Update google.golang.org/genproto/googleapis/api digest to 08b0e42 - #1230
Conversation
red-hat-konflux
Bot
added
approved
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
1 similar comment
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @red-hat-konflux[bot]. Thanks for your PR. I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
the
needs-ok-to-test
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift-online/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review. WalkthroughThe pull request updates indirect versions for the genproto API, genproto RPC, and protobuf modules in ChangesGo module version updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This dependency digest update does not introduce a concrete security, correctness, or availability issue. The existing release-signing follow-up remains separate, and no actionable merge-blocking risk remains after normal checks. Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) Full details: No-Weak-CryptoExplanation The pull request changes only go.mod and go.sum dependency metadata. The updated genproto API and RPC modules contain no weak-crypto references. The SHA1 use in protobuf v1.36.12 is an existing internal fuzz-corpus naming utility that is also present in v1.36.11, so the pull request does not introduce it. No changed code uses weak algorithms or non-constant-time secret comparisons. Full details: Container-PrivilegesExplanation PASS: The PR changes only go.mod and go.sum. The diff updates Go dependency versions and checksums; it adds no container or Kubernetes manifest. The changed patch contains none of privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings. Full details: No-Sensitive-Data-In-LogsExplanation PASS: The pull request changes only dependency metadata in go.mod and go.sum. The diff adds no source code, logging calls, or sensitive-data handling. Therefore, it does not introduce logging that may expose passwords, tokens, API keys, PII, session IDs, internal hostnames, or customer data. Full details: No-Hardcoded-SecretsExplanation The pull request changes only Full details: No-Injection-VectorsExplanation PASS. The pull request changes only Full details: Ai-AttributionExplanation No AI tool is mentioned in the authored PR description or in the PR commit. The only PR commit contains a Signed-off-by trailer from red-hat-konflux[bot], with no Assisted-by, Generated-by, or Co-Authored-By trailer. The conditional attribution requirement does not apply. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 149-150: Update the release workflow around the binary and SHA256
artifact publishing steps to generate and attach provenance attestations, and
sign release artifacts with Sigstore/cosign. Ensure the CycloneDX SBOM is
included in the attested or signed release outputs, and retain the indirect
genproto RPC dependency only when the regenerated module graph requires it.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e2ea97f4-d0a7-463b-b6cd-2369a7bea61c
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260729162451-8efbd57d26e0 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
versions=(
"google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d"
"google.golang.org/genproto/googleapis/rpc v0.0.0-20260729162451-8efbd57d26e0"
)
for entry in "${versions[@]}"; do
read -r module version <<< "$entry"
jq -n \
--arg name "$module" \
--arg version "$version" \
'{package:{name:$name,ecosystem:"Go"},version:$version}' |
curl -fsS -X POST \
-H 'Content-Type: application/json' \
--data-binary `@-` \
https://api.osv.dev/v1/query |
jq --arg module "$module" --arg version "$version" \
'{module:$module,version:$version,vulnerabilities:(.vulns // [])}'
done
rg -n -i 'sbom|spdx|cyclonedx|provenance|attest|slsa|cosign|sigstore' \
--glob '!vendor/**' --glob '!go.sum' .Repository: openshift-online/ocm-cli
Length of output: 501
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- go.mod context ---'
sed -n '135,160p' go.mod
printf '%s\n' '--- matching go.sum records ---'
rg -n '^google\.golang\.org/genproto/(googleapis/(api|rpc)) v0\.0\.0-(20260803160001-6ac0973c030d|20260729162451-8efbd57d26e0)( |/go\.mod )' go.sum
printf '%s\n' '--- references and module graph declarations ---'
rg -n 'google\.golang\.org/genproto|genproto/googleapis/(api|rpc)' --glob '!go.sum' --glob '!vendor/**' .
printf '%s\n' '--- build and release supply-chain controls ---'
rg -n -i 'sbom|spdx|cyclonedx|provenance|attest|slsa|cosign|sigstore|ghcr|release' \
--glob '!vendor/**' --glob '!go.sum' \
.github hack Makefile* 2>/dev/null || true
printf '%s\n' '--- tracked workflow and build files ---'
git ls-files '.github/**' 'hack/**' 'Makefile*' '*Dockerfile*' | head -200Repository: openshift-online/ocm-cli
Length of output: 5432
🌐 Web query:
Find the upstream license files and license identifiers for google.golang.org/genproto/googleapis/api and google.golang.org/genproto/googleapis/rpc at commits 6ac0973c030d and 8efbd57d26e0, and determine whether the modules are Apache-2.0 licensed.
💡 Result:
The modules google.golang.org/genproto/googleapis/api and google.golang.org/genproto/googleapis/rpc are licensed under the Apache License, Version 2.0 [1][2][3]. The license information for these modules is maintained in the upstream repository, googleapis/go-genproto [2][4]. The project includes a LICENSE file at the root of the repository [1], and the source files within the module typically contain a header indicating that they are licensed under the Apache License, Version 2.0 [5]. The license identifier used for these modules is Apache-2.0 [4][6][3]. For the specified commits (6ac0973c030d and 8efbd57d26e0), the modules are governed by the Apache-2.0 license, consistent with the overall licensing of the googleapis/go-genproto repository [2][4][3].
Citations:
- 1: https://github.com/googleapis/go-genproto/blob/main/LICENSE
- 2: https://github.com/googleapis/go-genproto
- 3: https://guide.sonatype.com/component/golang/google.golang.org%2Fgenproto%2Fgoogleapis%2Fapi/v0.0.0-20260729162451-8efbd57d26e0/versions
- 4: https://pkg.go.dev/google.golang.org/genproto/googleapis/api@v0.0.0-20260729162451-8efbd57d26e0
- 5: https://github.com/googleapis/go-genproto/blob/master/googleapis/rpc/status/status.pb.go
- 6: https://pkg.go.dev/google.golang.org/genproto@v0.0.0-20260729162451-8efbd57d26e0
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- release workflow ---'
cat -n .github/workflows/publish-release.yaml
printf '%s\n' '--- build scripts ---'
cat -n hack/build_hermetic_image.sh
cat -n hack/build_release_images.sh
cat -n Makefile
printf '%s\n' '--- module metadata from the Go proxy ---'
for module_version in \
'google.golang.org/genproto/googleapis/api/@v/v0.0.0-20260803160001-6ac0973c030d.info' \
'google.golang.org/genproto/googleapis/rpc/@v/v0.0.0-20260729162451-8efbd57d26e0.info'; do
printf '%s\n' "--- $module_version ---"
curl -fsS "https://proxy.golang.org/$module_version"
done
printf '%s\n' '--- upstream commit existence and license paths ---'
for sha in 6ac0973c030d 8efbd57d26e0; do
curl -fsS "https://api.github.com/repos/googleapis/go-genproto/commits/$sha" |
jq --arg sha "$sha" '{requested:$sha,commit:.sha,message:.commit.message}'
done
for path in LICENSE googleapis/api/LICENSE googleapis/rpc/LICENSE; do
status=$(curl -sS -o /dev/null -w '%{http_code}' "https://raw.githubusercontent.com/googleapis/go-genproto/6ac0973c030d/$path")
printf '%s %s\n' "6ac0973c030d/$path" "$status"
done
for path in LICENSE googleapis/api/LICENSE googleapis/rpc/LICENSE; do
status=$(curl -sS -o /dev/null -w '%{http_code}' "https://raw.githubusercontent.com/googleapis/go-genproto/8efbd57d26e0/$path")
printf '%s %s\n' "8efbd57d26e0/$path" "$status"
doneRepository: openshift-online/ocm-cli
Length of output: 14932
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- working-tree and last-commit scope ---'
git status --short
git diff --stat HEAD^ HEAD -- go.mod go.sum
git diff --unified=3 HEAD^ HEAD -- go.mod go.sum
printf '%s\n' '--- previous dependency declarations ---'
git show HEAD^:go.mod | sed -n '135,155p'
git show HEAD^:go.sum | rg -n 'google\.golang\.org/genproto/(googleapis/(api|rpc))' || true
printf '%s\n' '--- workflow controls, excluding comments ---'
rg -n -i 'sbom|spdx|cyclonedx|provenance|attest|slsa|cosign|sigstore|sign|upload-artifact|release' \
.github/workflows hack Makefile docker \
| rg -v '^[^:]+:[0-9]+:.*#' || trueRepository: openshift-online/ocm-cli
Length of output: 7086
Add provenance attestations and sign release artifacts.
Both pins have matching go.sum records, no OSV advisories, and Apache-2.0 licenses. The hermetic build requests a CycloneDX SBOM, but .github/workflows/publish-release.yaml publishes binaries and SHA256 files without provenance attestations or Sigstore/cosign signatures. Add both controls. Retain the indirect RPC update only if the regenerated module graph requires it.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 149 - 150, Update the release workflow around the binary
and SHA256 artifact publishing steps to generate and attach provenance
attestations, and sign release artifacts with Sigstore/cosign. Ensure the
CycloneDX SBOM is included in the attested or signed release outputs, and retain
the indirect genproto RPC dependency only when the regenerated module graph
requires it.
Source: Path instructions
openshift-ci
Bot
added
the
needs-rebase
e5c00d6 to
0c5ca22
Compare
red-hat-konflux
Bot
changed the title
|
New changes are detected. LGTM label has been removed. |
openshift-ci
Bot
removed
the
needs-rebase
0c5ca22 to
7b7e0e6
Compare
red-hat-konflux
Bot
changed the title
openshift-ci
Bot
added
the
needs-rebase
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
7b7e0e6 to
03bc868
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
the
needs-rebase
This PR contains the following updates:
8efbd57→08b0e42Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.
Summary by CodeRabbit