WIP: OCPSTRAT-3036: Rebase 1.36.1 by jubittajohn · Pull Request #930 · openshift/cluster-kube-controller-manager-operator

jubittajohn · 2026-04-27T21:48:17Z

Summary by CodeRabbit

Chores
- Updated build and CI base images and runtime to the newer OpenShift 5.0 / Go 1.26 toolchain.
- Upgraded the project Go toolchain to 1.26 and refreshed direct and indirect dependencies for compatibility and security, including updated dependency pins and replace directives to aligned revisions.

openshift-ci-robot · 2026-04-27T21:48:21Z

@jubittajohn: This pull request references OCPSTRAT-3036 which is a valid jira issue.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-04-27T21:48:32Z

Walkthrough

Updates CI and Docker builder image tags from Go 1.25 / OpenShift 4.22 to Go 1.26 / OpenShift 5.0, and upgrades the module graph: go directive to 1.26.0, multiple direct and indirect dependency bumps, grpc/gateway middleware changes, and expanded replace directives in go.mod.

Changes

Build configuration

Layer / File(s)	Summary
Builder image tags `.ci-operator.yaml`, `Dockerfile.rhel7`	Replaced build root/builder and final runtime image tags: `rhel-9-release-golang-1.25-openshift-4.22` / `rhel-9-golang-1.25-openshift-4.22` / `ocp/4.22:base-rhel9-minimal` → `rhel-9-release-golang-1.26-openshift-5.0` / `rhel-9-golang-1.26-openshift-5.0` / `ocp/5.0:base-rhel9-minimal`.

Go module updates

Layer / File(s)	Summary
Go toolchain and direct dependencies `go.mod`	Updated `go` directive to 1.26.0 and bumped direct require versions (e.g., Gomega, OpenShift api/client-go, prometheus/common, cobra, protobuf, Kubernetes modules to v0.36.1).
gRPC/gateway and middleware `go.mod`	Added/updated grpc-ecosystem middleware modules (including prometheus provider) and bumped `grpc-gateway/v2` and related gRPC indirect deps.
Indirect dependency refresh `go.mod`	Refreshed many indirect dependencies: observability (OTel/etcd), Prometheus procfs, `golang.org/x/*`, gRPC/genproto, apiserver/konnectivity components, and switched backoff v4→v5.
Replace directives `go.mod`	Replaced single ginkgo override with a multi-entry `replace` block that pins `github.com/onsi/ginkgo/v2` to an OpenShift fork and redirects `github.com/openshift/api`, `github.com/openshift/client-go`, and `github.com/openshift/library-go` to `github.com/jubittajohn/*` at specified revisions.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 4 warnings)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	Dockerfile.rhel7 (lines 7-8) lacks USER directive, causing container to run as root (UID 0). Also, pod.yaml uses hostNetwork: true, enabling network privilege escalation.	Add USER directive (e.g., USER 1001) to Dockerfile.rhel7 after line 7 to enforce non-root execution and reduce privilege escalation risk.
Test Structure And Quality	⚠️ Warning	Ginkgo tests lack proper timeouts on cluster operations (Create/Get/Delete), missing BeforeEach/AfterEach patterns, inadequate assertion messages, and multiple unrelated behaviors per test.	Add explicit timeouts to all cluster operations, implement BeforeEach/AfterEach for setup/cleanup, add meaningful messages to assertions, and split multi-behavior tests into focused single-responsibility tests.
Microshift Test Compatibility	⚠️ Warning	New e2e tests use unsupported MicroShift APIs (ClusterOperator config/v1, operator/v1) without protection labels, apigroup tags, or runtime skip checks.	Add [apigroup:config.openshift.io] tags to tests using ClusterOperator, or add [Skipped:MicroShift] labels, or guard with exutil.IsMicroShiftCluster() runtime checks.
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	test/e2e-preferred-host/kcm_preferred_host_kas.go lines 71,74 build URLs with fmt.Sprintf("%s://%s:1234", scheme, host) without bracketing IPv6 addresses, failing in IPv6-only environments.	Use net.JoinHostPort(host, "1234") instead of string concatenation, or wrap IPv6 addresses in brackets: fmt.Sprintf("%s://[%s]:1234", scheme, host)
Title check	⚠️ Warning	The title mentions 'WIP: OCPSTRAT-3036: Rebase 1.36.1' but the raw summary shows the rebase is to version 1.36 (Go 1.26, Kubernetes 0.36.1) and multiple files across the repository are being updated, not just a single cohesive change.	Remove the 'WIP:' prefix and provide a more descriptive title that accurately reflects the scope of changes, such as 'Upgrade Go toolchain and dependencies to support OpenShift 5.0' or similar.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	All Ginkgo test titles in the PR are stable and deterministic with static strings containing no dynamic values, UUIDs, timestamps, pod/node names, or generated identifiers.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo tests make multi-node cluster assumptions. All added tests work on SNO with single-pod deployments and OpenShift APIs.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only build config and dependencies (.ci-operator.yaml, Dockerfile.rhel7, go.mod), not deployment manifests or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	OTE Binary Stdout Contract is preserved: klog.Fatal writes to stderr by default; no fmt.Print* in process-level code; no top-level initializers writing to stdout.
No-Weak-Crypto	✅ Passed	No weak crypto introduced. PR changes only build config, Dockerfile, and Go dependencies. Pre-existing SHA1 in test code (unmodified) is used for certificate hashing, not encryption.
No-Sensitive-Data-In-Logs	✅ Passed	No logging of sensitive data found. Error messages are generic validation messages, and secret names only (not content) are logged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-04-27T21:49:21Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xueqzhan for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@go.mod`:
- Around line 92-97: The go.opentelemetry.io/otel SDK is pinned at v1.40.0 and
is vulnerable; update go.mod so all OTEL modules are at v1.43.0 or later (at
minimum bump go.opentelemetry.io/otel/sdk to v1.43.0) and align related entries
— update go.opentelemetry.io/otel, go.opentelemetry.io/otel/metric,
go.opentelemetry.io/otel/trace,
go.opentelemetry.io/otel/exporters/otlp/otlptrace and
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to the same
patched version (e.g., v1.43.0) so versions are coherent and the
GHSA-hfvc-g4fc-pqhx range is avoided.
- Around line 140-142: The go.mod contains replace directives pointing core
OpenShift modules (github.com/openshift/api, github.com/openshift/client-go,
github.com/openshift/library-go) to a personal fork (github.com/jubittajohn/*);
remove these replace entries unless there is an explicit, documented reason to
use the fork. Edit the go.mod to delete the three replace lines referencing
github.com/jubittajohn/api, github.com/jubittajohn/client-go, and
github.com/jubittajohn/library-go so the module resolution returns upstream
github.com/openshift/* versions; if a fork is required, instead add a clear
comment and a tracked issue reference near the replace entries.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 51c8d078-dd3d-4af0-9eed-c824cd985624

📥 Commits

Reviewing files that changed from the base of the PR and between ca150c4 and b7547d2.

⛔ Files ignored due to path filters (297)

go.sum is excluded by !**/*.sum
vendor/cel.dev/expr/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
vendor/cel.dev/expr/MODULE.bazel is excluded by !**/vendor/**, !vendor/**
vendor/cel.dev/expr/checked.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/eval.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/explain.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/syntax.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/value.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/.golangci.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/LICENSE.txt is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/Makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/SECURITY.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/collection.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/constraints.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/version.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/exponential.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/retry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/tries.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/backoff.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/error.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/exponential.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/retry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/ticker.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/timer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/sdnotify_other.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/sdnotify_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/watchdog.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/journal/journal.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/journal/journal_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/.travis.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/CHANGES.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/curly.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/custom_verb.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/btree/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/btree/btree_generic.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/merge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/profile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/proto.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/prune.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/constants.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/COPYRIGHT is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/callmeta.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.travis.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/metric_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/util.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.proto is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2_protoopaque.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/core_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/decorator_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/deprecated_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/formatter/formatter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/automaxprocs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroup.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups2.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_linux.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_unsupported.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/errors.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/mountpoint.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/runtime.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/subsys.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/abort.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/gocovmerge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/profiles_and_reports.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/dependencies.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/around_node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/failer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/focus.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/group.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/ordering.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_wasm.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_win.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/client_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/server_handler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/progress_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/report_entry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_event_writer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/suite.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/suite_patch.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/writer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/gojson_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporting_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/table_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/around_node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/config.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/deprecated_types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/errors.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/flags.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/label_filter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/report_entry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/semver_filter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/version.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/format/format.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/gomega_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/have_key_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/have_key_with_value_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/match_error_strictly_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/support/goraph/edge/edge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/.ci-operator.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/Dockerfile.ocp is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_authentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/features.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/features/features.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/install.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/machine/v1beta1/types_machineset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/security/v1/generated.proto is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/security/v1/types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/security/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/security/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsdnsspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/alertmanagercustomconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clustermonitoringspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/containerresource.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metricsserverconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/monitoringpluginconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorbuddyinfoconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorcpufreqconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorethtoolconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorksmdconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectormountstatsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclasscollectconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclassconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetdevconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorprocessesconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdcollectconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectortcpstatconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexporterconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/openshiftstatemetricsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatoradmissionwebhookconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatorconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/telemeterclientconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/apiserver.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/authentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/build.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusterimagepolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusteroperator.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusterversion.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/console.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/dns.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/featuregate.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/image.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagecontentpolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagedigestmirrorset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagepolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagetagmirrorset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/infrastructure.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/ingress.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/insightsdatagather.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/network.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/oauth.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/operatorhub.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/project.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/proxy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/scheduler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/backup.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/clustermonitoring.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/criocredentialproviderconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/insightsdatagather.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/pki.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha2/insightsdatagather.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/factory.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/internalinterfaces/factory_interfaces.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/awscsidriverconfigspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollertuningoptions.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/controller/controllercmd/cmd.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/certrotation/client_cert_rotation_controller.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/encryption/state/types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/certsyncpod/certsync_controller.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/controller/installer/installer_controller.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/controller/installerstate/installer_state_controller.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/controller/node/node_controller.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/v1helpers/test_helpers.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/decode.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/expfmt.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/fuzz.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/openmetrics_create.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/text_create.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/text_parse.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/.golangci.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/Makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/Makefile.common is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/arp.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/buddyinfo.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/cmdline.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/cpuinfo.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/cpuinfo_armx.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/cpuinfo_loong64.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/cpuinfo_mipsx.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/cpuinfo_others.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/cpuinfo_ppcx.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/cpuinfo_riscvx.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/cpuinfo_s390x.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/cpuinfo_x86.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/crypto.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/fs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/fs_statfs_notype.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/fs_statfs_type.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/fscache.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/internal/fs/fs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/internal/util/parse.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/internal/util/readfile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/internal/util/sysreadfile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/internal/util/sysreadfile_compat.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/internal/util/valueparser.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/ipvs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/kernel_hung.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/kernel_random.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/loadavg.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/mdstat.go is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (3)

.ci-operator.yaml
Dockerfile.rhel7
go.mod

coderabbitai · 2026-04-27T21:59:14Z

GHSA-hfvc-g4fc-pqhx

+	go.opentelemetry.io/otel v1.41.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect
+	go.opentelemetry.io/otel/metric v1.41.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.40.0 // indirect
+	go.opentelemetry.io/otel/trace v1.41.0 // indirect


⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash set -euo pipefail # Confirm current otel-related pins in go.mod rg -n 'go\.opentelemetry\.io/otel' go.mod # Query OSV for vulnerability status of the pinned SDK version. curl -sS https://api.osv.dev/v1/query \ -H 'content-type: application/json' \ -d '{"package":{"name":"go.opentelemetry.io/otel/sdk","ecosystem":"Go"},"version":"1.40.0"}' \ | jq '{vuln_ids:[.vulns[].id], matching:[.vulns[]|select(.id=="GHSA-hfvc-g4fc-pqhx")|{id,affected:.affected}]}'

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 1368

Upgrade go.opentelemetry.io/otel/sdk to patch GHSA-hfvc-g4fc-pqhx before merge.

Line 96 pins go.opentelemetry.io/otel/sdk v1.40.0, which is vulnerable to GHSA-hfvc-g4fc-pqhx (affected versions: 1.15.0 to <1.43.0). Bump to v1.43.0 or later and align the OTEL module versions for coherence—currently the core module is at v1.41.0 while the SDK and exporters lag at v1.40.0.

🧰 Tools

🪛 OSV Scanner (2.3.5)

[HIGH] 96-96: go.opentelemetry.io/otel/sdk 1.40.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

(GHSA-hfvc-g4fc-pqhx)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@go.mod` around lines 92 - 97, The go.opentelemetry.io/otel SDK is pinned at v1.40.0 and is vulnerable; update go.mod so all OTEL modules are at v1.43.0 or later (at minimum bump go.opentelemetry.io/otel/sdk to v1.43.0) and align related entries — update go.opentelemetry.io/otel, go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/exporters/otlp/otlptrace and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to the same patched version (e.g., v1.43.0) so versions are coherent and the GHSA-hfvc-g4fc-pqhx range is avoided.

coderabbitai · 2026-04-27T21:59:14Z

+	github.com/openshift/api => github.com/jubittajohn/api v0.0.0-20260427143949-fa2a8fc32379
+	github.com/openshift/client-go => github.com/jubittajohn/client-go v0.0.0-20260427145758-ec18c956ffc2
+	github.com/openshift/library-go => github.com/jubittajohn/library-go v0.0.0-20260427152643-85540ba4a3d0


⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash set -euo pipefail # Verify replace directives and blast radius in repository imports. awk '/^replace $/,/^$/{print NR ":" $0}' go.mod rg -n --type=go '"github.com/openshift/(api|client-go|library-go)' -C1

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 50407

🏁 Script executed:

# Search for any comments or documentation about these forks rg -i "jubittajohn|personal.?fork|temporary.?replace" --max-count=20 # Check go.sum for the specific versions grep "jubittajohn" go.sum # Look for any TODO/FIXME comments related to these modules rg -i "TODO|FIXME|XXX" go.mod

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 2693

Remove personal-fork replaces for core OpenShift modules.

Lines 140-142 redirect core dependencies (api, client-go, library-go) to personal forks under jubittajohn/. This introduces avoidable provenance and maintenance risk for production operator builds. No documentation or tracking indicates this is temporary or required.

Suggested cleanup (if fork overrides are not strictly required)

replace ( github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20260424201627-4d4cc33d669d - github.com/openshift/api => github.com/jubittajohn/api v0.0.0-20260427143949-fa2a8fc32379 - github.com/openshift/client-go => github.com/jubittajohn/client-go v0.0.0-20260427145758-ec18c956ffc2 - github.com/openshift/library-go => github.com/jubittajohn/library-go v0.0.0-20260427152643-85540ba4a3d0 )

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

github.com/openshift/api => github.com/jubittajohn/api v0.0.0-20260427143949-fa2a8fc32379

github.com/openshift/client-go => github.com/jubittajohn/client-go v0.0.0-20260427145758-ec18c956ffc2

github.com/openshift/library-go => github.com/jubittajohn/library-go v0.0.0-20260427152643-85540ba4a3d0

replace (

github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20260424201627-4d4cc33d669d

)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@go.mod` around lines 140 - 142, The go.mod contains replace directives pointing core OpenShift modules (github.com/openshift/api, github.com/openshift/client-go, github.com/openshift/library-go) to a personal fork (github.com/jubittajohn/*); remove these replace entries unless there is an explicit, documented reason to use the fork. Edit the go.mod to delete the three replace lines referencing github.com/jubittajohn/api, github.com/jubittajohn/client-go, and github.com/jubittajohn/library-go so the module resolution returns upstream github.com/openshift/* versions; if a fork is required, instead add a clear comment and a tracked issue reference near the replace entries.

coderabbitai

♻️ Duplicate comments (2)

go.mod (2)
140-142: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Remove or document the personal-fork replaces for core OpenShift modules.

Lines 140-142 redirect core OpenShift dependencies (api, client-go, library-go) to personal forks under jubittajohn/*. While these may be necessary for the rebase work-in-progress, they introduce provenance and supply-chain risk for production builds. No inline comment or tracking issue explains why these forks are required or when they will be removed.

Before merging to main, either:

Remove these replace directives if the upstream modules now have the necessary changes, or

Add an inline comment with a tracking issue (e.g., Jira ticket) documenting why the forks are temporarily required and when they will be removed.
🔍 Verification script

Check if these forks are used elsewhere or documented:
#!/bin/bash
# Look for any documentation or issues referencing these forks
rg -i "jubittajohn|personal.?fork|temporary.?replace|OCPSTRAT-3036" --type=md -C3

# Check if other operators in the org use similar patterns
rg "github.com/jubittajohn" --type=go -C2
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 140 - 142, The go.mod currently replaces core OpenShift
modules (github.com/openshift/api, github.com/openshift/client-go,
github.com/openshift/library-go) with personal forks (github.com/jubittajohn/*);
either remove those replace directives if the upstream now contains the needed
changes, or add an inline comment above each replace documenting the tracking
ticket/issue (e.g., OCPSTRAT-XXXX or a Jira URL), why the fork is required, and
an explicit date or condition for removal; update the replace entries for
github.com/openshift/api, github.com/openshift/client-go, and
github.com/openshift/library-go accordingly so reviewers know this is temporary.
92-97: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Upgrade go.opentelemetry.io/otel/sdk to patch GHSA-hfvc-g4fc-pqhx before merge.

Line 96 pins go.opentelemetry.io/otel/sdk v1.40.0, which remains vulnerable to GHSA-hfvc-g4fc-pqhx (HIGH severity, PATH hijacking in BSD kenv command). The vulnerability affects versions 1.15.0 to <1.43.0. Additionally, OTEL module versions are inconsistent—core modules are at v1.41.0 while SDK and exporters lag at v1.40.0.

Bump go.opentelemetry.io/otel/sdk and the OTLP trace exporters (lines 93-94) to v1.43.0 or later, and align all OTEL modules to the same version for coherence.
🔧 Suggested fix

Run these commands to update the vulnerable modules:
go get go.opentelemetry.io/otel/sdk@v1.43.0
go get go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.43.0
go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.43.0
go mod tidy
go mod vendor
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 92 - 97, Update the go.opentelemetry modules to a
non-vulnerable, consistent version: bump go.opentelemetry.io/otel/sdk and the
OTLP exporter modules (go.opentelemetry.io/otel/exporters/otlp/otlptrace and
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc) to v1.43.0 or
later and align the versions of go.opentelemetry.io/otel,
go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/trace, and any other
otel modules to the same release; then run the equivalent of the suggested go
get commands for those modules and run go mod tidy (and go mod vendor if you
vendor) to update go.mod/go.sum.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@go.mod`:
- Around line 140-142: The go.mod currently replaces core OpenShift modules
(github.com/openshift/api, github.com/openshift/client-go,
github.com/openshift/library-go) with personal forks (github.com/jubittajohn/*);
either remove those replace directives if the upstream now contains the needed
changes, or add an inline comment above each replace documenting the tracking
ticket/issue (e.g., OCPSTRAT-XXXX or a Jira URL), why the fork is required, and
an explicit date or condition for removal; update the replace entries for
github.com/openshift/api, github.com/openshift/client-go, and
github.com/openshift/library-go accordingly so reviewers know this is temporary.
- Around line 92-97: Update the go.opentelemetry modules to a non-vulnerable,
consistent version: bump go.opentelemetry.io/otel/sdk and the OTLP exporter
modules (go.opentelemetry.io/otel/exporters/otlp/otlptrace and
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc) to v1.43.0 or
later and align the versions of go.opentelemetry.io/otel,
go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/trace, and any other
otel modules to the same release; then run the equivalent of the suggested go
get commands for those modules and run go mod tidy (and go mod vendor if you
vendor) to update go.mod/go.sum.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: bca7a02f-8eb0-4fe5-b942-88d2fd00e748

📥 Commits

Reviewing files that changed from the base of the PR and between b7547d2 and 04e5466.

⛔ Files ignored due to path filters (297)

go.sum is excluded by !**/*.sum
vendor/cel.dev/expr/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
vendor/cel.dev/expr/MODULE.bazel is excluded by !**/vendor/**, !vendor/**
vendor/cel.dev/expr/checked.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/eval.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/explain.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/syntax.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/value.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/.golangci.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/LICENSE.txt is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/Makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/SECURITY.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/collection.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/constraints.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/version.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/exponential.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/retry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/tries.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/backoff.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/error.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/exponential.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/retry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/ticker.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/timer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/sdnotify_other.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/sdnotify_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/watchdog.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/journal/journal.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/journal/journal_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/.travis.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/CHANGES.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/curly.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/custom_verb.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/btree/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/btree/btree_generic.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/merge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/profile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/proto.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/prune.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/constants.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/COPYRIGHT is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/callmeta.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.travis.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/metric_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/util.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.proto is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2_protoopaque.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/core_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/decorator_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/deprecated_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/formatter/formatter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/automaxprocs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroup.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups2.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_linux.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_unsupported.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/errors.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/mountpoint.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/runtime.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/subsys.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/abort.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/gocovmerge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/profiles_and_reports.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/dependencies.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/around_node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/failer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/focus.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/group.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/ordering.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_wasm.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_win.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/client_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/server_handler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/progress_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/report_entry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_event_writer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/suite.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/suite_patch.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/writer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/gojson_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporting_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/table_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/around_node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/config.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/deprecated_types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/errors.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/flags.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/label_filter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/report_entry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/semver_filter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/version.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/format/format.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/gomega_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/have_key_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/have_key_with_value_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/match_error_strictly_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/support/goraph/edge/edge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/.ci-operator.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/Dockerfile.ocp is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_apiserver.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_authentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_cluster_operator.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_image.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_infrastructure.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_kmsencryption.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/console/v1/types_console_plugin.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/console/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/features.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/features/features.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/install.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/machine/v1beta1/types_machineset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/security/v1/generated.proto is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/security/v1/types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/security/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/security/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverencryption.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsdnsspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awskmsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/kmsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/kmspluginconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/registrysources.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultapproleauthentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultauthentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultconfigmapreference.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultkmspluginconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultsecretreference.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaulttlsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vsphereplatformspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/alertmanagercustomconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clustermonitoringspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/containerresource.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metricsserverconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/monitoringpluginconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorbuddyinfoconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorcpufreqconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorethtoolconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorksmdconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectormountstatsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclasscollectconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclassconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetdevconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorprocessesconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsoftirqsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdcollectconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectortcpstatconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexporterconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/openshiftstatemetricsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatoradmissionwebhookconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatorconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/telemeterclientconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/apiserver.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/authentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/build.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusterimagepolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusteroperator.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusterversion.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/console.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/dns.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/featuregate.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/image.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagecontentpolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagedigestmirrorset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagepolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagetagmirrorset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/infrastructure.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/ingress.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/insightsdatagather.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/network.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/oauth.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/operatorhub.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/project.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/proxy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/scheduler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/backup.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/clustermonitoring.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/criocredentialproviderconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/insightsdatagather.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/pki.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha2/insightsdatagather.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/factory.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/internalinterfaces/factory_interfaces.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/awscsidriverconfigspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollertuningoptions.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/config/serving/server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/controller/controllercmd/builder.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/controller/controllercmd/cmd.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/certrotation/client_cert_rotation_controller.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/encryption/state/types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/certsyncpod/certsync_controller.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/controller/installer/installer_controller.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/controller/installerstate/installer_state_controller.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/controller/node/node_controller.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/installerpod/cmd.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/internal/atomicdir/sync.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/staticpod/internal/fsutil/fsutil.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/library-go/pkg/operator/v1helpers/test_helpers.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/decode.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/expfmt.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/fuzz.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/openmetrics_create.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/text_create.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/common/expfmt/text_parse.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/.golangci.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/Makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/Makefile.common is excluded by !**/vendor/**, !vendor/**
vendor/github.com/prometheus/procfs/arp.go is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (3)

.ci-operator.yaml
Dockerfile.rhel7
go.mod

🚧 Files skipped from review as they are similar to previous changes (1)

.ci-operator.yaml

jubittajohn · 2026-05-19T21:17:36Z

/retest

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

Dockerfile.rhel7 (1)
1-16: ⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy lift

Add USER directive to run as non-root.

The Dockerfile does not specify a USER directive, causing the container to run as root. This violates the container security requirement to run as a non-root user. While this is a pre-existing issue not introduced by the version bump changes, it should be addressed to meet security standards.
🔒 Proposed fix

Add a USER directive before the final LABEL instruction:
 COPY --from=builder /go/src/github.com/openshift/cluster-kube-controller-manager-operator/cluster-kube-controller-manager-operator-tests-ext.gz /usr/bin/
 COPY manifests /manifests
+USER 1001
 LABEL io.openshift.release.operator true
Note: Verify that UID 1001 (or the appropriate non-root user) has the necessary permissions for runtime operations, and validate against deployment constraints in the OpenShift environment.
As per coding guidelines: "USER non-root; never run as root" (Container security (prodsec-skills) for **/{Dockerfile,Containerfile}*).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.rhel7` around lines 1 - 16, The image runs as root because there's
no USER directive; add a non-root USER (e.g., UID 1001 or a named non-root user)
before the final LABEL and ensure runtime files/directories copied from the
builder (/usr/bin/cluster-kube-controller-manager-operator,
/usr/bin/cluster-kube-controller-manager-operator-tests-ext.gz,
/usr/share/bootkube/manifests/* and /manifests) are owned or accessible by that
UID (use chown/chgrp during build or set appropriate permissions) so the
operator can run without root privileges and pass OpenShift security checks.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@Dockerfile.rhel7`:
- Around line 1-16: The image runs as root because there's no USER directive;
add a non-root USER (e.g., UID 1001 or a named non-root user) before the final
LABEL and ensure runtime files/directories copied from the builder
(/usr/bin/cluster-kube-controller-manager-operator,
/usr/bin/cluster-kube-controller-manager-operator-tests-ext.gz,
/usr/share/bootkube/manifests/* and /manifests) are owned or accessible by that
UID (use chown/chgrp during build or set appropriate permissions) so the
operator can run without root privileges and pass OpenShift security checks.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4782f97a-02fb-4bd5-b703-2b9c00aa39ec

📥 Commits

Reviewing files that changed from the base of the PR and between 04e5466 and d2b6a3b.

⛔ Files ignored due to path filters (290)

go.sum is excluded by !**/*.sum
vendor/cel.dev/expr/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
vendor/cel.dev/expr/MODULE.bazel is excluded by !**/vendor/**, !vendor/**
vendor/cel.dev/expr/checked.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/eval.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/explain.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/syntax.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/value.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/.golangci.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/LICENSE.txt is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/Makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/SECURITY.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/collection.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/constraints.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/version.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/exponential.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/retry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/tries.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/backoff.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/error.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/exponential.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/retry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/ticker.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/timer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/sdnotify_other.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/sdnotify_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/watchdog.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/journal/journal.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/journal/journal_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/.travis.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/CHANGES.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/curly.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/custom_verb.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/btree/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/btree/btree_generic.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/merge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/profile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/proto.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/prune.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/constants.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/COPYRIGHT is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/callmeta.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.travis.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/metric_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/util.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.proto is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2_protoopaque.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/core_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/decorator_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/deprecated_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/formatter/formatter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/automaxprocs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroup.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups2.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_linux.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_unsupported.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/errors.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/mountpoint.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/runtime.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/subsys.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/abort.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/gocovmerge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/profiles_and_reports.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/dependencies.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/around_node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/failer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/focus.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/group.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/ordering.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_wasm.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_win.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/client_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/server_handler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/progress_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/report_entry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_event_writer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/suite.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/suite_patch.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/writer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/gojson_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporting_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/table_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/around_node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/config.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/deprecated_types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/errors.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/flags.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/label_filter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/report_entry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/semver_filter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/version.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/format/format.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/gomega_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/have_key_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/have_key_with_value_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/match_error_strictly_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/support/goraph/edge/edge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/.ci-operator.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/Dockerfile.ocp is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/Makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_apiserver.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_authentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_cluster_operator.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_image.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_infrastructure.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_kmsencryption.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_network.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/console/v1/types_console_plugin.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/console/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/features.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/features/features.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/install.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/machine/v1beta1/types_machineset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/security/v1/generated.proto is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/security/v1/types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/security/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/security/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverencryption.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsdnsspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awskmsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clientcredentialconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clientsecretsecretreference.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/customtlsprofile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalclaimssource.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourceauthentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcecertificateauthorityconfigmapreference.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcepredicate.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcetls.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/kmsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/kmspluginconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/networkobservabilityspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/networkspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/oidcprovider.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/registrysources.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/sourcedclaimmapping.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/sourceurl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/tlsprofilespec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/tlssecurityprofile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultapproleauthentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultauthentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultconfigmapreference.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultkmspluginconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultsecretreference.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaulttlsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vsphereplatformspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/alertmanagercustomconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clustermonitoringspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/containerresource.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metricsserverconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/monitoringpluginconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorbuddyinfoconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorcpufreqconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorethtoolconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorksmdconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectormountstatsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclasscollectconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclassconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetdevconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorprocessesconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsoftirqsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdcollectconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectortcpstatconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexporterconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/openshiftstatemetricsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatoradmissionwebhookconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatorconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/telemeterclientconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierrequestloggingconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/apiserver.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/authentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/build.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusterimagepolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusteroperator.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusterversion.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/console.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/dns.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/featuregate.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/image.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagecontentpolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagedigestmirrorset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagepolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagetagmirrorset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/infrastructure.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/ingress.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/insightsdatagather.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/network.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/oauth.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/operatorhub.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/project.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/proxy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/scheduler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/backup.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/clustermonitoring.go is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (3)

.ci-operator.yaml
Dockerfile.rhel7
go.mod

🚧 Files skipped from review as they are similar to previous changes (2)

.ci-operator.yaml
go.mod

Signed-off-by: jubittajohn <jujohn@redhat.com>

coderabbitai

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

Dockerfile.rhel7 (1)
15-15: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Missing HEALTHCHECK definition.

The Dockerfile does not define a HEALTHCHECK instruction, which is required by coding guidelines for operational health monitoring.
🏥 Proposed fix to add HEALTHCHECK

Add a HEALTHCHECK directive after the LABEL:
 LABEL io.openshift.release.operator true
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD ["/usr/bin/cluster-kube-controller-manager-operator", "health-check"]
Note: Adjust the health check command based on the actual health endpoint provided by the operator binary. If the operator exposes an HTTP health endpoint, use a curl/wget-based check instead.
As per coding guidelines: "HEALTHCHECK defined" from Container security (prodsec-skills) requirements.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.rhel7` at line 15, Add a HEALTHCHECK instruction immediately after
the existing LABEL io.openshift.release.operator true in the Dockerfile to
satisfy the "HEALTHCHECK defined" guideline: choose either HEALTHCHECK
--interval/--timeout with CMD-SHELL (for an HTTP check using curl/wget against
the operator's health endpoint, e.g., /health or /ready) or CMD (running the
operator binary's built‑in health command) and ensure the command returns
appropriate exit codes; update the Dockerfile to use the correct
endpoint/command and reasonable interval/timeout/retries for production.
Source: Coding guidelines

♻️ Duplicate comments (2)

go.mod (2)
140-142: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Personal-fork replaces for core OpenShift modules remain (duplicate of prior comment).

This duplicates the previous review comment. Lines 140-142 still redirect github.com/openshift/{api,client-go,library-go} to jubittajohn/* personal forks without documentation or tracking. Per supply chain security guidelines, dependencies should have clear provenance.

Note: These may be acceptable as temporary integration branches during the rebase workflow (PR author matches fork owner), but should either be documented inline or replaced with upstream references before final merge.

As per coding guidelines: "New deps: justify need, check license compatibility" and "SBOM: ensure build produces provenance attestations" from supply chain security requirements. Personal forks complicate provenance tracking.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 140 - 142, The go.mod entries redirecting
github.com/openshift/api, github.com/openshift/client-go, and
github.com/openshift/library-go to your personal forks (jubittajohn/*) must be
either reverted to the upstream module versions or clearly documented and
justified; update the go.mod to point to the official upstream modules (or to a
tracked temporary integration branch) and add an inline comment in go.mod and a
note in the PR description explaining why the forked replacements are necessary,
who owns them, the intended lifetime, and how provenance/SBOM attestation will
be produced, or remove the forks entirely before merge to satisfy supply-chain
provenance requirements.
Source: Coding guidelines

92-97: ⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy lift

Upgrade OpenTelemetry SDK to patch GHSA-hfvc-g4fc-pqhx (duplicate of prior comment).

This is a duplicate of the previous review comment. The vulnerable go.opentelemetry.io/otel/sdk v1.40.0 at line 96 remains unpatched. Per supply chain security guidelines, known CVEs must be resolved before merge.

As per coding guidelines: "Flag known CVEs (cross-ref osv.dev)" from supply chain security requirements for dependency files.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 92 - 97, The go.mod currently pins a vulnerable
dependency go.opentelemetry.io/otel/sdk v1.40.0; update that entry to a patched
release (e.g. v1.41.0 or later) and align related otel packages (otlptrace,
otlptracegrpc, metric, trace) to compatible versions to avoid mismatched semver;
run `go get`/`go mod tidy` to update go.sum and verify builds and checks (target
the go.opentelemetry.io/otel/sdk symbol in go.mod and ensure the version change
propagates consistently across the other go.opentelemetry.io/otel/* entries).
Sources: Coding guidelines, Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile.rhel7`:
- Around line 7-8: The Dockerfile currently creates directories as root and
lacks a USER directive, so add a non-root user and switch to it: create or use a
low-privilege user (e.g., add a user/group, chown the target directories
/usr/share/bootkube/manifests/bootstrap-manifests/
/usr/share/bootkube/manifests/config/ /usr/share/bootkube/manifests/manifests/
to that user) and add a USER <non-root-user> directive immediately after the
FROM line so the container never runs as root; ensure ownership/permissions
changes occur before dropping privileges so the non-root user can write to those
directories.

In `@go.mod`:
- Line 21: The go.mod currently pins google.golang.org/protobuf to a VCS
pseudo-version (v1.36.12-0.20260120151049-f2248ac996af) which is unnecessary if
a stable tag suffices; replace that pseudo-version with the nearest published
stable tag (e.g., v1.36.12 or latest v1.36.x) or remove the explicit line if not
required, keep the dependency marked as // indirect and preserve the comment
about improving error handling if desired, and run go get or go mod tidy to
update checksums and ensure the module graph resolves to the stable release
instead of the commit pseudo-version.

---

Outside diff comments:
In `@Dockerfile.rhel7`:
- Line 15: Add a HEALTHCHECK instruction immediately after the existing LABEL
io.openshift.release.operator true in the Dockerfile to satisfy the "HEALTHCHECK
defined" guideline: choose either HEALTHCHECK --interval/--timeout with
CMD-SHELL (for an HTTP check using curl/wget against the operator's health
endpoint, e.g., /health or /ready) or CMD (running the operator binary's
built‑in health command) and ensure the command returns appropriate exit codes;
update the Dockerfile to use the correct endpoint/command and reasonable
interval/timeout/retries for production.

---

Duplicate comments:
In `@go.mod`:
- Around line 140-142: The go.mod entries redirecting github.com/openshift/api,
github.com/openshift/client-go, and github.com/openshift/library-go to your
personal forks (jubittajohn/*) must be either reverted to the upstream module
versions or clearly documented and justified; update the go.mod to point to the
official upstream modules (or to a tracked temporary integration branch) and add
an inline comment in go.mod and a note in the PR description explaining why the
forked replacements are necessary, who owns them, the intended lifetime, and how
provenance/SBOM attestation will be produced, or remove the forks entirely
before merge to satisfy supply-chain provenance requirements.
- Around line 92-97: The go.mod currently pins a vulnerable dependency
go.opentelemetry.io/otel/sdk v1.40.0; update that entry to a patched release
(e.g. v1.41.0 or later) and align related otel packages (otlptrace,
otlptracegrpc, metric, trace) to compatible versions to avoid mismatched semver;
run `go get`/`go mod tidy` to update go.sum and verify builds and checks (target
the go.opentelemetry.io/otel/sdk symbol in go.mod and ensure the version change
propagates consistently across the other go.opentelemetry.io/otel/* entries).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ab24cb3d-4562-4bd3-a652-ae36bbbb0395

📥 Commits

Reviewing files that changed from the base of the PR and between d2b6a3b and 8ccdaa1.

⛔ Files ignored due to path filters (297)

go.sum is excluded by !**/*.sum
vendor/cel.dev/expr/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
vendor/cel.dev/expr/MODULE.bazel is excluded by !**/vendor/**, !vendor/**
vendor/cel.dev/expr/checked.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/eval.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/explain.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/syntax.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/cel.dev/expr/value.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/.golangci.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/LICENSE.txt is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/Makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/SECURITY.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/collection.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/constraints.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/Masterminds/semver/v3/version.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/exponential.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/retry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v4/tries.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/backoff.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/error.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/exponential.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/retry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/ticker.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/cenkalti/backoff/v5/timer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/sdnotify_other.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/sdnotify_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/daemon/watchdog.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/journal/journal.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/coreos/go-systemd/v22/journal/journal_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/.travis.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/CHANGES.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/curly.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/custom_verb.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/emicklei/go-restful/v3/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/btree/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/btree/btree_generic.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/merge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/profile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/proto.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/google/pprof/profile/prune.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/constants.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/COPYRIGHT is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/LICENSE is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/callmeta.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/doc.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.travis.yml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/metric_options.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_metrics.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/go-grpc-prometheus/util.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.proto is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2_protoopaque.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/.gitignore is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/core_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/decorator_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/deprecated_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/formatter/formatter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/README.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/automaxprocs.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroup.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups2.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_linux.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_unsupported.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/errors.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/mountpoint.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/runtime.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/subsys.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/abort.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/gocovmerge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/profiles_and_reports.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/dependencies.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/around_node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/failer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/focus.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/group.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/ordering.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_wasm.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_win.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/client_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_client.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_server.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/server_handler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/progress_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/report_entry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_event_writer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/suite.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/suite_patch.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/internal/writer.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/gojson_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/reporting_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/table_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/around_node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/config.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/deprecated_types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/errors.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/flags.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/label_filter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/report_entry.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/semver_filter.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/ginkgo/v2/types/version.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/format/format.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/gomega_dsl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/have_key_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/have_key_with_value_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/match_error_strictly_matcher.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/onsi/gomega/matchers/support/goraph/edge/edge.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/.ci-operator.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/Dockerfile.ocp is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/Makefile is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_apiserver.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_authentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_cluster_operator.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_image.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_infrastructure.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_kmsencryption.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_network.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/console/v1/types_console_plugin.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/console/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/features.md is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/features/features.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/install.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/machine/v1beta1/types_machineset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/security/v1/generated.proto is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/security/v1/types.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/api/security/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/security/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverencryption.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsdnsspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awskmsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clientcredentialconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clientsecretsecretreference.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/customtlsprofile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalclaimssource.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourceauthentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcecertificateauthorityconfigmapreference.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcepredicate.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcetls.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/kmsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/kmspluginconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/networkobservabilityspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/networkspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/oidcprovider.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/registrysources.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/sourcedclaimmapping.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/sourceurl.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/tlsprofilespec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/tlssecurityprofile.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultapproleauthentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultauthentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultconfigmapreference.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultkmspluginconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultsecretreference.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaulttlsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vsphereplatformspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/alertmanagercustomconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clustermonitoringspec.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/containerresource.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/kubestatemetricsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/kubestatemetricsresourcelabels.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metricsserverconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/monitoringpluginconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorbuddyinfoconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorcpufreqconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorethtoolconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorksmdconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectormountstatsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclasscollectconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclassconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetdevconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorprocessesconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsoftirqsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdcollectconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectortcpstatconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexporterconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/openshiftstatemetricsconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatoradmissionwebhookconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatorconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/telemeterclientconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierrequestloggingconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/apiserver.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/authentication.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/build.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusterimagepolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusteroperator.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/clusterversion.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/console.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/dns.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/featuregate.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/image.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagecontentpolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagedigestmirrorset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagepolicy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/imagetagmirrorset.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/infrastructure.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/ingress.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/insightsdatagather.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/network.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/node.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/oauth.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/operatorhub.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/project.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/proxy.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/scheduler.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/backup.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/clustermonitoring.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/criocredentialproviderconfig.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/insightsdatagather.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/pki.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha2/insightsdatagather.go is excluded by !**/vendor/**, !vendor/**
vendor/github.com/openshift/client-go/config/informers/externalversions/factory.go is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (3)

.ci-operator.yaml
Dockerfile.rhel7
go.mod

🚧 Files skipped from review as they are similar to previous changes (1)

.ci-operator.yaml

coderabbitai · 2026-06-08T01:04:38Z

+FROM registry.ci.openshift.org/ocp/5.0:base-rhel9-minimal
 RUN mkdir -p /usr/share/bootkube/manifests/bootstrap-manifests/ /usr/share/bootkube/manifests/config/ /usr/share/bootkube/manifests/manifests/


⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Container runs as root - critical security violation.

No USER directive is specified, causing the container to run as root (UID 0). As per coding guidelines, containers must specify a non-root user and never run as root.

🔒 Proposed fix to add non-root USER

Add a USER directive after the FROM statement:

FROM registry.ci.openshift.org/ocp/5.0:base-rhel9-minimal +USER 1001 RUN mkdir -p /usr/share/bootkube/manifests/bootstrap-manifests/ /usr/share/bootkube/manifests/config/ /usr/share/bootkube/manifests/manifests/

As per coding guidelines: "USER non-root; never run as root" from Container security (prodsec-skills) requirements.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

FROM registry.ci.openshift.org/ocp/5.0:base-rhel9-minimal

RUN mkdir -p /usr/share/bootkube/manifests/bootstrap-manifests/ /usr/share/bootkube/manifests/config/ /usr/share/bootkube/manifests/manifests/

FROM registry.ci.openshift.org/ocp/5.0:base-rhel9-minimal

USER 1001

RUN mkdir -p /usr/share/bootkube/manifests/bootstrap-manifests/ /usr/share/bootkube/manifests/config/ /usr/share/bootkube/manifests/manifests/

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile.rhel7` around lines 7 - 8, The Dockerfile currently creates directories as root and lacks a USER directive, so add a non-root user and switch to it: create or use a low-privilege user (e.g., add a user/group, chown the target directories /usr/share/bootkube/manifests/bootstrap-manifests/ /usr/share/bootkube/manifests/config/ /usr/share/bootkube/manifests/manifests/ to that user) and add a USER <non-root-user> directive immediately after the FROM line so the container never runs as root; ensure ownership/permissions changes occur before dropping privileges so the non-root user can write to those directories.

Sources: Coding guidelines, Linters/SAST tools

coderabbitai · 2026-06-08T01:04:38Z

-	k8s.io/component-base v0.35.1
-	k8s.io/klog/v2 v2.130.1
-	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect; to improve error handling


⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify the protobuf version exists and is legitimate echo "Checking if protobuf version is published..." curl -sS "https://proxy.golang.org/google.golang.org/protobuf/@v/v1.36.12-0.20260120151049-f2248ac996af.info" | jq '.' # Check for latest stable protobuf versions echo -e "\nLatest protobuf versions:" curl -sS "https://proxy.golang.org/google.golang.org/protobuf/@v/list" | tail -10 # Search for any references to why this specific version is needed rg -n "f2248ac996af|improve error handling" --type=go -C2

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 482

🏁 Script executed:

#!/bin/bash set -euo pipefail echo "== go.mod context (lines ~10-30) ==" nl -ba go.mod | sed -n '1,120p' | sed -n '10,35p' echo echo "== Confirm exact protobuf version in go.mod ==" rg -n "google\.golang\.org/protobuf v1\.36\.12-0\.20260120151049-f2248ac996af" go.mod || true echo echo "== Check if the exact version appears in `@v/list` ==" curl -sS "https://proxy.golang.org/google.golang.org/protobuf/@v/list" \ | rg -n "v1\.36\.12-0\.20260120151049-f2248ac996af" || true echo echo "== Fetch full module metadata for the exact version ==" curl -sS "https://proxy.golang.org/google.golang.org/protobuf/@v/v1.36.12-0.20260120151049-f2248ac996af.mod" | head -n 40 echo echo "== Search repo for reason string ==" rg -n "f2248ac996af|improve error handling" --type=go -C2 . || true

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 191

🏁 Script executed:

#!/bin/bash set -euo pipefail echo "== go.mod context (lines ~10-30) ==" cat -n go.mod | sed -n '10,35p' echo echo "== Confirm exact protobuf version in go.mod ==" rg -n "google\.golang\.org/protobuf v1\.36\.12-0\.20260120151049-f2248ac996af" go.mod || true echo echo "== Check if the exact version appears in `@v/list` ==" curl -sS "https://proxy.golang.org/google.golang.org/protobuf/@v/list" \ | rg -n "v1\.36\.12-0\.20260120151049-f2248ac996af" || true echo echo "== Fetch full module metadata for the exact version (.mod) ==" curl -sS "https://proxy.golang.org/google.golang.org/protobuf/@v/v1.36.12-0.20260120151049-f2248ac996af.mod" | head -n 60 echo echo "== Search repo for reason string/hash ==" rg -n "f2248ac996af|improve error handling" --type=go -C2 . || true

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 1839

Drop the “unpublished/illegitimate protobuf version” concern; optionally justify/consider a stable protobuf tag instead.

Go’s module proxy exposes google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af as a published VCS pseudo-version (origin commit f2248ac996afc39b3df0777cdcc269f6ade50b07, timestamp 2026-01-20). This repo also correctly marks it as // indirect; to improve error handling. If that specific commit isn’t required, prefer a tagged stable v1.36.x protobuf release over a commit pseudo-version.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 21, The go.mod currently pins google.golang.org/protobuf to a VCS pseudo-version (v1.36.12-0.20260120151049-f2248ac996af) which is unnecessary if a stable tag suffices; replace that pseudo-version with the nearest published stable tag (e.g., v1.36.12 or latest v1.36.x) or remove the explicit line if not required, keep the dependency marked as // indirect and preserve the comment about improving error handling if desired, and run go get or go mod tidy to update checksums and ensure the module graph resolves to the stable release instead of the commit pseudo-version.

Source: Coding guidelines

openshift-ci · 2026-06-08T04:21:31Z

@jubittajohn: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Apr 27, 2026

openshift-ci Bot requested review from atiratree and p0lyn0mial April 27, 2026 21:49

coderabbitai Bot reviewed Apr 27, 2026

View reviewed changes

jubittajohn force-pushed the rebase-1.36 branch from b7547d2 to 04e5466 Compare May 14, 2026 20:42

coderabbitai Bot reviewed May 14, 2026

View reviewed changes

jubittajohn force-pushed the rebase-1.36 branch from 04e5466 to d2b6a3b Compare June 5, 2026 22:14

coderabbitai Bot reviewed Jun 5, 2026

View reviewed changes

jubittajohn added 3 commits June 7, 2026 20:52

bump(k8s): update k8s.io/* dependencies to v0.36.1

aefa26f

Signed-off-by: jubittajohn <jujohn@redhat.com>

bump(k8s): go mod vendor

14c598c

Signed-off-by: jubittajohn <jujohn@redhat.com>

bump(k8s): update builder images

8ccdaa1

Signed-off-by: jubittajohn <jujohn@redhat.com>

jubittajohn force-pushed the rebase-1.36 branch from d2b6a3b to 8ccdaa1 Compare June 8, 2026 00:54

coderabbitai Bot reviewed Jun 8, 2026

View reviewed changes

jubittajohn changed the title ~~OCPSTRAT-3036: Rebase 1.36~~ WIP: OCPSTRAT-3036: Rebase 1.36.1 Jun 8, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 8, 2026

		FROM registry.ci.openshift.org/ocp/5.0:base-rhel9-minimal
		RUN mkdir -p /usr/share/bootkube/manifests/bootstrap-manifests/ /usr/share/bootkube/manifests/config/ /usr/share/bootkube/manifests/manifests/

Conversation

jubittajohn commented Apr 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Apr 27, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Apr 27, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Pre-merge checks failed

❌ Failed checks (1 error, 4 warnings)

Uh oh!

openshift-ci Bot commented Apr 27, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

jubittajohn commented May 19, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jubittajohn commented Apr 27, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Apr 27, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Apr 27, 2026 •

edited by openshift-ci Bot

Loading