Skip to content

NO-JIRA: Bump openshift/api and openshift/client-go #2319

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ardaguclu wants to merge 1 commit into from
Closed

NO-JIRA: Bump openshift/api and openshift/client-go #2319

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,9 @@ require (
github.com/onsi/gomega v1.38.2
github.com/opencontainers/go-digest v1.0.0
github.com/opencontainers/selinux v1.13.0
github.com/openshift/api v0.0.0-20260521125114-09730f85d883
github.com/openshift/api v0.0.0-20260618181827-d22a47a846dc

@coderabbitai coderabbitai Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Using master-branch pseudo-versions violates supply chain stability expectations.

Lines 21 and 23 pin github.com/openshift/api and github.com/openshift/client-go to recent master-branch pseudo-versions (both from 2026-06-18). These are unvetted pre-release commits, not stable releases. Per the coding guidelines, production dependencies must not use pre-release or yanked versions. Master branch is inherently unstable and lacks the stability guarantees of tagged releases.

Consider identifying a stable release version that includes the required KMS changes, or document why stable releases are unavailable and what testing/validation has been performed against these specific commits.

Also applies to: 23-23

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 21, The go.mod file pins github.com/openshift/api and
github.com/openshift/client-go to master-branch pseudo-versions
(v0.0.0-20260618181827-d22a47a846dc and similar), which are unvetted pre-release
commits that violate supply chain stability requirements. Replace these
master-branch pseudo-versions with actual stable release versions (e.g., vX.Y.Z
tags) that include the required KMS changes. If stable releases with the
necessary functionality are unavailable, document in a comment why these
specific pre-release commits are necessary and what validation has been
performed against them.

Source: Coding guidelines

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, find and read the go.mod file
fd -name go.mod -type f

Repository: openshift/library-go

Length of output: 295

🏁 Script executed:

# Also check the git history for recent changes to go.mod
git log --oneline -20 -- go.mod 2>/dev/null || echo "No git history available"

Repository: openshift/library-go

Length of output: 116

🏁 Script executed:

# Look for PR context or commit messages that mention KMS
git log --all --oneline --grep="KMS" 2>/dev/null | head -20 || echo "No matching commits"

Repository: openshift/library-go

Length of output: 1499

🏁 Script executed:

# Read the go.mod file to see the actual version pinning
cat go.mod

Repository: openshift/library-go

Length of output: 6826

🏁 Script executed:

# Get the commit details for the bump
git show a5c48f6f --stat

Repository: openshift/library-go

Length of output: 50377

🏁 Script executed:

# Get more details about the specific PR mentioned in the commit
git log a5c48f6f -1 --format=fuller

Repository: openshift/library-go

Length of output: 332

🏁 Script executed:

# Look for any PR references or upstream links in the recent git history
git log --all --format="%B" --grep="KMS\|openshift/api\|openshift/client-go" -i | head -100

Repository: openshift/library-go

Length of output: 3821

🏁 Script executed:

# Check if there are test files related to KMS in this repository
find . -type f -name "*kms*test*" -o -name "*test*kms*" | head -20

Repository: openshift/library-go

Length of output: 135

🏁 Script executed:

# Look for any evidence of testing these upgraded versions
rg -l "kms|KMS" test/ --type go | head -20

Repository: openshift/library-go

Length of output: 309

🏁 Script executed:

# Check the go.sum file for version information and verify if hashes match expected format
grep "github.com/openshift/api\|github.com/openshift/client-go" go.sum

Repository: openshift/library-go

Length of output: 522

🏁 Script executed:

# Check for CVE information for these specific commits
# First, let's look for any CHANGELOG or release notes references
git log --all --oneline --grep="changelog\|release\|CHANGELOG" -i | head -20

Repository: openshift/library-go

Length of output: 1339

🏁 Script executed:

# Search for licensing information in go.mod comments or documentation
head -50 go.mod | grep -A2 -B2 "license\|License\|LICENSE"

Repository: openshift/library-go

Length of output: 46

🏁 Script executed:

# Verify if there are actual test cases validating KMS functionality with these dependencies
grep -r "openshift/api\|openshift/client-go" test/library/encryption/ | head -20

Repository: openshift/library-go

Length of output: 706

🏁 Script executed:

# Check if there's any documentation about the specific commits being used
git show a5c48f6f:go.mod | grep -A2 -B2 "openshift"

Repository: openshift/library-go

Length of output: 469

🏁 Script executed:

# Check the commit dates to verify they're genuinely from the same time
git log -1 --format="%H %ai" a5c48f6f

Repository: openshift/library-go

Length of output: 131

🏁 Script executed:

# Look for any upstream repository references or KMS issue tracker information
git log a5c48f6f^..a5c48f6f --format="%B" | grep -i "fixes\|closes\|resolves\|#[0-9]\|openshift/"

Repository: openshift/library-go

Length of output: 264

🏁 Script executed:

# Check if there's a CHANGELOG or similar documenting the KMS changes
find . -type f \( -name "CHANGELOG*" -o -name "CHANGES*" -o -name "RELEASE*" \) | head -10

Repository: openshift/library-go

Length of output: 549

🏁 Script executed:

# Verify: are these versions pinned exactly or are they floating references?
cat go.mod | grep -A5 "require ("

Repository: openshift/library-go

Length of output: 621

🏁 Script executed:

# Let me verify the actual hashes are valid and check for any go.sum inconsistencies
wc -l go.sum && grep -c "github.com/openshift/api\|github.com/openshift/client-go" go.sum

Repository: openshift/library-go

Length of output: 77

🏁 Script executed:

# Check if there's any PR description or context we can access
git log --oneline -30 | grep -i "kms\|api\|client"

Repository: openshift/library-go

Length of output: 116

🏁 Script executed:

# Verify the pseudo-versions follow Go module conventions (v0.0.0-YYYYMMDDHHMMSS-COMMITHASH)
echo "openshift/api pseudo-version: v0.0.0-20260618181827-d22a47a846dc"
echo "openshift/client-go pseudo-version: v0.0.0-20260618131434-17fd91ed6167"
echo "Format check: YYYYMMDD matches commit dates"

Repository: openshift/library-go

Length of output: 244

🏁 Script executed:

# Let me check if there are actual integration/e2e tests that would validate KMS functionality
grep -r "kms\|KMS" test/e2e-encryption/encryption_test.go | head -20

Repository: openshift/library-go

Length of output: 1468

🏁 Script executed:

# Check what scenarios are being tested with these dependencies
grep -r "scenario\|Scenario" test/library/encryption/scenarios.go | head -15

Repository: openshift/library-go

Length of output: 1654

🏁 Script executed:

# Verify licensing is documented anywhere in the dependencies
grep -i "license\|COPYING" go.mod

Repository: openshift/library-go

Length of output: 46

🏁 Script executed:

# Check if there are specific test cases that validate the new API/client-go versions work together
grep -r "TestKMS\|TestEncryptionType" test/e2e-encryption/encryption_test.go | head -10

Repository: openshift/library-go

Length of output: 46

🏁 Script executed:

# Look for any references to upstream issues/PRs that might explain the KMS changes
git log --all --format="%B" | grep -i "CNTRLPLANE\|openshift/api\|openshift/client-go" | head -30

Repository: openshift/library-go

Length of output: 2092

🏁 Script executed:

# Verify that the two dependencies are truly compatible versions (not from different release cycles)
git log --oneline --all | grep -E "Bump|api|client-go" | head -15

Repository: openshift/library-go

Length of output: 957

Provide justification and evidence for bumping to master-branch commits.

The pseudo-versions (v0.0.0-20260618181827-d22a47a846dc and v0.0.0-20260618131434-17fd91ed6167) indicate unreleased commits from upstream master branches. While the codebase contains extensive KMS-related functionality and integration tests (test/e2e-encryption/encryption_test.go includes KMS verification), the commit message "Bump openshift/api and openshift/client-go" provides no:

  • Link to upstream PRs or CNTRLPLANE tracking issues documenting these specific commits
  • Changelog summary of breaking or significant changes
  • Justification for why released versions cannot be used

Per supply chain security guidelines, non-release versions require explicit justification. Please provide:

  1. Links to upstream issues/PRs corresponding to the commits (likely CNTRLPLANE-* tickets based on your KMS work history)
  2. Summary of API changes in these commits requiring coordinated updates
  3. Reference to which tests validate compatibility between these two versions
Related commits in history 
27cc62d1 Bump openshift/api and openshift/client-go
76149153 Update openshift/api and openshift/client-go for KMS
c3797459 Update openshift/api and openshift/client-go for KMS
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 21, The dependency bump for openshift/api to a master-branch
pseudo-version (v0.0.0-20260618181827-d22a47a846dc) in go.mod lacks required
justification and supply chain security documentation. Either revert the
openshift/api dependency to the latest released stable version if the unreleased
commit is not essential, or if the master-branch version is necessary, document
the justification by adding a detailed commit message or PR description that
includes links to upstream CNTRLPLANE tracking issues or PRs corresponding to
this specific commit, a summary of the API changes that necessitate this
unreleased version, and references to the encryption-related tests (such as
those in test/e2e-encryption/encryption_test.go) that validate compatibility
between the openshift/api and openshift/client-go versions being used.

github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee
github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a
github.com/openshift/client-go v0.0.0-20260618131434-17fd91ed6167
github.com/pkg/errors v0.9.1
github.com/pkg/profile v1.7.0
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.74.0
Expand Down
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,12 +225,12 @@ github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrB
github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
github.com/opencontainers/selinux v1.13.0 h1:Zza88GWezyT7RLql12URvoxsbLfjFx988+LGaWfbL84=
github.com/opencontainers/selinux v1.13.0/go.mod h1:XxWTed+A/s5NNq4GmYScVy+9jzXhGBVEOAyucdRUY8s=
github.com/openshift/api v0.0.0-20260521125114-09730f85d883 h1:So9yxVJRY+F1aVBjcDw6N3M4h30wyH/GpkazK8xT4TI=
github.com/openshift/api v0.0.0-20260521125114-09730f85d883/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
github.com/openshift/api v0.0.0-20260618181827-d22a47a846dc h1:PpMpzCIXk/oIwu+ZnL4Kzuz8xP8yCX23NJQLwABLxv8=
github.com/openshift/api v0.0.0-20260618181827-d22a47a846dc/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee h1:+Sp5GGnjHDhT/a/nQ1xdp43UscBMr7G5wxsYotyhzJ4=
github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE=
github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a h1:EKx2XhOKehd1C5ptY7IrLl4WV35E8kP0pRPnG5BUZXk=
github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a/go.mod h1:V933kvY/cb/Un7UCEOhXHUySNX327u7Epe8g9KNqg2Q=
github.com/openshift/client-go v0.0.0-20260618131434-17fd91ed6167 h1:TfqgEkvjjdzmVW3wkXWjh65rF+cjahnrBMbRdraT4Wo=
github.com/openshift/client-go v0.0.0-20260618131434-17fd91ed6167/go.mod h1:SYV1Wn6Pd27K9olD4WbUtjn4RWU83b9UjG1rbaQsTRE=
github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
Expand Down
2 changes: 1 addition & 1 deletion vendor/github.com/openshift/api/.ci-operator.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions vendor/github.com/openshift/api/Dockerfile.ocp
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

21 changes: 21 additions & 0 deletions vendor/github.com/openshift/api/Makefile
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

385 changes: 384 additions & 1 deletion vendor/github.com/openshift/api/config/v1/types_authentication.go
View file
Open in desktop

Large diffs are not rendered by default.

122 changes: 111 additions & 11 deletions vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading