From cef8a0def478936cec853ada445a1ac8176fd8cf Mon Sep 17 00:00:00 2001 From: Alex Rodriguez <131964409+ezekiel-alexrod@users.noreply.github.com> Date: Fri, 16 Oct 2026 16:26:12 +0200 Subject: [PATCH 1/2] chore(agent): bump golangci-lint to v2.14.0 v2.12.2 can't read Go 1.27 export data, so the lint job fails on the Go 1.27 bump. Renovate didn't track the linter here: the annotations let the platform-renovate custom managers pick up the Makefile and .custom-gcl.yml together. v2.14.0 raises one modernize finding on main, fixed with errors.AsType. Refs: MK8S-470 --- agent/.custom-gcl.yml | 3 ++- agent/Makefile | 3 ++- agent/internal/puller/puller_test.go | 3 +-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/agent/.custom-gcl.yml b/agent/.custom-gcl.yml index d9ae33b..c9f7c02 100644 --- a/agent/.custom-gcl.yml +++ b/agent/.custom-gcl.yml @@ -3,7 +3,8 @@ # with all the plugins listed below. # # See: https://golangci-lint.run/plugins/module-plugins/ -version: v2.12.2 +# renovate: datasource=github-releases depName=golangci/golangci-lint +version: v2.14.0 plugins: # logcheck validates structured logging calls and parameters (e.g., balanced key-value pairs) - module: "sigs.k8s.io/logtools" diff --git a/agent/Makefile b/agent/Makefile index 13ea8a7..53c9cae 100644 --- a/agent/Makefile +++ b/agent/Makefile @@ -219,7 +219,8 @@ ENVTEST_K8S_VERSION ?= $(shell v='$(call gomodver,k8s.io/api)'; \ [ -n "$$v" ] || { echo "Set ENVTEST_K8S_VERSION manually (k8s.io/api replace has no tag)" >&2; exit 1; }; \ printf '%s\n' "$$v" | sed -E 's/^v?[0-9]+\.([0-9]+).*/1.\1/') -GOLANGCI_LINT_VERSION ?= v2.12.2 +# renovate: datasource=github-releases depName=golangci/golangci-lint +GOLANGCI_LINT_VERSION ?= v2.14.0 # The kind release also pins the Kubernetes version of the e2e cluster, through # its default node image. # renovate: datasource=github-releases depName=kubernetes-sigs/kind diff --git a/agent/internal/puller/puller_test.go b/agent/internal/puller/puller_test.go index 6604481..70bf30d 100644 --- a/agent/internal/puller/puller_test.go +++ b/agent/internal/puller/puller_test.go @@ -1132,8 +1132,7 @@ func TestRemotePullRejectsARegistrySignedByAnUnknownCA(t *testing.T) { if !errors.Is(err, ErrPull) { t.Fatalf("err = %v, want ErrPull", err) } - var unknown x509.UnknownAuthorityError - if !errors.As(err, &unknown) { + if _, ok := errors.AsType[x509.UnknownAuthorityError](err); !ok { t.Errorf("err = %v, want an unknown authority", err) } } From e5c37cf9b20d988c03b441ed101ca2c8395c5f77 Mon Sep 17 00:00:00 2001 From: Alex Rodriguez <131964409+ezekiel-alexrod@users.noreply.github.com> Date: Mon, 19 Oct 2026 13:14:51 +0200 Subject: [PATCH 2/2] ci(agent): track kustomize and controller-gen, check generated files Renovate didn't see the kustomize and controller-gen versions in the Makefile. The annotations let the platform-renovate Makefile custom manager bump them. The test job regenerated the CRDs, RBAC and deepcopy code but never compared the result with what is committed, so a controller-gen bump or an edited API type could merge with stale files. The job now fails when make test leaves a diff. YEAR is fixed in the Makefile, or every generated header would change each January. Nothing ran kustomize in CI, so the job now builds config/default too. Refs: MK8S-470 --- .github/workflows/agent-ci.yaml | 14 ++++++++++++++ CONTRIBUTING.md | 4 ++-- agent/AGENTS.md | 4 ++-- agent/Makefile | 6 +++++- 4 files changed, 23 insertions(+), 5 deletions(-) diff --git a/.github/workflows/agent-ci.yaml b/.github/workflows/agent-ci.yaml index 10cc7f8..20e6d79 100644 --- a/.github/workflows/agent-ci.yaml +++ b/.github/workflows/agent-ci.yaml @@ -42,6 +42,20 @@ jobs: cache-dependency-path: agent/go.sum - name: Run tests run: make -C agent test + # `make test` first regenerates the CRDs, RBAC and deepcopy code, then + # runs `go fmt`. Whatever they change must be committed: an edited API + # type or RBAC marker, a controller-gen bump, or unformatted code. + - name: Check make test left the tree clean + if: ${{ !cancelled() }} + run: | + git diff + test -z "$(git status --porcelain)" || { git status --porcelain; exit 1; } + # Nothing else runs kustomize, so a kustomize bump would go untested. + - name: Build the manifests with kustomize + if: ${{ !cancelled() }} + run: | + make -C agent kustomize + agent/bin/kustomize build agent/config/default > /dev/null image: runs-on: ubuntu-latest diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b30b7a3..f0ed4b9 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -59,8 +59,8 @@ make -C rpm rpm EL=9 # build both RPMs into rpm/_build/ - **Generated code is committed.** After touching the API types or the RBAC markers, run `make -C agent manifests generate` and commit the result. CI - regenerates it before running the tests but does not fail on an uncommitted - diff, so a stale CRD reaches `main` unnoticed if you skip this. + regenerates it before running the tests, and fails if the result differs + from what is committed. A controller-gen bump needs the same step. - **Logging**: `logr` through controller-runtime, with the `logcheck` linter enforcing balanced key-value pairs. Log a value once, at the level that owns it: the reconciler logs outcomes, the packages it calls return errors. diff --git a/agent/AGENTS.md b/agent/AGENTS.md index 58377a3..a5c2390 100644 --- a/agent/AGENTS.md +++ b/agent/AGENTS.md @@ -44,8 +44,8 @@ Never hand-edit these; regenerate them instead: scaffolding They come from the markers in the Go sources, so change the marker, run -`make manifests generate`, and commit the result. Nothing in CI catches a stale -one; [../CONTRIBUTING.md](../CONTRIBUTING.md#agent-go) says why. +`make manifests generate`, and commit the result. CI fails on a stale one, see +[../CONTRIBUTING.md](../CONTRIBUTING.md#agent-go). Leave the `+kubebuilder:scaffold:*` comments alone. They are insertion points for the kubebuilder CLI, in `cmd/manager/main.go`, `internal/controller/suite_test.go` diff --git a/agent/Makefile b/agent/Makefile index 53c9cae..0600df1 100644 --- a/agent/Makefile +++ b/agent/Makefile @@ -1,7 +1,9 @@ # Image URL to use all building/pushing image targets IMG ?= controller:latest # YEAR defines the year value used for substituting the YEAR placeholder in the boilerplate header. -YEAR ?= $(shell date +%Y) +# Fixed to the year the project started: the current year would rewrite +# every generated header each January, and CI fails on a changed tree. +YEAR ?= 2026 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set) ifeq (,$(shell go env GOBIN)) @@ -206,7 +208,9 @@ ENVTEST ?= $(LOCALBIN)/setup-envtest GOLANGCI_LINT = $(LOCALBIN)/golangci-lint ## Tool Versions +# renovate: datasource=go depName=sigs.k8s.io/kustomize/kustomize/v5 KUSTOMIZE_VERSION ?= v5.8.1 +# renovate: datasource=go depName=sigs.k8s.io/controller-tools CONTROLLER_TOOLS_VERSION ?= v0.21.0 #ENVTEST_VERSION is the controller-runtime version to use for setup-envtest, derived from go.mod