OCM-00000 | ci: Update bingo-tooling to v1.6.0

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/vuln	v1.1.4 → v1.6.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign davidleerh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

Removed the golang.org/x/vuln dependency declaration from .bingo/govulncheck.mod, retaining the module declaration and go 1.25.8 directive.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is a Renovate update notice and misses most required template sections like summary, issue context, testing, and verification.	Rewrite the PR description using the repository template, including PR Summary, issue context, related issues, change type, behavior changes, and test validation.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only updates .bingo dependency files; no Ginkgo tests or titles were added/changed, so the stability check is not applicable.
Test Structure And Quality	✅ Passed	Only .bingo dependency files changed; no Ginkgo test code was modified, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo/e2e test files were changed; the PR only removes govulncheck module/sum entries, so MicroShift test compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only .bingo dependency files changed; no Ginkgo/e2e tests were added or modified, so SNO compatibility concerns don’t apply.
Topology-Aware Scheduling Compatibility	✅ Passed	Only .bingo/govulncheck.mod/.sum changed; no deployment manifests, controllers, or scheduling constraints were modified.
Ote Binary Stdout Contract	✅ Passed	Only .bingo dependency metadata changed; no runtime source files or process-level stdout writes were added or modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo/e2e test files changed; the PR only edits .bingo govulncheck module/sum metadata, so IPv4/network assumptions aren’t introduced.
No-Weak-Crypto	✅ Passed	PR only removes govulncheck dependency metadata; diff adds no crypto code or secret comparisons.
Container-Privileges	✅ Passed	PR only updates .bingo dependency files; diff contains no container/K8s privilege settings or manifest changes.
No-Sensitive-Data-In-Logs	✅ Passed	PR only edits .bingo dependency metadata; no code or logging changes that could expose sensitive data.
Title check	✅ Passed	The title is concise and related to the dependency/tooling update, though it is broader than the exact file-level change.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/master/bingo-tooling

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@red-hat-konflux[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	bd72ec6	link	false	/test security
ci/prow/images-images	bd72ec6	link	true	/test images-images
ci/prow/e2e-presubmits-images	bd72ec6	link	true	/test e2e-presubmits-images
ci/prow/govulncheck	bd72ec6	link	false	/test govulncheck

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[amandahla]

@coderabbitai I dont understand, why Renovate is removing from the file? Is this something related to how bingo works?

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
gh pr view 3363 --repo openshift/rosa --json title,body,files,commits -q '.'
echo "---FILE CONTENT---"
gh api repos/openshift/rosa/contents/.bingo/govulncheck.mod?ref=main --jq '.content' | base64 -d
echo "---PR DIFF---"
gh pr diff 3363 --repo openshift/rosa

Length of output: 3211

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
gh api repos/openshift/rosa --jq '.default_branch'
echo "---FILE ON BASE BRANCH---"
gh api repos/openshift/rosa/contents/.bingo/govulncheck.mod?ref=master --jq '.content' | base64 -d
echo "---PR DIFF---"
gh pr diff 3363 --repo openshift/rosa
echo "---VARIABLES.MK / bingo config---"
gh api repos/openshift/rosa/contents/.bingo/variables.mk?ref=master --jq '.content' 2>/dev/null | base64 -d || true
echo "---Renovate config---"
gh api repos/openshift/rosa/contents/renovate.json?ref=master --jq '.content' 2>/dev/null | base64 -d || true

Length of output: 6564

---

@amandahla Good catch — this isn't something specific to how bingo works internally, it's a side effect of a Renovate/gomod post-update option interacting badly with bingo's synthetic per-tool go.mod files.

What's happening:

The .bingo/govulncheck.mod file is a placeholder module generated by bingo:

module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT

go 1.25.8

require golang.org/x/vuln v1.1.4 // cmd/govulncheck

There's no actual .go source file in that "module" that imports golang.org/x/vuln — bingo only uses the require line (plus the trailing // cmd/govulncheck comment) as metadata to know which version to go install for the tool. It's not a real dependency import.

Your renovate.json has:

"gomod": {
  ...
  "managerFilePatterns": [
    "/(^|/)\\.bingo/[^/]+\\.mod$/"
  ],
  "postUpdateOptions": [
    "gomodUpdateImportPaths",
    "gomodTidy"
  ],
  ...
}

gomodTidy tells Renovate to run go mod tidy after bumping the version. Since go mod tidy doesn't know about bingo's convention and sees no source file actually importing golang.org/x/vuln within that synthetic module, it concludes the dependency is unused and removes the require line entirely — which also empties govulncheck.sum. This is exactly what happened in PR #3363 (the version bump to v1.6.0 never landed; the require line was just deleted).

Suggested fix:

Add a packageRules entry that disables gomodTidy specifically for the .bingo/*.mod files, so it only bumps the version there without running tidy:

{
  "description": "Don't run gomodTidy on bingo tool mod files (they have no real Go source, tidy strips the require)",
  "matchManagers": ["gomod"],
  "matchFileNames": [".bingo/*.mod"],
  "postUpdateOptions": ["gomodUpdateImportPaths"]
}

Renovate merges packageRules on top of the base gomod config, so this override should apply only to files under .bingo/, leaving gomodTidy intact for your main go.mod/go.sum. You may want to confirm the array-override merge behavior (Renovate generally lets a later matching packageRules entry fully replace array-type options like postUpdateOptions for the matched files) with a test PR before relying on it broadly.

Would you like me to open a follow-up issue to track updating the Renovate/Mintmaker configuration for this?

[amandahla]

/hold

[red-hat-konflux]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v1.6.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.