CNTRPLANE-3226: kms: bump library-go to get KMS plugin security context#916
CNTRPLANE-3226: kms: bump library-go to get KMS plugin security context#916bertinatto wants to merge 1 commit into
Conversation
|
/test e2e-aws-operator-encryption-kms |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
WalkthroughBump the ChangesDependency version update
🎯 1 (Trivial) | ⏱️ ~2 minutes
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 137: Remove the personal-fork replace directive pointing library-go (the
line with "replace github.com/openshift/library-go =>
github.com/bertinatto/library-go ..."), restore the dependency to the official
module, and instead open a PR against github.com/openshift/library-go with your
required patches so the project can consume an upstream released version; after
that, update go.mod to reference the appropriate upstream released version (no
local replace), run automated CVE/OSV scanning (e.g., osv.dev) against the
chosen upstream version, and ensure any build/artifact provenance, attestation,
or signing requirements are satisfied before merging.
- Line 135: Update the repository documentation to justify the go.mod
replacement of github.com/onsi/ginkgo/v2 with
github.com/openshift/onsi-ginkgo/v2 (the replace line in go.mod); state what
functional/behavioral changes or bugfixes in the OpenShift fork are required
(cite specific commits, features, or incompatibilities vs upstream ginkgo that
our code depends on), and indicate whether this override is temporary or
permanent plus the plan and timeline to upstream the changes and revert the
replace (or reasons for keeping it permanently). Reference the exact replace
directive and both module names (github.com/onsi/ginkgo/v2 and
github.com/openshift/onsi-ginkgo/v2) so reviewers can locate the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 34e8750e-90ab-47d8-8481-982557740f0c
⛔ Files ignored due to path filters (9)
go.sumis excluded by!**/*.sumvendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/key_controller.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/encryptiondata/secret.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/pluginlifecycle/sidecar.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/pluginlifecycle/vault.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/test/library/encryption/helpers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/test/library/encryption/kms/vault.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/test/library/encryption/scenarios.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (1)
go.mod
| sigs.k8s.io/yaml v1.6.0 // indirect | ||
| ) | ||
|
|
||
| replace github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check for CVEs affecting the ginkgo fork version
# Query GitHub security advisories for ginkgo
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "github.com/onsi/ginkgo/v2") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
# Also check the OpenShift fork
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "github.com/openshift/onsi-ginkgo/v2") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: openshift/cluster-authentication-operator
Length of output: 421
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ver="v2.6.1-0.20251001123353-fd5b1fb35db1"
for pkg in "github.com/onsi/ginkgo/v2" "github.com/openshift/onsi-ginkgo/v2"; do
curl -s https://api.osv.dev/v1/query \
-H 'content-type: application/json' \
-d "{\"package\":{\"name\":\"$pkg\"},\"version\":\"$ver\"}"
echo
doneRepository: openshift/cluster-authentication-operator
Length of output: 91
Justify the OpenShift Ginkgo fork in go.mod
For go.mod’s replace github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1, OSV reports no vulnerabilities for that pinned pseudo-version for both github.com/onsi/ginkgo/v2 and github.com/openshift/onsi-ginkgo/v2.
Please still document:
- Why the OpenShift
onsi-ginkgofork is required (what changes differ from upstream) - Whether the override is temporary or permanent, and the upstreaming/reversion plan if temporary
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 135, Update the repository documentation to justify the
go.mod replacement of github.com/onsi/ginkgo/v2 with
github.com/openshift/onsi-ginkgo/v2 (the replace line in go.mod); state what
functional/behavioral changes or bugfixes in the OpenShift fork are required
(cite specific commits, features, or incompatibilities vs upstream ginkgo that
our code depends on), and indicate whether this override is temporary or
permanent plus the plan and timeline to upstream the changes and revert the
replace (or reasons for keeping it permanently). Reference the exact replace
directive and both module names (github.com/onsi/ginkgo/v2 and
github.com/openshift/onsi-ginkgo/v2) so reviewers can locate the change.
Source: Coding guidelines
bertinatto
force-pushed
the
kms-plugins-lifecycle-restrict-sidecar
branch
from
2fd71ce to
df3d7b1
Compare
bertinatto
changed the title
|
@bertinatto: No Jira issue with key CNTRPLANE-3226 exists in the tracker at https://redhat.atlassian.net. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@bertinatto: No Jira issue with key CNTRPLANE-3226 exists in the tracker at https://redhat.atlassian.net. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
go.mod (1)
135-135: ⚡ Quick winDocument the OpenShift Ginkgo fork override (pre-existing, still applies).
The
replace github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1directive persists from earlier review feedback. If this override is still in use, please add a comment ingo.modor the project documentation explaining:
- Why the OpenShift fork is required (specific bug fixes, backports, or features not in upstream ginkgo).
- Whether the override is permanent or temporary, and if temporary, the plan/timeline to upstream changes and revert to upstream ginkgo.
This supports supply-chain transparency and future maintainability.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 135, Add a short explanatory comment next to the existing replace directive "replace github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1" (or in project docs) that states why the OpenShift fork is required (specific bug/PR/backport or feature) and whether this override is permanent or temporary; if temporary, include the plan/timeline and the criteria for reverting to upstream ginkgo so future maintainers can understand and remove the override when appropriate.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 17: Add a one-line rationale and migration plan for the pseudo-version
pin of github.com/openshift/library-go in the PR: insert a brief comment (e.g.,
// pinned to pseudo-version for testing KMS sidecar restrictions; will move to
upstream tag before main/prod) near the go.mod entry for
github.com/openshift/library-go and add a TODO in the repo docs or PR
description that commits the plan to update to a tagged upstream release; also
double-check there is no unintended replace directive for
github.com/openshift/library-go (no replace github.com/bertinatto/library-go)
and mention that check in the PR description.
---
Nitpick comments:
In `@go.mod`:
- Line 135: Add a short explanatory comment next to the existing replace
directive "replace github.com/onsi/ginkgo/v2 =>
github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1" (or in
project docs) that states why the OpenShift fork is required (specific
bug/PR/backport or feature) and whether this override is permanent or temporary;
if temporary, include the plan/timeline and the criteria for reverting to
upstream ginkgo so future maintainers can understand and remove the override
when appropriate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e6e0c5eb-8b60-4f5e-8a53-5bde3777da69
⛔ Files ignored due to path filters (5)
go.sumis excluded by!**/*.sumvendor/github.com/openshift/library-go/pkg/operator/encryption/kms/pluginlifecycle/reference_data_resolver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/pluginlifecycle/sidecar.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/pluginlifecycle/vault.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (1)
go.mod
| github.com/openshift/build-machinery-go v0.0.0-20251023084048-5d77c1a5e5af | ||
| github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a | ||
| github.com/openshift/library-go v0.0.0-20260612140105-3fa3bb604fd6 | ||
| github.com/openshift/library-go v0.0.0-20260612181855-acbfa3c5590f |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check CVEs for the bumped library-go pseudo-version
PSEUDO_VER="v0.0.0-20260612181855-acbfa3c5590f"
echo "=== Checking OSV advisories for github.com/openshift/library-go $PSEUDO_VER ==="
curl -s https://api.osv.dev/v1/query \
-H 'content-type: application/json' \
-d "{\"package\":{\"name\":\"github.com/openshift/library-go\"},\"version\":\"$PSEUDO_VER\"}"
echo
echo "=== Verifying no replace directive for bertinatto/library-go ==="
rg -n "replace\s+github\.com/openshift/library-go\s+=>\s+github\.com/bertinatto/library-go" go.mod || echo "✓ No bertinatto fork replace found"
echo
echo "=== Current library-go require line ==="
rg -n "github\.com/openshift/library-go\s+" go.mod | grep -v "^[[:space:]]*#" | head -1Repository: openshift/cluster-authentication-operator
Length of output: 403
Require rationale for github.com/openshift/library-go pseudo-version bump (go.mod:17)
go.modpinsgithub.com/openshift/library-gotov0.0.0-20260612181855-acbfa3c5590f; add PR-specific justification (e.g., “testing KMS sidecar restrictions”) and document a plan to move to a tagged upstream release before this reaches production/main.- osv.dev reports no advisories for this exact pseudo-version, and
go.modcontains noreplace github.com/openshift/library-go => github.com/bertinatto/library-go.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 17, Add a one-line rationale and migration plan for the
pseudo-version pin of github.com/openshift/library-go in the PR: insert a brief
comment (e.g., // pinned to pseudo-version for testing KMS sidecar restrictions;
will move to upstream tag before main/prod) near the go.mod entry for
github.com/openshift/library-go and add a TODO in the repo docs or PR
description that commits the plan to update to a tagged upstream release; also
double-check there is no unintended replace directive for
github.com/openshift/library-go (no replace github.com/bertinatto/library-go)
and mention that check in the PR description.
Source: Coding guidelines
|
@bertinatto: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary by CodeRabbit