fsS "https://api.github.com/repos/googleapis/go-genproto/commits/$sha" |
jq --arg sha "$sha" '{requested:$sha,commit:.sha,message:.commit.message}'
done
for path in LICENSE googleapis/api/LICENSE googleapis/rpc/LICENSE; do
status=$(curl -sS -o /dev/null -w '%{http_code}' "https://raw.githubusercontent.com/googleapis/go-genproto/6ac0973c030d/$path")
printf '%s %s\n' "6ac0973c030d/$path" "$status"
done
for path in LICENSE googleapis/api/LICENSE googleapis/rpc/LICENSE; do
status=$(curl -sS -o /dev/null -w '%{http_code}' "https://raw.githubusercontent.com/googleapis/go-genproto/8efbd57d26e0/$path")
printf '%s %s\n' "8efbd57d26e0/$path" "$status"
doneRepository: openshift-online/ocm-cli
Length of output: 14932
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- working-tree and last-commit scope ---'
git status --short
git diff --stat HEAD^ HEAD -- go.mod go.sum
git diff --unified=3 HEAD^ HEAD -- go.mod go.sum
printf '%s\n' '--- previous dependency declarations ---'
git show HEAD^:go.mod | sed -n '135,155p'
git show HEAD^:go.sum | rg -n 'google\.golang\.org/genproto/(googleapis/(api|rpc))' || true
printf '%s\n' '--- workflow controls, excluding comments ---'
rg -n -i 'sbom|spdx|cyclonedx|provenance|attest|slsa|cosign|sigstore|sign|upload-artifact|release' \
.github/workflows hack Makefile docker \
| rg -v '^[^:]+:[0-9]+:.*#' || trueRepository: openshift-online/ocm-cli
Length of output: 7086
Add provenance attestations and sign release artifacts.
Both pins have matching go.sum records, no OSV advisories, and Apache-2.0 licenses. The hermetic build requests a CycloneDX SBOM, but .github/workflows/publish-release.yaml publishes binaries and SHA256 files without provenance attestations or Sigstore/cosign signatures. Add both controls. Retain the indirect RPC update only if the regenerated module graph requires it.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 149 - 150, Update the release workflow around the binary
and SHA256 artifact publishing steps to generate and attach provenance
attestations, and sign release artifacts with Sigstore/cosign. Ensure the
CycloneDX SBOM is included in the attested or signed release outputs, and retain
the indirect genproto RPC dependency only when the regenerated module graph
requires it.
Source: Path instructions
openshift-ci
Bot
added
the
needs-rebase
e5c00d6 to
0c5ca22
Compare
red-hat-konflux
Bot
changed the title
|
New changes are detected. LGTM label has been removed. |
openshift-ci
Bot
removed
the
needs-rebase
0c5ca22 to
7b7e0e6
Compare
red-hat-konflux
Bot
changed the title
openshift-ci
Bot
added
the
needs-rebase
7b7e0e6 to
03bc868
Compare
openshift-ci
Bot
added
needs-rebase
03bc868 to
6543403
Compare
red-hat-konflux
Bot
changed the title
openshift-ci
Bot
added
needs-rebase
6543403 to
41c80d7
Compare
red-hat-konflux
Bot
changed the title
openshift-ci
Bot
removed
the
needs-rebase
41c80d7 to
7ffd18e
Compare
red-hat-konflux
Bot
changed the title
7ffd18e to
f7cb2f9
Compare
red-hat-konflux
Bot
changed the title
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
f7cb2f9 to
6a1cb3b
Compare
red-hat-konflux
Bot
changed the title
This PR contains the following updates:
8efbd57→f61a6caWarning
Some dependencies could not be looked up. Check the warning logs for more information.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.