OAPE-836: V1.42.3 Rebase openshift/main with upstream v1.42.3

[mytreya-rh]

Description of the change:*
Rebase this repo's main branch with upstream https://github.com/operator-framework/ansible-operator-plugins/releases/tag/v1.42.3 tag.
Changes done:

1. Cherry-picked [WIP] UPSTREAM: <carry>: automate hermetic build requirements generation #79 (UPSTREAM: <carry>: automate hermetic build requirements generation) onto the rebase branch first, so make -f openshift/Makefile generate-requirements uses the new Python-based generator (openshift/hack/generate_requirements.py) against the v1.42.3 Pipfile/Pipfile.lock instead of the old manual bash pipeline in openshift/Dockerfile.requirements.
2. Updated openshift/hack/rebase_upstream.sh to allow reusing a pre-existing <version>-rebase-<branch> branch, so the [WIP] UPSTREAM: <carry>: automate hermetic build requirements generation #79 cherry-pick could be staged before running the rest of the script.
3. Triggered the rebase using openshift/hack/rebase_upstream.sh v1.42.3, which merged upstream tag v1.42.3 (no conflicts), ran go mod tidy && go mod vendor, regenerated openshift/release/ansible/ansible_collections (only benign galaxy metadata URL diffs), and regenerated openshift/requirements*.txt / openshift/Pipfile.lock via the new generator.
   Motivation for the change:
   Pick up upstream v1.42.3, which bumps the Go toolchain to 1.26.3 and updates several Go/Python dependencies for CVE fixes (cryptography, urllib3, idna, requests, grpc, pyasn1, pip/pipenv, ubi9-minimal, etc.), while also landing the automated hermetic build-requirements generation from [WIP] UPSTREAM: <carry>: automate hermetic build requirements generation #79 ahead of the dependency regeneration so the new requirements files are produced by the maintained script rather than the manual bash pipeline.

Summary by CodeRabbit

• New Features

  • Added automated OpenShift Python requirements generation with dependency conflict handling, CVE checks, and validation.
  • Added documentation for the requirements-generation process.

• Security

  • Added enhanced Python dependency auditing and refreshed packages and container base images.

• Release

  • Updated the image and bundled ansible-operator version to v1.42.3.
  • Updated Galaxy metadata to use published API endpoints.

• Maintenance

  • Updated the Go toolchain, development dependencies, and generated requirements.
  • Refreshed CI checkout actions.

[openshift-ci-robot]

@mytreya-rh: This pull request references OAPE-836 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Description of the change:*
Rebase this repo's main branch with upstream https://github.com/operator-framework/ansible-operator-plugins/releases/tag/v1.42.3 tag.
Changes done:

1. Cherry-picked [WIP] UPSTREAM: <carry>: automate hermetic build requirements generation #79 (UPSTREAM: <carry>: automate hermetic build requirements generation) onto the rebase branch first, so make -f openshift/Makefile generate-requirements uses the new Python-based generator (openshift/hack/generate_requirements.py) against the v1.42.3 Pipfile/Pipfile.lock instead of the old manual bash pipeline in openshift/Dockerfile.requirements.
2. Updated openshift/hack/rebase_upstream.sh to allow reusing a pre-existing <version>-rebase-<branch> branch, so the [WIP] UPSTREAM: <carry>: automate hermetic build requirements generation #79 cherry-pick could be staged before running the rest of the script.
3. Triggered the rebase using openshift/hack/rebase_upstream.sh v1.42.3, which merged upstream tag v1.42.3 (no conflicts), ran go mod tidy && go mod vendor, regenerated openshift/release/ansible/ansible_collections (only benign galaxy metadata URL diffs), and regenerated openshift/requirements*.txt / openshift/Pipfile.lock via the new generator.
   Motivation for the change:
   Pick up upstream v1.42.3, which bumps the Go toolchain to 1.26.3 and updates several Go/Python dependencies for CVE fixes (cryptography, urllib3, idna, requests, grpc, pyasn1, pip/pipenv, ubi9-minimal, etc.), while also landing the automated hermetic build-requirements generation from [WIP] UPSTREAM: <carry>: automate hermetic build requirements generation #79 ahead of the dependency regeneration so the new requirements files are produced by the maintained script rather than the manual bash pipeline.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mytreya-rh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [mytreya-rh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The change adds a six-stage OpenShift requirements generator, integrates it into the requirements image, refreshes generated dependencies and container tooling, updates Go and release versions, changes Galaxy metadata endpoints, and upgrades workflow checkout actions.

Changes

Requirements and release refresh

Layer / File(s)	Summary
Requirements generator implementation openshift/hack/generate_requirements.py, openshift/hack/generate_requirements.md	The generator resolves runtime packages, remediates CVEs, separates conflicting build dependencies, creates phased requirements, and verifies completeness. Its pipeline and execution details are documented.
Requirements image integration and generated artifacts openshift/Dockerfile.requirements, openshift/requirements*.txt	The image invokes the generator with pinned tooling, exports Pipfile.lock, and regenerates runtime and build requirement files.
Container dependency and audit refresh images/ansible-operator/*	The images use UBI Minimal 9.8, updated Python tooling, pip-audit, and newer Python dependency pins.
Version and Go toolchain updates go.mod, Makefile, internal/version/version.go, testdata/memcached-molecule-operator/Makefile	The Go toolchain and dependencies are refreshed. Release version values change to v1.42.3.
Release metadata and workflow updates .github/workflows/*, openshift/release/ansible/ansible_collections/*/GALAXY.yml	Workflows update actions/checkout to v7. Five collection metadata files use published Galaxy API paths.

Estimated code review effort: 5 (Critical) | ~120 minutes

Suggested reviewers: anik120, oceanc80

Sequence Diagram(s)

sequenceDiagram
  participant Dockerfile_requirements
  participant generate_requirements_py
  participant pipenv
  participant Safety
  participant pip_find_builddeps_py
  participant pip_compile
  participant requirements_artifacts
  Dockerfile_requirements->>generate_requirements_py: invoke six-stage generation
  generate_requirements_py->>pipenv: resolve and update runtime packages
  generate_requirements_py->>Safety: scan runtime and build requirements
  generate_requirements_py->>pip_find_builddeps_py: collect build dependencies
  pip_find_builddeps_py-->>generate_requirements_py: return build constraints
  generate_requirements_py->>pip_compile: compile phased requirements
  generate_requirements_py->>requirements_artifacts: write requirements files and Pipfile.lock

Loading

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Ote Binary Stdout Contract	❌ Error	The e2e BeforeSuite writes directly to stdout at test/e2e/ansible/suite_test.go:89; its setup also reaches stdout writes in command.Run and GenerateSamples.	Remove these diagnostics or route them to GinkgoWriter or os.Stderr before OTE test binaries emit JSON.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: rebasing openshift/main onto upstream v1.42.3.
Docstring Coverage	✅ Passed	Docstring coverage is 95.45% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes no Go test sources or Ginkgo title expressions. The only test-related source change adds Ginkgo's ArtifactDir helper, not a test name.
Test Structure And Quality	✅ Passed	The PR changes no project *_test.go files or Ginkgo test declarations; it only updates Ginkgo/Gomega dependencies and vendored code, so this test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	The PR changes no test/e2e or *_test.go paths; its only non-vendor Go change is version.go, with no added Ginkgo DSL or MicroShift API references.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo or e2e tests were added; the changed non-vendored Go files contain only internal/version/version.go.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes workflows, dependency/build files, Galaxy metadata, generated requirements, and vendored libraries; it adds no deployment manifests or operator/controller scheduling code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds no Go test files, modifies no e2e tests, and adds no Ginkgo declarations. The IPv6/disconnected test check is not applicable.
No-Weak-Crypto	✅ Passed	New code has no weak-crypto APIs or secret comparisons; added MD5/SHA1 telemetry symbols only wrap strings, and existing weak-crypto vendor files are unchanged from main.
Container-Privileges	✅ Passed	The PR adds no privileged, host namespace, SYS_ADMIN, or privilege-escalation settings; runtime images use USER 1001, and root is limited to documented build-only requirement-generation stages.
No-Sensitive-Data-In-Logs	✅ Passed	No changed code logs passwords, tokens, API keys, PII, or customer data; workflow secrets are passed to login actions without echo, and generator logs package/tool diagnostics only.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 14

🧹 Nitpick comments (5)

images/ansible-operator/Pipfile (1)

8-11: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pin the build-tool installs exactly

pip~=26.1.2 and the unpinned pip-audit in both Dockerfiles can drift; use exact versions there. The Pipfile entries already resolve to exact versions through Pipfile.lock, so they don’t need == pins.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@images/ansible-operator/Pipfile` around lines 8 - 11, Pin the build-tool
dependencies exactly in both Dockerfiles: update pip to 26.1.2 and assign an
exact version to pip-audit in images/ansible-operator/Dockerfile lines 29-30 and
images/ansible-operator/pipfile.Dockerfile lines 23-24. No change is required in
images/ansible-operator/Pipfile lines 8-11 because its lockfile already resolves
those entries exactly.

Source: Path instructions

openshift/hack/generate_requirements.py (3)

452-468: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value

Gap heuristic splits on patch-only differences.

When every consecutive gap is 0 (e.g. resolved versions 8.1.0 and 8.1.2), max_gap never exceeds 0, split_after stays at unique[0], and the group is split even though no major/minor conflict exists. The recursion re-validates each sub-group, so the result is only extra phases rather than a wrong one — but requiring max_gap > 0 before splitting would avoid the spurious phase.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/hack/generate_requirements.py` around lines 452 - 468, Update the
gap-splitting logic around split_after and max_gap so it returns no split when
the largest major/minor gap is zero, including patch-only differences. Only
compute and return the older group when max_gap is greater than zero; preserve
the existing split behavior for genuine major/minor gaps.

---

203-207: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

_min_safe_version picks the last upper bound, not the tightest.

For multi-clause specs (Safety often emits ranges joined by ||, e.g. <1.9 || >=2.0,<2.1), the last <X match is the newest bound, so the inferred "min safe version" can silently overshoot or undershoot. Selecting the maximum bound with packaging.version.Version makes the intent explicit and matches the docstring.

♻️ Proposed refactor

-    # Find the tightest upper bound: the version just after <X
-    best: str | None = None
-    for m in re.finditer(r"<([0-9][0-9a-zA-Z._-]*)", affected_spec):
-        best = m.group(1)   # last match wins (most restrictive)
-    return best
+    # Pick the highest upper bound across all clauses so the resulting
+    # ">=best" constraint clears every affected range.
+    from packaging.version import InvalidVersion, Version
+
+    best: str | None = None
+    for m in re.finditer(r"<([0-9][0-9a-zA-Z._-]*)", affected_spec):
+        cand = m.group(1)
+        if best is None:
+            best = cand
+            continue
+        try:
+            if Version(cand) > Version(best):
+                best = cand
+        except InvalidVersion:
+            best = cand
+    return best

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/hack/generate_requirements.py` around lines 203 - 207, Update
_min_safe_version to compare every matched upper-bound version using
packaging.version.Version and retain the maximum bound rather than relying on
the last regex match. Return the selected version in the existing string format,
preserving None when no upper bounds are found.

---

625-629: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Every committed lockfile header now records absolute /requirements*.in paths. stage2_runtime_txt writes the compile input into out_dir specifically to keep pip-compile's # via annotations relative-looking, but the container invokes the generator with the default --output-dir . at /, so all three regenerated files carry /requirements-*.in annotations instead of the previous relative form. Harmless for pip, but it inflates the diff on every regeneration.

• openshift/hack/generate_requirements.py#L625-L629: either write the .in files relative to the process CWD, or update the comment to reflect that the annotation path follows --output-dir.
• openshift/requirements-build.txt#L5-L6: regenerate once the output directory is a real subdirectory so annotations return to the relative form.
• openshift/requirements-pre-build.txt#L5-L6: same regeneration applies to this header and its # via lines.
• openshift/requirements.txt#L5-L6: same regeneration applies to this header and its # via lines.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/hack/generate_requirements.py` around lines 625 - 629, The
stage2_runtime_txt path setup around compile_in and out_txt currently produces
absolute # via annotations when --output-dir is /. Make the compile input path
relative to the process CWD (or update the comment to accurately document
--output-dir-dependent behavior), then regenerate
openshift/requirements-build.txt:5-6, openshift/requirements-pre-build.txt:5-6,
and openshift/requirements.txt:5-6 using a real subdirectory so their headers
and # via lines use relative paths.

openshift/hack/generate_requirements.md (1)

27-32: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Add languages to fenced code blocks (markdownlint MD040).

Seven fenced blocks (Lines 27, 60, 121, 183, 216, 242, 288) have no language specified. text is fine for the ASCII diagrams.

Also applies to: 60-80, 121-125

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/hack/generate_requirements.md` around lines 27 - 32, Add the `text`
language identifier to the seven unlabeled fenced code blocks in
generate_requirements.md, including the blocks around the listed sections, while
preserving their existing diagram and content text.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Line 28: Pin every actions/checkout invocation to a full immutable commit SHA
instead of the mutable `@v7` tag: update .github/workflows/release.yml at lines
28-28 and 66-66, .github/workflows/test-ansible.yml at lines 10-10 and 23-23,
.github/workflows/test-sanity.yml at line 10, and .github/workflows/unit.yml at
line 10.

In @.github/workflows/test-ansible.yml:
- Around line 10-12: Add persist-credentials: false to every actions/checkout
step in .github/workflows/test-ansible.yml at lines 10-12 and 23-25,
.github/workflows/test-sanity.yml at lines 10-12, and .github/workflows/unit.yml
at lines 10-12; no other workflow behavior needs changing.

In `@go.mod`:
- Line 110: Update the google.golang.org/grpc dependency in go.mod from v1.79.3
to v1.82.1 or later, and synchronize related module checksums or dependency
metadata so the module build list no longer includes the vulnerable version.

In `@images/ansible-operator/pipfile.Dockerfile`:
- Line 1: Add a non-root user in the basebuilder image, grant that user write
access to /tmp/pip-airlock, and configure the image to run as that user so the
ENTRYPOINT cp operation does not create root-owned Pipfile.lock files.

In `@openshift/Dockerfile.requirements`:
- Around line 33-34: Update the documentation describing hardcoded package
assumptions: in openshift/Dockerfile.requirements lines 33-34, replace the
cachi2-specific wheel pin statement with a note that build-isolation pins are
auto-discovered from package metadata; in
openshift/hack/generate_requirements.py lines 5-7, remove “and cachi2-specific
pins” from the module docstring while leaving the script behavior unchanged.

In `@openshift/hack/generate_requirements.md`:
- Line 188: Update the step-count descriptions in the requirements-generation
documentation: change “five strategies” to “six strategies” near the
recursion-level list and “three-step process” to “four-step process” near the
later numbered list, without changing the steps themselves.

In `@openshift/hack/generate_requirements.py`:
- Around line 882-883: Remove the unnecessary f-string prefixes from the literal
string fragments in the requirement-generation output, including the fragments
near the auto-detected build-isolation pins and the corresponding locations
around lines 1001 and 1236. Preserve the existing concatenation and
interpolation for strings that still contain placeholders.
- Around line 230-239: Update the vulnerability parsing at this path and the
re-check around the second parse site to use the combined check.stdout and
check.stderr streams, matching Stage 5’s _strip_ansi handling. Preserve the
existing warning and auto-fix behavior while ensuring reports emitted on stderr
are parsed and processed.
- Around line 992-999: Change the deferred-package handling around the mapped
phase loop so `later_pkgs` constraints are accumulated when
`requirements-build.in` is not yet available, instead of being dropped. After
the loop has produced the build requirements, append all deferred specs and run
the same `_pip_compile`, `_normalize_quirks`, and `_comment_out` post-processing
used for the normal build output, ensuring RPM-installed packages remain
commented out.
- Around line 1062-1078: Update the Safety invocation loop around safety_cmd so
missing executables are caught as FileNotFoundError and the next command form is
attempted. Remove the premature stderr-based break and only stop when the
command executes successfully or produces a non-missing-command result, while
preserving the existing return-code handling and artifact generation flow.

In `@openshift/hack/rebase_upstream.sh`:
- Around line 49-52: Update the existing-branch path in the rebase_work_branch
reuse logic to ensure the checked-out branch contains the refreshed
rebase_branch before continuing. Merge the updated base into the reused branch,
or perform an ancestry check and abort with a clear message when it is not based
on the refreshed target.
- Around line 50-54: Update the existing-branch path around rebase_work_branch
so git checkout failure aborts the script immediately, matching the failure
handling in the branch-creation path. Preserve the current success behavior and
ensure no merge or commit proceeds when checkout fails.

In `@openshift/requirements-build.txt`:
- Around line 56-74: Update the pinned setuptools version in the requirements
file from 82.0.1 to a patched release that addresses the published advisory,
keeping the existing unsafe-package entry and formatting intact.

In `@openshift/requirements.txt`:
- Around line 33-36: Update the pinned runtime dependency set in
requirements.txt by restoring the rsa package required by google-auth==2.55.0,
using the compatible rsa>=3.1.4,<5 constraint and retaining the existing
generated dependency annotations for the google-auth dependency chain.

---

Nitpick comments:
In `@images/ansible-operator/Pipfile`:
- Around line 8-11: Pin the build-tool dependencies exactly in both Dockerfiles:
update pip to 26.1.2 and assign an exact version to pip-audit in
images/ansible-operator/Dockerfile lines 29-30 and
images/ansible-operator/pipfile.Dockerfile lines 23-24. No change is required in
images/ansible-operator/Pipfile lines 8-11 because its lockfile already resolves
those entries exactly.

In `@openshift/hack/generate_requirements.md`:
- Around line 27-32: Add the `text` language identifier to the seven unlabeled
fenced code blocks in generate_requirements.md, including the blocks around the
listed sections, while preserving their existing diagram and content text.

In `@openshift/hack/generate_requirements.py`:
- Around line 452-468: Update the gap-splitting logic around split_after and
max_gap so it returns no split when the largest major/minor gap is zero,
including patch-only differences. Only compute and return the older group when
max_gap is greater than zero; preserve the existing split behavior for genuine
major/minor gaps.
- Around line 203-207: Update _min_safe_version to compare every matched
upper-bound version using packaging.version.Version and retain the maximum bound
rather than relying on the last regex match. Return the selected version in the
existing string format, preserving None when no upper bounds are found.
- Around line 625-629: The stage2_runtime_txt path setup around compile_in and
out_txt currently produces absolute # via annotations when --output-dir is /.
Make the compile input path relative to the process CWD (or update the comment
to accurately document --output-dir-dependent behavior), then regenerate
openshift/requirements-build.txt:5-6, openshift/requirements-pre-build.txt:5-6,
and openshift/requirements.txt:5-6 using a real subdirectory so their headers
and # via lines use relative paths.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 29944b7a-ce45-4d4b-a48f-d75ab87228fb

📥 Commits

Reviewing files that changed from the base of the PR and between 0a0c4c2 and d822aff.

⛔ Files ignored due to path filters (255)

• go.sum is excluded by !**/*.sum
• images/ansible-operator/Pipfile.lock is excluded by !**/*.lock
• openshift/Pipfile.lock is excluded by !**/*.lock
• vendor/cel.dev/expr/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/MODULE.bazel is excluded by !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/checked.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/eval.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/explain.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/syntax.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/value.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/.gitignore is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/core_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/ginkgo.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/helpergo_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/internal/global/init.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/internal/suite.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/errors.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/flags.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/format/format.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/gomega_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/matchers.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/matchers/be_a_slice_matcher.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/matchers/be_an_array_matcher.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/types/types.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/.golangci.yml is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/CONTRIBUTING.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/Makefile is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/RELEASING.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/encoder.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/hash.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/internal/attribute.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/kv.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/type_string.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/value.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/baggage/baggage.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/dependencies.Dockerfile is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/errorhandler/errorhandler.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/handler.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/state.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/asyncfloat64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/asyncint64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/meter.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/syncfloat64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/syncint64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/baggage.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/trace_context.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/requirements.txt is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/internal/x/features.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/builtin.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/container.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/env.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id_readfile.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/os.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/process.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/resource.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/batch_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/simple_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/tracer.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/provider.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/sampling.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/span.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.39.0/MIGRATION.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.39.0/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/MIGRATION.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/attribute_group.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/error_type.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/exception.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/otelconv/metric.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/schema.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/auto.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/tracestate.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/versions.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/html/iter.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/html/node.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/html/nodetype_string.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/client_conn_pool.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/client_priority_go126.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/client_priority_go127.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/clientconn.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/frame.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/http2.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server_wrap.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport_wrap.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_priority_rfc7540.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_priority_rfc9218.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_random.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_roundrobin.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/go118.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/idna.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/idna9.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/pre_go118.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/punycode.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables10.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables11.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables12.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables13.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables15.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables17.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables9.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/trie12.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/trie13.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/internal/httpcommon/request.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/internal/httpsfv/httpsfv.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/deviceauth.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/oauth2.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/pkce.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/token.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sync/errgroup/errgroup.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sync/singleflight/singleflight.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/plan9/syscall_plan9.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/affinity_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ioctl_signed.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ioctl_unsigned.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/mkall.sh is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_arm.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_loong64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_solaris.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_unix.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zsyscall_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/aliases.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/dll_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/registry/key.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/security_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/syscall_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/types_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/zsyscall_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/edge/edge.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/inspector/cursor.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/inspector/inspector.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/inspector/iter.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/packages/golist.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/packages/packages.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/types/objectpath/objectpath.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/aliases/aliases.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/aliases/aliases_go122.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/event/core/event.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/event/keys/keys.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/event/label/label.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gcimporter/iexport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gcimporter/iimport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gcimporter/ureader.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gocommand/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/imports/fix.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/imports/mod.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/imports/source_modindex.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/directories.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/index.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/lookup.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/modindex.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/symbols.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/pkgbits/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/stdlib/deps.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/typeparams/coretype.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/typeparams/free.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/typesinternal/types.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/versions/features.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/CONTRIBUTING.md is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/balancer.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/pickfirst/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/subconn.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer_wrapper.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/clientconn.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/credentials/credentials.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/credentials/tls.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/encoding.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/gzip/gzip.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/proto/proto.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/experimental/stats/metricregistry.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/experimental/stats/metrics.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/interceptor.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/balancer/weight/weight.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/buffer/unbounded.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/channelz/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/envconfig/envconfig.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/envconfig/xds.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/experimental.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/idle/idle.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/stats/metrics_recorder_list.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/stats/stats.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/client_stream.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/controlbuf.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/flowcontrol.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/handler_server.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/http2_client.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/http2_server.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/http_util.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/server_stream.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/mem/buffer_pool.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/mem/buffer_slice.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/mem/buffers.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/preloader.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/resolver/resolver.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/resolver_wrapper.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/rpc_util.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/stream.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/filedesc/desc.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/filedesc/desc_init.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/version/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/reflect/protodesc/desc.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/reflect/protodesc/proto.go is excluded by !**/vendor/**, !vendor/**
• vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (24)

• .github/workflows/release.yml
• .github/workflows/test-ansible.yml
• .github/workflows/test-sanity.yml
• .github/workflows/unit.yml
• Makefile
• go.mod
• images/ansible-operator/Dockerfile
• images/ansible-operator/Pipfile
• images/ansible-operator/pipfile.Dockerfile
• internal/version/version.go
• openshift/Dockerfile.requirements
• openshift/hack/generate_requirements.md
• openshift/hack/generate_requirements.py
• openshift/hack/rebase_upstream.sh
• openshift/release/ansible/ansible_collections/cloud.common-3.0.0.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/community.docker-3.12.1.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/community.library_inventory_filtering_v1-1.1.5.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/kubernetes.core-3.2.0.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/operator_sdk.util-0.5.0.info/GALAXY.yml
• openshift/requirements-build.txt
• openshift/requirements-build1.txt
• openshift/requirements-pre-build.txt
• openshift/requirements.txt
• testdata/memcached-molecule-operator/Makefile

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

google-auth 2.55.0 Python dependencies rsa requirement

💡 Result:

In google-auth version 2.55.0, the rsa library is listed as a required dependency, with the version constraint defined as >=3.1.4 and <5 [1][2]. While google-auth has transitioned to using the cryptography library as its primary backend for RSA operations [3], rsa remained a required dependency in version 2.55.0 to maintain backward compatibility and support existing functionality [4][3][2]. The library uses internal wrapper classes (such as RSASigner and RSAVerifier) that can leverage either the cryptography library or the rsa library [5][3]. In subsequent development, the project has aimed to reduce and eventually remove this hard dependency on rsa, moving it toward optional status in newer versions of the library [3][6][2].

Citations:

• 1: https://pypi.org/project/google-auth/2.55.0/
• 2: https://data.gpo.zugaina.org/gentoo/dev-python/google-auth/google-auth-2.55.0.ebuild
• 3: feat: add cryptography as required dependency googleapis/google-auth-library-python#1929
• 4: https://github.com/GoogleCloudPlatform/google-auth-library-python/blob/master/setup.py
• 5: https://googleapis.dev/python/google-auth/latest/reference/google.auth.crypt.rsa.html
• 6: https://pypi.org/project/google-auth/

---

🏁 Script executed:

set -euo pipefail

printf '\n[1] locate google-auth and rsa entries in openshift/requirements.txt\n'
rg -n '^(google-auth==|rsa==|pyasn1==|pyasn1-modules==)' openshift/requirements.txt || true

printf '\n[2] show the surrounding block around google-auth\n'
python3 - <<'PY'
from pathlib import Path
p = Path('openshift/requirements.txt')
lines = p.read_text().splitlines()
for i, line in enumerate(lines, 1):
    if line.startswith('google-auth==') or line.startswith('rsa=='):
        start = max(1, i-6)
        end = min(len(lines), i+8)
        print(f'\n--- lines {start}-{end} around line {i} ---')
        for j in range(start, end+1):
            print(f'{j:4}: {lines[j-1]}')
PY

printf '\n[3] check whether rsa appears anywhere in the file at all\n'
python3 - <<'PY'
from pathlib import Path
text = Path('openshift/requirements.txt').read_text()
print('rsa present:' , 'rsa==' in text or '\nrsa\n' in text or ' rsa' in text)
PY

Repository: openshift/ansible-operator-plugins

Length of output: 834

---

Restore rsa to the google-auth runtime set. google-auth==2.55.0 still requires rsa>=3.1.4,<5, but rsa is missing from openshift/requirements.txt while its sibling deps are still pinned. A hermetic install will fail when google-auth is imported.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/requirements.txt` around lines 33 - 36, Update the pinned runtime
dependency set in requirements.txt by restoring the rsa package required by
google-auth==2.55.0, using the compatible rsa>=3.1.4,<5 constraint and retaining
the existing generated dependency annotations for the google-auth dependency
chain.

[chiragkyal]

We are not seeing any failure

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '[1] Locate rsa and dependency-install references'
rg -n -i -C 3 '(^rsa([<=>!~ ]|$)|\brsa\b|RPM_INSTALLED|--no-deps|requirements\.txt)' \
  openshift/hack/generate_requirements.py \
  openshift/Dockerfile.requirements \
  images/ansible-operator/Dockerfile \
  openshift 2>/dev/null || true

printf '%s\n' '[2] Map the generator before reading relevant sections'
ast-grep outline openshift/hack/generate_requirements.py --items all --type function,variable --match 'RPM_INSTALLED|stage2_runtime_txt|stage6_verify_completeness' || true

printf '%s\n' '[3] Show the generator exclusion and runtime-output logic'
rg -n -A 80 -B 12 'RPM_INSTALLED|def stage2_runtime_txt|def stage6_verify_completeness' \
  openshift/hack/generate_requirements.py || true

printf '%s\n' '[4] Show how generated requirements are installed or exported'
cat -n openshift/Dockerfile.requirements | sed -n '1,220p'

Length of output: 113996

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import json
from urllib.request import urlopen

url = "https://pypi.org/pypi/google-auth/2.55.0/json"
with urlopen(url, timeout=20) as response:
    payload = json.load(response)

requirements = payload["info"].get("requires_dist") or []
print("google-auth version:", payload["info"]["version"])
print("Requires-Dist entries:")
for requirement in requirements:
    print(" -", requirement)
print("rsa requirement present:", any(item.lower().startswith("rsa") for item in requirements))
PY

Length of output: 3130

---

What are the exact `Requires-Dist` dependencies listed in the PyPI metadata for `google-auth` version `2.55.0`? In particular, does that exact release require the `rsa` package?

_{You are interacting with an AI system.}

[chiragkyal]

/assign
/cc

[chiragkyal]

Thanks a lot for the automation script. Adding few comments/queries:

• Can we have a single commit with the downstream requirement changes? Currently, we have them in both 5c3c790 and d822aff commits.
• I think the order of the commit should be:
  • The new conflict resolution script and steps
  • Use the above script to do the rebase
  • Downstream specific requirement files
• If we follow the above steps, can we avoid 1703a4c commit?

[chiragkyal]

Why do we need this redundant Pipfile.lock?

[mytreya-rh]

Good catch, and you're right that it's currently byte-identical to images/ansible-operator/Pipfile.lock. This is intentional though, not redundant: openshift/Pipfile.lock is the artifact exported by Stage 1's CVE auto-fix (pipenv update <pkg> on top of the upstream lock file), so it's expected to diverge over time as new CVEs get fixed downstream between upstream rebases — waiting for every fix to land upstream first isn't practical given the CVE volume, and it naturally re-syncs at each rebase anyway. I've added an explicit "Why openshift/Pipfile.lock Can Differ..." section to generate_requirements.md and strengthened the Dockerfile.requirements comment block to spell this out, so it's discoverable next time someone asks the same question.

[chiragkyal]

Thanks for the explanation. Wondering if we should keep a copy of Pipfile as well, or not, to make it consistent with the updated Pipfile.lock?

[chiragkyal]

Same as above, do we really need Pipfile.lock for installing the requirements? To my understanding, it should be the same as the upstream one.

[mytreya-rh]

Same rationale as the Pipfile.lock comment: it isn't guaranteed to always match the upstream one, by design — Stage 1's CVE auto-fix can bump pins in the exported copy ahead of upstream. I've expanded the comment block right above this line to call that out explicitly.

[chiragkyal]

It might cause bumping the package version only in downstream, whereas the fix should land in upstream first.

[mytreya-rh]

Agreed this is a real tradeoff, but given how frequently CVEs come in, waiting on an upstream-first fix for every pin bump would create an unacceptable backlog, and any divergence resets naturally at the next rebase (since we start fresh from upstream's Pipfile each time). I've documented this reasoning explicitly in the new rationale section rather than changing the behavior.

[chiragkyal]

Shouldn't we error out and fail the script instead of just warning which we might overlook

[mytreya-rh]

Valid gap, thanks for flagging it. Both this CVE-auto-fix path (Stage 1) and the equivalent build-dep CVE scan (Stage 5) now sys.exit(1) with a detailed report when a CVE can't be auto-fixed, instead of only printing a warning — so make check-requirements (and CI) will fail loudly instead of silently passing with an unresolved known CVE buried in the logs.

[chiragkyal]

Now that the script will fail if the CVE cannot be auto-fixed, are there any recommended steps for how it should be manually investigated/fixed?

[chiragkyal]

At the end of the requirement generation process, can we add a verification step to ensure that all four requirement files include every package defined in the Pipfile/Pipfile.lock? The verification should also confirm that no packages are missing, omitted or commented out.

I think this will be a valuable sanity check.

[mytreya-rh]

Added — there's now a Stage 6 (stage6_verify_completeness()) that checks every package pinned in Pipfile.lock is correctly represented in requirements.txt: present and active, unless it's an RPM-installed package (must be commented out) or one of pip-compile's own reserved "unsafe" packages (pip/setuptools/distribute — these are unconditionally dropped by pip-compile itself when compiled without --allow-unsafe, which is how Stage 2 compiles requirements.txt, so their absence there is correct rather than a bug). It fails loudly listing any missing/miscommented package by name. Documented in the new "Stage 6 — Completeness Verification" section. I validated it locally against the real Pipfile.lock/requirements.txt and it correctly passes on the current committed state and correctly caught an edge case (pip itself) during development that I then had to special-case.

[chiragkyal]

Do you think we should validate that from CI as well? If in the long run we want to make this repo self-sustaining, having this verification in CI would help cross-verify instead of a local dependency.

[mytreya-rh]

In our envisioned self-sustain mode, the script as it is will be called from https://github.com/openshift/ansible-operator-plugins/blob/main/openshift/hack/rebase_upstream.sh through a rebasebot, and any other periodic job which will attempt to fix CVEs. Thus the invoking job itself will fail. So, i feel we need to not check it again as a standalone job.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[mytreya-rh]

Thanks for the thorough review, @chiragkyal! I've addressed all of the inline comments (replied individually in each thread) and, for the top-level commit-hygiene request, restructured the branch history:

• Single downstream-requirements commit: the requirements-file regeneration that was previously split across 5c3c7907 (pre-rebase) and d822afff (post-rebase) is now combined into one commit, containing only the final, fully-rebased output (openshift/Pipfile.lock, openshift/requirements*.txt).
• Reordered: the script/tooling commit now comes first (and no longer touches any output files), followed by the upstream merge, then the single downstream-requirements commit last.
• Dropped 1703a4c0: the rebase_upstream.sh "reuse pre-existing branch" tweak is no longer needed with this ordering, so it's gone.

New commit sequence:

1. automate hermetic build requirements generation — script/docs only (also includes the fail-hard CVE checks and the new completeness-verification stage from the inline comments above)
2. Merge upstream tag v1.42.3
3. Update vendor directory
4. Update ansible_collections directory
5. Update downstream requirements — single commit, final rebased output only

This was a pure history rewrite — I verified the final tree is byte-identical to the previous PR head everywhere except the script/doc files touched by the review fixes above (and the now-unnecessary rebase_upstream.sh tweak), so none of the requirements/Pipfile.lock content was regenerated or changed as part of this restructuring. Force-pushed the same branch (v1.42.3-rebase-main), so the PR is now at 5 commits.

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (1)

openshift/Dockerfile.requirements (1)

50-52: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Security Misconfiguration (CWE-494): Download of Code Without Integrity Check

Reachability: Internal

Pin the requirement-generation inputs.

Pin pip-tools to an exact version. Fetch pip_find_builddeps.py at a commit SHA and verify its checksum before execution. openshift/Makefile compares generated files, and openshift/install-ansible.sh consumes those files. Floating inputs can change the artifacts or execute changed upstream code during generation.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/Dockerfile.requirements` around lines 50 - 52, Update the
requirement-generation RUN step to pin pip-tools to an exact version, download
pip_find_builddeps.py from a fixed commit SHA, and verify the downloaded file
against an expected checksum before running it. Keep generate_requirements.py
and the existing generation flow intact, ensuring all inputs used to produce the
requirements artifacts are immutable and verified.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test-ansible.yml:
- Around line 10-12: Pin every changed actions/checkout step to a reviewed
40-character commit SHA instead of the mutable v7 tag: update
.github/workflows/test-ansible.yml lines 10-12 and 23-25,
.github/workflows/test-sanity.yml lines 10-12, and .github/workflows/unit.yml
lines 10-12, preserving each step’s existing with configuration.

In `@images/ansible-operator/pipfile.Dockerfile`:
- Around line 23-24: Update the bootstrap install commands in the Dockerfile to
pin exact versions for pip, pipenv, and pip-audit, and add reviewed hash
constraints for each package. Ensure the subsequent pipenv lock flow remains
unchanged while no unpinned or range-based bootstrap dependency remains.

In `@openshift/hack/generate_requirements.py`:
- Around line 239-241: The documentation comments for auto_fix_cves still
describe CVE remediation as non-blocking. In
openshift/hack/generate_requirements.py:239-241, update the third docstring
outcome to state that remediation guidance is printed and the function exits
non-zero; in openshift/hack/generate_requirements.py:611-613, replace the “Never
blocks requirements generation” note with the behavior that the call exits
non-zero when a pip-managed CVE cannot be auto-fixed.

---

Nitpick comments:
In `@openshift/Dockerfile.requirements`:
- Around line 50-52: Update the requirement-generation RUN step to pin pip-tools
to an exact version, download pip_find_builddeps.py from a fixed commit SHA, and
verify the downloaded file against an expected checksum before running it. Keep
generate_requirements.py and the existing generation flow intact, ensuring all
inputs used to produce the requirements artifacts are immutable and verified.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 799734e2-96fa-4174-a560-8a18c3fe73ba

📥 Commits

Reviewing files that changed from the base of the PR and between 0a0c4c2 and 7115916.

⛔ Files ignored due to path filters (255)

• go.sum is excluded by !**/*.sum
• images/ansible-operator/Pipfile.lock is excluded by !**/*.lock
• openshift/Pipfile.lock is excluded by !**/*.lock
• vendor/cel.dev/expr/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/MODULE.bazel is excluded by !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/checked.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/eval.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/explain.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/syntax.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/value.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/.gitignore is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/core_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/ginkgo.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/helpergo_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/internal/global/init.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/internal/suite.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/errors.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/flags.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/format/format.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/gomega_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/matchers.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/matchers/be_a_slice_matcher.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/matchers/be_an_array_matcher.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/types/types.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/.golangci.yml is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/CONTRIBUTING.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/Makefile is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/RELEASING.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/encoder.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/hash.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/internal/attribute.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/kv.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/type_string.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/value.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/baggage/baggage.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/dependencies.Dockerfile is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/errorhandler/errorhandler.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/handler.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/state.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/asyncfloat64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/asyncint64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/meter.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/syncfloat64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/syncint64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/baggage.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/trace_context.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/requirements.txt is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/internal/x/features.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/builtin.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/container.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/env.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id_readfile.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/os.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/process.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/resource.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/batch_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/simple_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/tracer.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/provider.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/sampling.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/span.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.39.0/MIGRATION.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.39.0/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/MIGRATION.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/attribute_group.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/error_type.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/exception.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/otelconv/metric.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/schema.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/auto.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/tracestate.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/versions.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/html/iter.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/html/node.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/html/nodetype_string.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/client_conn_pool.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/client_priority_go126.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/client_priority_go127.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/clientconn.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/frame.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/http2.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server_wrap.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport_wrap.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_priority_rfc7540.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_priority_rfc9218.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_random.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_roundrobin.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/go118.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/idna.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/idna9.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/pre_go118.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/punycode.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables10.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables11.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables12.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables13.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables15.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables17.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables9.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/trie12.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/trie13.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/internal/httpcommon/request.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/internal/httpsfv/httpsfv.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/deviceauth.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/oauth2.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/pkce.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/token.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sync/errgroup/errgroup.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sync/singleflight/singleflight.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/plan9/syscall_plan9.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/affinity_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ioctl_signed.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ioctl_unsigned.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/mkall.sh is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_arm.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_loong64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_solaris.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_unix.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zsyscall_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/aliases.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/dll_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/registry/key.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/security_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/syscall_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/types_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/zsyscall_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/edge/edge.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/inspector/cursor.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/inspector/inspector.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/inspector/iter.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/packages/golist.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/packages/packages.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/types/objectpath/objectpath.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/aliases/aliases.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/aliases/aliases_go122.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/event/core/event.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/event/keys/keys.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/event/label/label.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gcimporter/iexport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gcimporter/iimport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gcimporter/ureader.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gocommand/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/imports/fix.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/imports/mod.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/imports/source_modindex.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/directories.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/index.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/lookup.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/modindex.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/symbols.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/pkgbits/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/stdlib/deps.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/typeparams/coretype.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/typeparams/free.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/typesinternal/types.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/versions/features.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/CONTRIBUTING.md is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/balancer.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/pickfirst/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/subconn.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer_wrapper.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/clientconn.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/credentials/credentials.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/credentials/tls.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/encoding.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/gzip/gzip.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/proto/proto.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/experimental/stats/metricregistry.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/experimental/stats/metrics.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/interceptor.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/balancer/weight/weight.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/buffer/unbounded.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/channelz/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/envconfig/envconfig.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/envconfig/xds.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/experimental.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/idle/idle.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/stats/metrics_recorder_list.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/stats/stats.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/client_stream.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/controlbuf.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/flowcontrol.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/handler_server.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/http2_client.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/http2_server.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/http_util.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/server_stream.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/mem/buffer_pool.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/mem/buffer_slice.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/mem/buffers.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/preloader.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/resolver/resolver.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/resolver_wrapper.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/rpc_util.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/stream.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/filedesc/desc.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/filedesc/desc_init.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/version/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/reflect/protodesc/desc.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/reflect/protodesc/proto.go is excluded by !**/vendor/**, !vendor/**
• vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (23)

• .github/workflows/release.yml
• .github/workflows/test-ansible.yml
• .github/workflows/test-sanity.yml
• .github/workflows/unit.yml
• Makefile
• go.mod
• images/ansible-operator/Dockerfile
• images/ansible-operator/Pipfile
• images/ansible-operator/pipfile.Dockerfile
• internal/version/version.go
• openshift/Dockerfile.requirements
• openshift/hack/generate_requirements.md
• openshift/hack/generate_requirements.py
• openshift/release/ansible/ansible_collections/cloud.common-3.0.0.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/community.docker-3.12.1.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/community.library_inventory_filtering_v1-1.1.5.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/kubernetes.core-3.2.0.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/operator_sdk.util-0.5.0.info/GALAXY.yml
• openshift/requirements-build.txt
• openshift/requirements-build1.txt
• openshift/requirements-pre-build.txt
• openshift/requirements.txt
• testdata/memcached-molecule-operator/Makefile

🚧 Files skipped from review as they are similar to previous changes (15)

• testdata/memcached-molecule-operator/Makefile
• openshift/release/ansible/ansible_collections/operator_sdk.util-0.5.0.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/cloud.common-3.0.0.info/GALAXY.yml
• Makefile
• .github/workflows/release.yml
• images/ansible-operator/Pipfile
• openshift/requirements.txt
• internal/version/version.go
• openshift/requirements-build1.txt
• openshift/release/ansible/ansible_collections/community.docker-3.12.1.info/GALAXY.yml
• images/ansible-operator/Dockerfile
• openshift/release/ansible/ansible_collections/kubernetes.core-3.2.0.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/community.library_inventory_filtering_v1-1.1.5.info/GALAXY.yml
• openshift/requirements-build.txt
• openshift/requirements-pre-build.txt

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[mytreya-rh]

The verify-requirements CI job was failing independently of the review-comment fixes above, for an environmental reason: openshift/Dockerfile.requirements was installing pip and pip-tools unpinned ("latest"), and today's latest releases of each (pip==26.2.1, pip-tools==7.6.0) are mutually incompatible — pip-compile fails with:

TypeError: RequirementCommand.make_requirement_preparer() missing 1 required keyword-only argument: 'allow_editables'

This happens because pip-tools relies on pip's internal, unstable RequirementCommand API, so an unpinned pip can silently outpace the pip-tools release actually installed.

Fixed by pinning both to a tested-compatible pair (pip==24.3.1, pip-tools==7.6.0), consistent with how pipenv is already pinned in the same RUN step. Verified locally with the real openshift/Dockerfile.requirements — all 6 stages complete successfully. Folded the fix into the tooling commit (automate hermetic build requirements generation) and force-pushed; PR is still at 5 commits.

[mytreya-rh]

/test sanity

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

♻️ Duplicate comments (1)

openshift/hack/generate_requirements.py (1)

1017-1024: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

The deferred build-phase recompile still skips post-processing.

The previous review thread is marked as addressed, but the defect is still present in this code:

1. mapped is iterated in pre_build → build1 → build order. When the failing phase is pre_build or build1, requirements-build.in does not exist yet, build_in.exists() is False, and every constraint in later_pkgs is dropped with no warning.
2. Line 1024 writes requirements-build.txt directly. The post-processing at lines 1039-1042 applies to txt_path, not to build_txt. RPM-installed packages (cryptography, cffi, pycparser, maturin) therefore stay uncommented in requirements-build.txt, and the hermetic build tries to pip-install them.

🐛 Minimum fix

                 build_in  = out_dir / "requirements-build.in"
                 build_txt = out_dir / "requirements-build.txt"
+                extra = [s for p in later_pkgs for s in pkg_constraints.get(p, [])]
                 if build_in.exists():
                     existing = build_in.read_text()
-                    extra = [s for p in later_pkgs for s in pkg_constraints.get(p, [])]
                     build_in.write_text(existing + "\n".join(extra) + "\n")
-                    _pip_compile(build_in, build_txt, ["--allow-unsafe"])
+                    if _pip_compile(build_in, build_txt, ["--allow-unsafe"])[0]:
+                        c = _comment_out(
+                            _normalize_quirks(build_txt.read_text()), rpm_norms
+                        )
+                        build_txt.write_text(c)
+                elif extra:
+                    print(
+                        "  WARNING: requirements-build.in not written yet;"
+                        f" dropping build deps for {sorted(later_pkgs)}.",
+                        file=sys.stderr,
+                    )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/hack/generate_requirements.py` around lines 1017 - 1024, Update the
deferred build-phase handling around mapped, later_pkgs, and _pip_compile so
constraints are retained when requirements-build.in does not yet exist by
creating or initializing the file before appending them. After compiling
build_txt, apply the same post-processing used for txt_path so RPM-installed
packages are commented out in requirements-build.txt before the hermetic build
consumes it.

🧹 Nitpick comments (3)

.github/workflows/test-ansible.yml (1)

10-12: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Consider persist-credentials: false in the checkout steps.

The jobs do not push to the repository. They only build and run tests. Disable credential persistence so the token is not written to .git/config for later steps.

🔒 Proposed change

       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false

Also applies to lines 23-25.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test-ansible.yml around lines 10 - 12, Update both
checkout steps using actions/checkout@v7 to set persist-credentials to false
alongside fetch-depth, ensuring the repository token is not persisted in
.git/config.

Source: Linters/SAST tools

openshift/hack/generate_requirements.py (1)

531-532: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Temp file names can collide between sibling recursion groups.

split_{_depth}_{len(packages)} is not unique. Two sibling groups at the same depth with the same package count write the same .in and .txt files. Execution is sequential, so the result is currently correct, but the collision is fragile. The hardcoded _depth=10 at line 1002 exists for the same reason.

Consider a monotonic counter or tempfile.mkstemp(dir=tmp) for these intermediate files.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/hack/generate_requirements.py` around lines 531 - 532, Make the
intermediate filenames created in the recursive package-splitting flow unique
across sibling groups by replacing the depth/package-count naming in merged_in
and merged_out with a monotonic counter or tempfile-based allocation within tmp.
Also remove the hardcoded _depth=10 workaround and pass or derive the actual
recursion depth consistently through the relevant generation function.

images/ansible-operator/pipfile.Dockerfile (1)

24-26: 🩺 Stability & Availability | 🔵 Trivial | 🏗️ Heavy lift

Keep vulnerability scanning consistent.

pipenv audit is valid in pipenv==2026.6.2 and invokes pip-audit, so the Dockerfile commands are valid. generate_requirements.py still uses the older Safety-based pipenv check path and parses Safety output. Migrate it to pipenv audit with a compatible parser, or document the intentional difference.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@images/ansible-operator/pipfile.Dockerfile` around lines 24 - 26, Update
generate_requirements.py to use pipenv audit instead of the legacy Safety-based
pipenv check flow, and revise its vulnerability-output parsing to handle
pip-audit results consistently with the Dockerfile’s pipenv audit command;
alternatively, document the intentional divergence if preserving the existing
behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@openshift/hack/generate_requirements.py`:
- Around line 1017-1024: Update the deferred build-phase handling around mapped,
later_pkgs, and _pip_compile so constraints are retained when
requirements-build.in does not yet exist by creating or initializing the file
before appending them. After compiling build_txt, apply the same post-processing
used for txt_path so RPM-installed packages are commented out in
requirements-build.txt before the hermetic build consumes it.

---

Nitpick comments:
In @.github/workflows/test-ansible.yml:
- Around line 10-12: Update both checkout steps using actions/checkout@v7 to set
persist-credentials to false alongside fetch-depth, ensuring the repository
token is not persisted in .git/config.

In `@images/ansible-operator/pipfile.Dockerfile`:
- Around line 24-26: Update generate_requirements.py to use pipenv audit instead
of the legacy Safety-based pipenv check flow, and revise its
vulnerability-output parsing to handle pip-audit results consistently with the
Dockerfile’s pipenv audit command; alternatively, document the intentional
divergence if preserving the existing behavior.

In `@openshift/hack/generate_requirements.py`:
- Around line 531-532: Make the intermediate filenames created in the recursive
package-splitting flow unique across sibling groups by replacing the
depth/package-count naming in merged_in and merged_out with a monotonic counter
or tempfile-based allocation within tmp. Also remove the hardcoded _depth=10
workaround and pass or derive the actual recursion depth consistently through
the relevant generation function.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fd431b66-4748-4cc2-aede-730d023d1992

📥 Commits

Reviewing files that changed from the base of the PR and between 0a0c4c2 and 7e914b7.

⛔ Files ignored due to path filters (255)

• go.sum is excluded by !**/*.sum
• images/ansible-operator/Pipfile.lock is excluded by !**/*.lock
• openshift/Pipfile.lock is excluded by !**/*.lock
• vendor/cel.dev/expr/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/MODULE.bazel is excluded by !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/checked.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/eval.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/explain.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/syntax.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/cel.dev/expr/value.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/.gitignore is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/core_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/ginkgo.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/helpergo_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/internal/global/init.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/internal/suite.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/errors.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/flags.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/format/format.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/gomega_dsl.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/matchers.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/matchers/be_a_slice_matcher.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/matchers/be_an_array_matcher.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/onsi/gomega/types/types.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/.golangci.yml is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/CONTRIBUTING.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/Makefile is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/RELEASING.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/encoder.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/hash.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/internal/attribute.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/kv.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/type_string.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/value.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/baggage/baggage.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/dependencies.Dockerfile is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/errorhandler/errorhandler.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/handler.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/state.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/asyncfloat64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/asyncint64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/meter.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/syncfloat64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/syncint64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/baggage.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/trace_context.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/requirements.txt is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/internal/x/features.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/builtin.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/container.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/env.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id_readfile.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/os.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/process.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/resource.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/batch_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/simple_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/tracer.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/provider.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/sampling.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/span.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.39.0/MIGRATION.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.39.0/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/MIGRATION.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/attribute_group.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/error_type.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/exception.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/otelconv/metric.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.40.0/schema.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/auto.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/tracestate.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/versions.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/html/iter.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/html/node.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/html/nodetype_string.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/client_conn_pool.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/client_priority_go126.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/client_priority_go127.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/clientconn.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/frame.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/http2.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server_wrap.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport_wrap.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_priority_rfc7540.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_priority_rfc9218.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_random.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_roundrobin.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/go118.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/idna.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/idna9.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/pre_go118.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/punycode.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables10.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables11.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables12.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables13.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables15.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables17.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/tables9.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/trie12.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/idna/trie13.0.0.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/internal/httpcommon/request.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/internal/httpsfv/httpsfv.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/deviceauth.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/oauth2.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/pkce.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/token.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sync/errgroup/errgroup.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sync/singleflight/singleflight.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/plan9/syscall_plan9.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/affinity_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ioctl_signed.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ioctl_unsigned.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/mkall.sh is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_arm.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_loong64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_solaris.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_unix.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zsyscall_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/aliases.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/dll_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/registry/key.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/security_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/syscall_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/types_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/windows/zsyscall_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/edge/edge.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/inspector/cursor.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/inspector/inspector.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/ast/inspector/iter.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/packages/golist.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/packages/packages.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/go/types/objectpath/objectpath.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/aliases/aliases.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/aliases/aliases_go122.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/event/core/event.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/event/keys/keys.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/event/label/label.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gcimporter/iexport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gcimporter/iimport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gcimporter/ureader.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/gocommand/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/imports/fix.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/imports/mod.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/imports/source_modindex.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/directories.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/index.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/lookup.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/modindex.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/modindex/symbols.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/pkgbits/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/stdlib/deps.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/typeparams/coretype.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/typeparams/free.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/typesinternal/types.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/tools/internal/versions/features.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/CONTRIBUTING.md is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/balancer.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/pickfirst/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer/subconn.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/balancer_wrapper.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/clientconn.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/credentials/credentials.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/credentials/tls.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/encoding.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/gzip/gzip.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/encoding/proto/proto.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/experimental/stats/metricregistry.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/experimental/stats/metrics.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/interceptor.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/balancer/weight/weight.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/buffer/unbounded.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/channelz/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/envconfig/envconfig.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/envconfig/xds.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/experimental.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/idle/idle.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/stats/metrics_recorder_list.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/stats/stats.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/client_stream.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/controlbuf.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/flowcontrol.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/handler_server.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/http2_client.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/http2_server.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/http_util.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/server_stream.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/internal/transport/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/mem/buffer_pool.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/mem/buffer_slice.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/mem/buffers.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/preloader.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/resolver/resolver.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/resolver_wrapper.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/rpc_util.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/stream.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/grpc/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/filedesc/desc.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/filedesc/desc_init.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/internal/version/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/reflect/protodesc/desc.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.go is excluded by !**/vendor/**, !vendor/**
• vendor/google.golang.org/protobuf/reflect/protodesc/proto.go is excluded by !**/vendor/**, !vendor/**
• vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (23)

• .github/workflows/release.yml
• .github/workflows/test-ansible.yml
• .github/workflows/test-sanity.yml
• .github/workflows/unit.yml
• Makefile
• go.mod
• images/ansible-operator/Dockerfile
• images/ansible-operator/Pipfile
• images/ansible-operator/pipfile.Dockerfile
• internal/version/version.go
• openshift/Dockerfile.requirements
• openshift/hack/generate_requirements.md
• openshift/hack/generate_requirements.py
• openshift/release/ansible/ansible_collections/cloud.common-3.0.0.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/community.docker-3.12.1.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/community.library_inventory_filtering_v1-1.1.5.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/kubernetes.core-3.2.0.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/operator_sdk.util-0.5.0.info/GALAXY.yml
• openshift/requirements-build.txt
• openshift/requirements-build1.txt
• openshift/requirements-pre-build.txt
• openshift/requirements.txt
• testdata/memcached-molecule-operator/Makefile

🚧 Files skipped from review as they are similar to previous changes (16)

• testdata/memcached-molecule-operator/Makefile
• Makefile
• openshift/release/ansible/ansible_collections/community.docker-3.12.1.info/GALAXY.yml
• internal/version/version.go
• openshift/requirements-build1.txt
• images/ansible-operator/Pipfile
• openshift/release/ansible/ansible_collections/cloud.common-3.0.0.info/GALAXY.yml
• openshift/release/ansible/ansible_collections/kubernetes.core-3.2.0.info/GALAXY.yml
• openshift/Dockerfile.requirements
• openshift/release/ansible/ansible_collections/community.library_inventory_filtering_v1-1.1.5.info/GALAXY.yml
• openshift/requirements.txt
• .github/workflows/release.yml
• images/ansible-operator/Dockerfile
• openshift/release/ansible/ansible_collections/operator_sdk.util-0.5.0.info/GALAXY.yml
• openshift/requirements-build.txt
• openshift/requirements-pre-build.txt

[chiragkyal]

I verified the final tree is byte-identical to the previous PR head everywhere except the script/doc files touched by the review fixes above (and the now-unnecessary rebase_upstream.sh tweak), so none of the requirements/Pipfile.lock content was regenerated or changed as part of this restructuring.

As I can see, some packages have been updated to the latest minor versions (https://github.com/openshift/ansible-operator-plugins/compare/4798c310f62ce08f1b6d640fc1ea81ba020ed4c1..7e914b77ffd5688128fa1156e5724cbb1cdebe5d) during a force push. Don't you think we may need another ART test build?

[chiragkyal]

Looks like there is no upstream commits now, everything is squashed into a single commit. Earlier we used to have all the upstream commits + a final Merge tag commit..Did this script change the behaviour?

xref: https://github.com/openshift/ansible-operator-plugins/pull/69/commits

[mytreya-rh]

I verified the final tree is byte-identical to the previous PR head everywhere except the script/doc files touched by the review fixes above (and the now-unnecessary rebase_upstream.sh tweak), so none of the requirements/Pipfile.lock content was regenerated or changed as part of this restructuring.

As I can see, some packages have been updated to the latest minor versions (https://github.com/openshift/ansible-operator-plugins/compare/4798c310f62ce08f1b6d640fc1ea81ba020ed4c1..7e914b77ffd5688128fa1156e5724cbb1cdebe5d) during a force push. Don't you think we may need another ART test build?

ya, the verify-requirements failed and i first locally regenerated the requirements from the script, saw that the diff was just minor version bumps, and hence checked it in to have the job passed.
i feel, we don't need an ART run for this because no package was removed or added in a way to change the interdependence between the various packages.
What was left out to be checked was whether the latest packages would be available, and based on this chai-bot answer: https://redhat-internal.slack.com/archives/CB95J6R4N/p1786095899631289?thread_ts=1786093058.098069&cid=CB95J6R4N it looks like there won't be a problem, unless you see any caveats.

[mytreya-rh]

@chiragkyal Good catch — you're right, and this was an unintended side effect of the restructuring, not something the automation script changed.

Root cause: to reorder the downstream commits during the restructuring, the Merge upstream tag v1.42.3 commit had to be moved, and it was moved via git cherry-pick. Cherry-picking a merge commit always produces a flat, single-parent commit — cherry-pick has to pick one parent as the "mainline" and simply replays that diff as a regular commit — so the actual upstream commit chain silently dropped off the second-parent link, even though the commit message still read "Merge upstream tag v1.42.3" and the file content itself was unaffected.

Fix: reconstructed the merge commit properly — same tree/content, same message, but with both parents restored (the downstream line + the actual upstream v1.42.3 tag commit). Verified via git diff against the previous branch head that this is a pure topology fix with zero content changes, and confirmed the second-parent chain now shows the full set of individual upstream commits, matching the structure from #69.

Force-pushed — the branch history should now look the way you'd expect (all upstream commits + a real two-parent merge commit).

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@openshift/Dockerfile.requirements`:
- Around line 29-31: Update stage1_resolve_runtime and auto_fix_cves so any
unresolved runtime CVE terminates requirements generation and fails the build,
preserving success only when all detected CVEs are fixed. Alternatively, remove
the fail-fast claim from the Dockerfile.requirements documentation and add the
project’s explicit accepted-risk process.
- Line 62: Add a final runtime stage after the existing build stage, copying
only the generated requirement artifacts and required runtime executable while
excluding Rust, Cargo, GCC, and development headers. Configure the export
directory as a writable volume owned by a non-root USER, run the ENTRYPOINT
under that user, and define a HEALTHCHECK for the final image.
- Line 24: Update each pip install command in the Dockerfile, including the
command upgrading pip and the commands at the referenced additional locations,
to use --no-cache-dir or remove /root/.cache/pip in the same layer so no pip
cache remains in the final image.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 43d54939-5da2-4b77-a72f-b4cd49aed5ec

📥 Commits

Reviewing files that changed from the base of the PR and between 7e914b7 and 23b59d6.

📒 Files selected for processing (1)

• openshift/Dockerfile.requirements

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Add a restricted final image stage.

This Dockerfile has one FROM instruction. The exported image therefore retains rust, cargo, gcc, and development headers, and its ENTRYPOINT runs as root. It also has no HEALTHCHECK.

Add a final stage that copies only the generated artifacts and required runtime executable. Set a non-root USER, make the writable export volume available to that user, and define the required health check.

As per path instructions, “Multi-stage builds; no build tools in final image”, “USER non-root; never run as root”, and “HEALTHCHECK defined” apply.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/Dockerfile.requirements` at line 62, Add a final runtime stage
after the existing build stage, copying only the generated requirement artifacts
and required runtime executable while excluding Rust, Cargo, GCC, and
development headers. Configure the export directory as a writable volume owned
by a non-root USER, run the ENTRYPOINT under that user, and define a HEALTHCHECK
for the final image.

Source: Path instructions