chore(deps): consolidate open version bumps#696
Merged
Conversation
Bump sigs.k8s.io/gateway-api from v1.5.1 to v1.6.1 across all five workspace modules and github.com/gophercloud/gophercloud/v2 from v2.11.1 to v2.13.0 in the keystone operator, keeping the shared transitive set (go-openapi/swag, fxamacker/cbor, k8s.io/kube-openapi) in lockstep. Both bumps are source-compatible: controller-gen output is unchanged and the gophercloud identity/v3/federation package -- the only gophercloud API the keystone operator consumes besides the root package -- is byte-identical between v2.11.1 and v2.13.0. The individual Renovate branches left stale go.sum entries behind, which made verify-codegen fail on a dirty tree after module loading rewrote them. Running `go mod tidy` per module plus `go work sync` resolves that. cert-manager v1.21.0 is deliberately NOT part of this bump: it drops the deprecated cmmeta.ObjectReference alias, which mariadb-operator v0.38.1 (the latest release) still references, so the workspace no longer compiles. That bump stays blocked on a mariadb-operator release. On-behalf-of: @SAP Assisted-by: Claude:claude-opus-4-8[1m] Signed-off-by: Christian Berendt <berendt@23technologies.cloud>
Bump the pinned E2E test tooling in hack/install-test-deps.sh and replace the per-platform SHA256 constants alongside the versions. The version constants alone are not enough: verify_sha256 compares every download against a pinned hash, so bumping FLUX_VERSION and KUBECTL_VERSION without the matching digests aborts the installer on a checksum mismatch -- which is what took chainsaw-lint and e2e-infra down, since both jobs install their tooling through this script. All eight digests were taken from the upstream release artifacts and independently re-hashed after download; the darwin/arm64 pair is additionally verified end-to-end by running the installer. The optional-flux test stubs pre-populate binaries whose reported version must match the pins for the "already installed" short-circuit to fire, so their hardcoded versions move too, as does the pinned tooling table in the e2e-deployment reference. On-behalf-of: @SAP Assisted-by: Claude:claude-opus-4-8[1m] Signed-off-by: Christian Berendt <berendt@23technologies.cloud>
Bump FLUX_OPERATOR_VERSION in hack/deploy-infra.sh and move the flux-web ResourceSet chart pin from the 0.54.x to the 0.55.x SemVer range. The two are documented as a bump-together pair: the kind-only Web UI addon installs the flux-operator Helm chart, whose version track follows the operator release applied before the FluxInstance CR. The kind_base_flux_web_test assertions encode that coupling literally, which is why the version-only Renovate branch failed test-shell. On-behalf-of: @SAP Assisted-by: Claude:claude-opus-4-8[1m] Signed-off-by: Christian Berendt <berendt@23technologies.cloud>
Bump all ten actions/setup-go pins in ci.yaml from v6 to v7 and the actions/attest digest in the supply-chain-attest composite action. Both are digest-pinned action bumps with no workflow-level changes. The image-build failures on the attest branch were Docker Hub 502s pulling moby/buildkit, unrelated to the digest. On-behalf-of: @SAP Assisted-by: Claude:claude-opus-4-8[1m] Signed-off-by: Christian Berendt <berendt@23technologies.cloud>
Lock-file maintenance for the nixos-unstable nixpkgs input. On-behalf-of: @SAP Assisted-by: Claude:claude-opus-4-8[1m] Signed-off-by: Christian Berendt <berendt@23technologies.cloud>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the open Renovate version bumps into a single PR, including the
follow-up changes each bump needs to actually go green. The K-ORC bump is
deliberately left out.
Included
actions/attestdigest →f7c74d2flux-operatorv0.54.1 → v0.55.0actions/setup-gov6 → v7 (10 pins)gophercloud/v2v2.11.1 → v2.13.0gateway-apiv1.5.1 → v1.6.1Not included
#526 — cert-manager v1.21.0 stays blocked. v1.21.0 removes the deprecated
cmmeta.ObjectReferencealias forIssuerReference.mariadb-operatorv0.38.1 — the latest release — still references it, so the workspace stops
compiling:
There is no newer mariadb-operator to upgrade to, so this needs an upstream
release first. Everything else here is independent of it.
What the version-only branches were missing
Each of these is why the corresponding Renovate branch was red:
go.sumentries, so module loadingrewrote them during
make manifestsandverify-codegenfailed on a dirtytree. Fixed by
go mod tidyper module plusgo work sync. controller-genoutput itself is unchanged.
pinned per-platform SHA256 constants, so
verify_sha256aborted theinstaller on a checksum mismatch. That took down
chainsaw-lintande2e-infra, both of which install their tooling through this script. Alleight digests were re-hashed from the upstream artifacts; darwin/arm64 is
additionally verified end-to-end by running the installer. The
optional-flux test stubs and the pinned-tooling reference table carry the
versions literally and move with them.
deploy/kind/base/flux-web.yamlpins the Helm chart tothe operator's minor track (
0.54.x→0.55.x), andkind_base_flux_web_test.shasserts that coupling literally. Version-onlybump ⇒
test-shellred.Failures that were not the bumps
e2e-operator (keystone)—keystone-oidc-federationfailed on an8-day-old branch.
identity/v3/federationis byte-identical betweenv2.11.1 and v2.13.0, and the only change in the root package is the
DefaultUserAgentstring, so the bump cannot be the cause.moby/buildkit.e2e-chaos— unrelated to a toolchain-setup action bump.Verification
make build,make test,make lint(0 issues × 5 modules),make shellcheck,make verify-crd-syncandmake test-shellall run locally.test-shellhas aset of failures that reproduce identically on
mainon macOS; the failure setswere diffed against a
mainworktree and are byte-identical, so nothing hereregresses.
Noted, not changed
GATEWAY_API_VERSIONinhack/deploy-infra.shis stillv1.1.0while the Gomodule is now v1.6.1, despite the comment asking to keep them aligned. That
drift predates this PR (it was already 4 minor versions behind at v1.5.1).
Bumping the CRD bundle installed into kind is a real infrastructure change that
also needs the
gwapi_crdspresence list re-checked, so it belongs in its ownPR.