Skip to content

OCPCLOUD-3610: Update to K8s 1.36.3 dependencies - #496

Open
Leo6Leo wants to merge 4 commits into
openshift:mainfrom
Leo6Leo:OCPCLOUD-3609-k8s-1.36
Open

OCPCLOUD-3610: Update to K8s 1.36.3 dependencies#496
Leo6Leo wants to merge 4 commits into
openshift:mainfrom
Leo6Leo:OCPCLOUD-3609-k8s-1.36

Conversation

@Leo6Leo

@Leo6Leo Leo6Leo commented Jul 28, 2026

Copy link
Copy Markdown

Summary

  • Bump all Kubernetes dependencies from v0.35.x to v0.36.3
  • Bump controller-runtime v0.23.3 → v0.24.1, controller-tools v0.20.1 → v0.21.0
  • Bump cloud-provider-aws v1.35.1 → v1.36.1, cloud-provider-azure v1.35.1 → v1.36.3, cloud-provider-vsphere v1.34.0 → v1.36.0
  • Update OpenShift deps (api, client-go, library-go, cluster-api-actuator-pkg) to release-4.23
  • Remove cloud-provider-vsphere replace directive (v1.36.0 properly vendors k8s 1.36)
  • Bump Go version 1.25.0 → 1.26.0
  • Fix go vet non-constant format string in Eventf calls (new in Go 1.26)
  • Update OpenShift ginkgo fork for operator-tests to match k8s 1.36

Commits are separated per convention:

  1. Bump k8s to 1.36.3 dependencies — go.mod/go.sum changes only
  2. Vendor — vendor directory only
  3. Fix build after K8s 1.36 bump — code fixes

Test plan

  • make build passes locally
  • go vet ./... passes
  • Unit tests pass
  • Full CI integration tests

/epic OCPCLOUD-3610

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Updates

    • Updated the project’s Go toolchain and Kubernetes-related components to newer versions.
    • Refreshed supporting libraries and test tooling.
  • Bug Fixes

    • Corrected status event reporting so warning and progress messages display reliably.
  • Documentation

    • Added guidance for maintaining Go and Kubernetes versions, including update and verification steps.
  • Developer Experience

    • Added an automated workflow skill for standardizing Go and Kubernetes version updates.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 28, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 28, 2026

Copy link
Copy Markdown

@Leo6Leo: This pull request references OCPCLOUD-3609 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Bump all Kubernetes dependencies from v0.35.x to v0.36.3
  • Bump controller-runtime v0.23.3 → v0.24.1, controller-tools v0.20.1 → v0.21.0
  • Bump cloud-provider-aws v1.35.1 → v1.36.1, cloud-provider-azure v1.35.1 → v1.36.3, cloud-provider-vsphere v1.34.0 → v1.36.0
  • Update OpenShift deps (api, client-go, library-go, cluster-api-actuator-pkg) to release-4.23
  • Remove cloud-provider-vsphere replace directive (v1.36.0 properly vendors k8s 1.36)
  • Bump Go version 1.25.0 → 1.26.0
  • Fix go vet non-constant format string in Eventf calls (new in Go 1.26)
  • Update OpenShift ginkgo fork for operator-tests to match k8s 1.36

Commits are separated per convention:

  1. Bump k8s to 1.36.3 dependencies — go.mod/go.sum changes only
  2. Vendor — vendor directory only
  3. Fix build after K8s 1.36 bump — code fixes

Test plan

  • make build passes locally
  • go vet ./... passes
  • Unit tests pass
  • Full CI integration tests

/epic OCPCLOUD-3609

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from RadekManak and mdbooth July 28, 2026 15:34
@openshift-ci

openshift-ci Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign theobarberbany for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 28, 2026

Copy link
Copy Markdown

Walkthrough

The PR upgrades Go and Kubernetes-related dependencies in both modules, updates Kubernetes replacement pins, removes the main module’s vSphere override, documents the bump workflow, adds agent skill wiring, and changes two controller status events to use explicit formatted arguments.

Changes

Dependency and toolchain refresh

Layer / File(s) Summary
Module and replacement alignment
go.mod, openshift-tests/operator-tests/go.mod
Both modules move to Go 1.26; direct Kubernetes-related requirements are updated, operator-test replacement pins advance, and the root vSphere override is removed.
Transitive dependency refresh
go.mod, openshift-tests/operator-tests/go.mod
Indirect Azure, OpenAPI, JWT, Google, Prometheus, OpenTelemetry, and Kubernetes-related module versions are refreshed or removed.

Bump workflow and agent integration

Layer / File(s) Summary
Bump procedure documentation
docs/development/bump-k8s-go.md
Documents prerequisites, module updates, vendoring, infrastructure changes, commit structure, and verification steps.
Agent skill wiring
.agents/skills/bump-k8s-go/SKILL.md, .claude/skills/bump-k8s-go
Adds the Kubernetes/Go bump skill and links the Claude skill path to it.

Status event formatting

Layer / File(s) Summary
Explicit status event formatting
pkg/controllers/status.go
Degraded and progressing status events now pass messages through explicit %s format arguments.

Estimated code review effort: 2 (Simple) | ~15 minutes

Suggested reviewers: mdbooth, radekmanak

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No changed non-vendor _test.go files or Ginkgo DSL titles in the PR; edits are go.mod/vendor/status.go only.
Test Structure And Quality ✅ Passed PR changes no repository Ginkgo test files; only vendored test framework deps and non-test code, so the test-structure checklist isn’t applicable.
Microshift Test Compatibility ✅ Passed No non-vendor Ginkgo/e2e tests were added; the only code change is the Eventf format fix in pkg/controllers/status.go.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new repo-owned Ginkgo e2e tests were added; the diff is dependency/docs/controller churn only, so SNO-specific guards are not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed PR changes are dependency/docs/skill updates plus a harmless Eventf formatting fix; no pod specs, replicas, anti-affinity, PDBs, or topology-aware scheduling logic were added.
Ote Binary Stdout Contract ✅ Passed PASS: The PR only changes go.mod/go.sum, docs, and status.go; no changed main/init/TestMain/suite setup writes to stdout, and status.go only uses klog/Eventf.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The PR adds no new Ginkgo e2e tests; changed files are go.mod/vendor, one status.go fix, and docs/skills only.
No-Weak-Crypto ✅ Passed No new weak-crypto or secret-comparison code was added; the PR deletes x/crypto/ssh and blowfish implementations, and other crypto edits are docs/limits only.
Container-Privileges ✅ Passed No PR diff adds privileged/hostNetwork/allowPrivilegeEscalation/root settings; the matching manifest lines are pre-existing and unchanged.
No-Sensitive-Data-In-Logs ✅ Passed Changed log lines in pkg/controllers/status.go only emit errors and release/version messages; no passwords, tokens, keys, PII, or host/customer data appear.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: updating Kubernetes dependencies to 1.36.3.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
go.mod (2)

5-37: 🔒 Security & Privacy | 🔵 Trivial

Run OSV/CVE checks against the refreshed dependency graph.

The manifest pins many new direct and indirect versions, but version changes alone do not establish vulnerability status. Verify both modules with the repository’s supported OSV scanner and confirm corresponding go.sum entries and build provenance remain valid.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 5 - 37, Run the repository-supported OSV/CVE scanner
against the refreshed Go dependency graph in go.mod, including direct and
indirect modules, and address any reported vulnerabilities. Regenerate or
validate go.sum so every resolved dependency has matching integrity entries,
then verify the dependency update still builds successfully with reproducible
provenance.

Source: Path instructions


3-42: 🩺 Stability & Availability | 🔵 Trivial

Verify the upgraded toolchain and both module graphs before merge.

Line [3] raises the repository requirement to Go 1.26.0, while openshift-tests/operator-tests is a separate module. Confirm CI/build images use Go 1.26.0, then run make precommit, go mod verify, and tests—including race-mode tests—from both module roots.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 3 - 42, Validate the Go 1.26.0 requirement in go.mod
against all CI and build images, including the separate
openshift-tests/operator-tests module. From each module root, run make
precommit, go mod verify, and the complete test suite with race-mode tests, then
resolve any toolchain, dependency, or test failures before merging.

Source: Learnings

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@go.mod`:
- Around line 5-37: Run the repository-supported OSV/CVE scanner against the
refreshed Go dependency graph in go.mod, including direct and indirect modules,
and address any reported vulnerabilities. Regenerate or validate go.sum so every
resolved dependency has matching integrity entries, then verify the dependency
update still builds successfully with reproducible provenance.
- Around line 3-42: Validate the Go 1.26.0 requirement in go.mod against all CI
and build images, including the separate openshift-tests/operator-tests module.
From each module root, run make precommit, go mod verify, and the complete test
suite with race-mode tests, then resolve any toolchain, dependency, or test
failures before merging.

@Leo6Leo Leo6Leo changed the title OCPCLOUD-3609: Update to K8s 1.36.3 dependencies OCPCLOUD-361-: Update to K8s 1.36.3 dependencies Jul 28, 2026
@openshift-ci-robot openshift-ci-robot removed the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 28, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@Leo6Leo: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

Details

In response to this:

Summary

  • Bump all Kubernetes dependencies from v0.35.x to v0.36.3
  • Bump controller-runtime v0.23.3 → v0.24.1, controller-tools v0.20.1 → v0.21.0
  • Bump cloud-provider-aws v1.35.1 → v1.36.1, cloud-provider-azure v1.35.1 → v1.36.3, cloud-provider-vsphere v1.34.0 → v1.36.0
  • Update OpenShift deps (api, client-go, library-go, cluster-api-actuator-pkg) to release-4.23
  • Remove cloud-provider-vsphere replace directive (v1.36.0 properly vendors k8s 1.36)
  • Bump Go version 1.25.0 → 1.26.0
  • Fix go vet non-constant format string in Eventf calls (new in Go 1.26)
  • Update OpenShift ginkgo fork for operator-tests to match k8s 1.36

Commits are separated per convention:

  1. Bump k8s to 1.36.3 dependencies — go.mod/go.sum changes only
  2. Vendor — vendor directory only
  3. Fix build after K8s 1.36 bump — code fixes

Test plan

  • make build passes locally
  • go vet ./... passes
  • Unit tests pass
  • Full CI integration tests

/epic OCPCLOUD-3609

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Bug Fixes

  • Improved Kubernetes event messages so status degradation and upgrade details are displayed correctly.

  • Maintenance

  • Updated the Go toolchain and refreshed Kubernetes, OpenShift, cloud-provider, observability, and testing dependencies.

  • Updated operator test dependency versions and compatibility pins.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@Leo6Leo Leo6Leo changed the title OCPCLOUD-361-: Update to K8s 1.36.3 dependencies OCPCLOUD-3610: Update to K8s 1.36.3 dependencies Jul 28, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 28, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 28, 2026

Copy link
Copy Markdown

@Leo6Leo: This pull request references OCPCLOUD-3610 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Bump all Kubernetes dependencies from v0.35.x to v0.36.3
  • Bump controller-runtime v0.23.3 → v0.24.1, controller-tools v0.20.1 → v0.21.0
  • Bump cloud-provider-aws v1.35.1 → v1.36.1, cloud-provider-azure v1.35.1 → v1.36.3, cloud-provider-vsphere v1.34.0 → v1.36.0
  • Update OpenShift deps (api, client-go, library-go, cluster-api-actuator-pkg) to release-4.23
  • Remove cloud-provider-vsphere replace directive (v1.36.0 properly vendors k8s 1.36)
  • Bump Go version 1.25.0 → 1.26.0
  • Fix go vet non-constant format string in Eventf calls (new in Go 1.26)
  • Update OpenShift ginkgo fork for operator-tests to match k8s 1.36

Commits are separated per convention:

  1. Bump k8s to 1.36.3 dependencies — go.mod/go.sum changes only
  2. Vendor — vendor directory only
  3. Fix build after K8s 1.36 bump — code fixes

Test plan

  • make build passes locally
  • go vet ./... passes
  • Unit tests pass
  • Full CI integration tests

/epic OCPCLOUD-3609

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Bug Fixes

  • Improved Kubernetes event messages so status degradation and upgrade details are displayed correctly.

  • Maintenance

  • Updated the Go toolchain and refreshed Kubernetes, OpenShift, cloud-provider, observability, and testing dependencies.

  • Updated operator test dependency versions and compatibility pins.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@Leo6Leo

Leo6Leo commented Jul 28, 2026

Copy link
Copy Markdown
Author

/retest

@theobarberbany

Copy link
Copy Markdown
Contributor

@Leo6Leo can we split the go.mod and vendoring changes from the last commit into the previous two?

Leo6Leo and others added 4 commits July 29, 2026 14:13
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fix non-constant format string in Eventf calls (go vet in Go 1.26)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add a reusable skill that documents the K8s/Go version bump workflow
specific to this repo, covering workspace modules, cloud providers,
vendoring, and commit structure conventions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Leo6Leo
Leo6Leo force-pushed the OCPCLOUD-3609-k8s-1.36 branch from cd2ee02 to 15572ea Compare July 29, 2026 18:43
@coderabbitai

coderabbitai Bot commented Jul 29, 2026

Copy link
Copy Markdown

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details
Validation Failed: {"resource":"IssueComment","code":"custom","field":"body","message":"body is too long (maximum is 65536 characters)"} - https://docs.github.com/rest/issues/comments#update-an-issue-comment

@Leo6Leo

Leo6Leo commented Jul 29, 2026

Copy link
Copy Markdown
Author

As @damdo suggested, added the skill that follows the pattern here

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agents/skills/bump-k8s-go/SKILL.md:
- Around line 7-8: Narrow the allowed-tools declaration for the skill to
read-only repository operations and only the exact commands required by its
documented workflow. Remove gh entirely and exclude unrestricted git, make,
curl, find, cat, grep, and go access unless each is replaced with a narrowly
scoped read-only or required command that cannot mutate files, access the
network, or execute arbitrary Makefile targets.
- Around line 1-8: Update the skill metadata at the beginning of the document by
wrapping description, argument-hint, and allowed-tools in YAML frontmatter
delimiters (`---`). Preserve their existing values and leave the remaining
Markdown body unchanged.
- Around line 1-15: Add the frontmatter setting disable-model-invocation: true
to the bump-k8s-go skill metadata, alongside the existing description and
argument-hint fields, so the skill runs only when explicitly invoked via
/bump-k8s-go.

In `@docs/development/bump-k8s-go.md`:
- Around line 52-58: Update every fenced code block in bump-k8s-go.md to declare
a language, using bash for shell command examples and text for commit-message
examples, including the additional referenced blocks.
- Around line 80-87: Update the commit instructions around Step 5 and the
referenced commit-boundary section so each generated file, including
go.work.sum, has exactly one owning commit; account for metadata rewrites caused
by hack/go-mod.sh by assigning those changes consistently to the vendor commit.
Add a clean-diff checkpoint immediately after vendoring, requiring the expected
vendor-related files to be reviewed and no unintended changes to remain before
committing.
- Around line 124-129: Update the Step 9 verification checklist to add explicit
test commands for the non-root modules openshift-tests/operator-tests and
openshift-tests/ccm-aws-tests, running the latter with GOWORK=off. Keep the
existing root make test check and ensure the checklist covers every Go module.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

Comment on lines +1 to +8
description
Bump Kubernetes and Go to new minor versions across the project. Use when upgrading k8s (e.g. from 1.35 to 1.36) and Go (e.g. from 1.25 to 1.26). Handles go.mod, go.work, openshift-tests modules, cloud providers, and vendoring.

argument-hint
<k8s-minor> <go-minor> (e.g. 1.36 1.26)

allowed-tools
Bash(go *) Bash(git *) Bash(grep *) Bash(find *) Bash(gh *) Bash(make *) Bash(curl *) Bash(cat *)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/sh
set -eu
file=.agents/skills/bump-k8s-go/SKILL.md
test "$(sed -n '1p' "$file")" = "---"
test "$(grep -c '^---$' "$file")" -ge 2
grep -q '^description:' "$file"
grep -q '^argument-hint:' "$file"
grep -q '^allowed-tools:' "$file"

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 189


🏁 Script executed:

#!/bin/sh
set -eu

file=.agents/skills/bump-k8s-go/SKILL.md
printf '\n== file head ==\n'
sed -n '1,30p' "$file"

printf '\n== line numbers ==\n'
cat -n "$file" | sed -n '1,30p'

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 1617


🏁 Script executed:

#!/bin/sh
set -eu

printf '\n== skill files ==\n'
find .agents/skills -name 'SKILL.md' -maxdepth 3 | sort

printf '\n== first 20 lines of sibling skills ==\n'
for f in $(find .agents/skills -name 'SKILL.md' -maxdepth 3 | sort); do
  printf '\n--- %s ---\n' "$f"
  sed -n '1,20p' "$f"
done

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 972


🌐 Web query:

Claude Code skills YAML frontmatter SKILL.md description argument-hint allowed-tools official docs

💡 Result:

In Claude Code, custom skills are defined using a SKILL.md file placed within specific directories (e.g., ~/.claude/skills/ or.claude/skills/). This file consists of two sections: YAML frontmatter delimited by --- markers, and markdown content that provides instructions for the skill [1][2][3]. The YAML frontmatter controls the skill's behavior and discovery. Key fields include: description: A recommended field that defines what the skill does and when it should be used. Claude uses this text to decide when to automatically load and apply the skill. If omitted, the first paragraph of the markdown content is used as the fallback [1][4]. It is best practice to front-load trigger phrases to ensure accuracy within the 1,536-character truncation limit [1][5]. argument-hint: A string that provides a hint during command autocomplete (e.g., [issue-number] or [filename]). It is purely cosmetic and does not perform input validation, but it serves as helpful documentation for users invoking the command via the CLI [1][6][5]. allowed-tools: An optional field that defines an allowlist of tools Claude can use without asking for explicit permission while the skill is active. This field accepts a space- or comma-separated string, or a YAML list. Patterns like Bash(command *) are supported for more granular control [1][7][5]. Other notable frontmatter fields include: - disable-model-invocation: Set to true to prevent automatic triggering by Claude, forcing the skill to be invoked manually via its slash command [1][4]. - arguments: Defines named positional arguments for string substitution within the markdown content [1]. - model: Optionally specifies which model version to use for the skill [7][5]. By configuring these fields, you can effectively manage how Claude discovers, restricts, and executes your custom skills [1][3].

Citations:


Add YAML frontmatter to this skill. description, argument-hint, and allowed-tools are plain text here, so Claude Code won’t parse them as skill metadata. Move them under --- markers; the Markdown body can stay unchanged.

🧰 Tools
🪛 LanguageTool

[style] ~2-~2: This is not the usual sequence for adjectives that have no special emphasis.
Context: description Bump Kubernetes and Go to new minor versions across the project. Use when u...

(EN_ADJ_ORDER)

🪛 markdownlint-cli2 (0.23.1)

[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)


[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)


[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)


[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.agents/skills/bump-k8s-go/SKILL.md around lines 1 - 8, Update the skill
metadata at the beginning of the document by wrapping description,
argument-hint, and allowed-tools in YAML frontmatter delimiters (`---`).
Preserve their existing values and leave the remaining Markdown body unchanged.

Comment on lines +1 to +15
description
Bump Kubernetes and Go to new minor versions across the project. Use when upgrading k8s (e.g. from 1.35 to 1.36) and Go (e.g. from 1.25 to 1.26). Handles go.mod, go.work, openshift-tests modules, cloud providers, and vendoring.

argument-hint
<k8s-minor> <go-minor> (e.g. 1.36 1.26)

allowed-tools
Bash(go *) Bash(git *) Bash(grep *) Bash(find *) Bash(gh *) Bash(make *) Bash(curl *) Bash(cat *)

Bump Kubernetes and Go Versions
================================

Target versions: **$ARGUMENTS**

Follow the instructions in docs/development/bump-k8s-go.md exactly, using `$ARGUMENTS` as the target Kubernetes and Go minor versions.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- SKILL file ---\n'
cat -n .agents/skills/bump-k8s-go/SKILL.md | sed -n '1,80p'

printf '\n--- skill-related docs/search ---\n'
rg -n "disable-model-invocation|model invocation|skills" .agents docs -g '*.md' -g '*.yaml' -g '*.yml' -g '*.json' | sed -n '1,200p'

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 280


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- file list around skills ---\n'
git ls-files .agents/skills docs | sed -n '1,200p'

printf '\n--- locate any skill metadata examples ---\n'
rg -n "^disable-model-invocation:|^argument-hint:|^allowed-tools:|^description:" .agents docs -g 'SKILL.md' -g '*.md' | sed -n '1,200p'

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 280


🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the skill file and any references to model invocation controls in-repo.
printf '--- .agents/skills/bump-k8s-go/SKILL.md ---\n'
cat -n .agents/skills/bump-k8s-go/SKILL.md | sed -n '1,40p'

printf '\n--- references to disable-model-invocation ---\n'
rg -n "disable-model-invocation|model-driven invocation|automatic invocation|skill.*invocation" . -g '*.md' -g '*.yaml' -g '*.yml' -g '*.json' | sed -n '1,200p'

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 280


🌐 Web query:

Claude Code skills disable-model-invocation true skill metadata

💡 Result:

In Claude Code, the disable-model-invocation: true setting is a metadata flag used in a skill's SKILL.md frontmatter to manage how the model interacts with that skill [1][2]. Intended Behavior: The primary purpose of disable-model-invocation: true is to prevent Claude from autonomously triggering a skill based on conversation context [1][3]. It is designed for workflows that carry side effects—such as deployments, commits, or sending messages—where you want to ensure the action is only executed when you manually invoke it via a slash command (e.g., /your-skill-name) [1][3]. It also prevents the skill from being preloaded into subagents or triggered by scheduled tasks [1][2]. Known Issues and Discrepancies: While official documentation describes the behavior above, users have reported inconsistent implementation in certain versions of Claude Code [4][5]. Specifically: - Some reports indicate that setting this flag may cause the skill to be completely hidden from the session, making it unavailable even for manual slash command invocation [4]. - Other reports state that while the skill might appear, attempting to use the slash command results in an error indicating the skill cannot be used because of the disable-model-invocation setting [5]. These issues suggest that while disable-model-invocation: true is the documented mechanism for controlling autonomous invocation, its behavior may vary depending on the specific version of Claude Code you are running [4][5]. If you encounter issues where the skill is blocked from manual use, you may need to check the official issue tracker for updates or version-specific workarounds [4][5]. Note on user-invocable: It is common to confuse disable-model-invocation with user-invocable. The user-invocable field only controls whether the skill appears in your / slash command menu; it does not stop the model from triggering the skill autonomously [1][6]. To prevent the model from using a skill, you must use disable-model-invocation: true [6].

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- .agents/skills/bump-k8s-go/SKILL.md ---'
cat -n .agents/skills/bump-k8s-go/SKILL.md | sed -n '1,80p'

printf '%s\n' ''
printf '%s\n' '--- any skill metadata examples in repo ---'
rg -n "disable-model-invocation|user-invocable|argument-hint|allowed-tools|description:" . -g 'SKILL.md' -g '*.md' -g '*.yaml' -g '*.yml' | sed -n '1,200p'

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 37232


Disable automatic invocation for this mutating skill. Add disable-model-invocation: true so it only runs through explicit /bump-k8s-go <k8s-minor> <go-minor> calls.

🧰 Tools
🪛 LanguageTool

[style] ~2-~2: This is not the usual sequence for adjectives that have no special emphasis.
Context: description Bump Kubernetes and Go to new minor versions across the project. Use when u...

(EN_ADJ_ORDER)

🪛 markdownlint-cli2 (0.23.1)

[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)


[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)


[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)


[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.agents/skills/bump-k8s-go/SKILL.md around lines 1 - 15, Add the frontmatter
setting disable-model-invocation: true to the bump-k8s-go skill metadata,
alongside the existing description and argument-hint fields, so the skill runs
only when explicitly invoked via /bump-k8s-go.

Comment on lines +7 to +8
allowed-tools
Bash(go *) Bash(git *) Bash(grep *) Bash(find *) Bash(gh *) Bash(make *) Bash(curl *) Bash(cat *)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Narrow the pre-approved shell surface.

Once frontmatter is fixed, git *, gh *, make *, curl *, find *, cat *, grep *, and go * grant permissionless mutation, arbitrary network access, broad filesystem reads, and arbitrary Makefile execution. git * and gh * also conflict with the documentation’s “do not push or create a PR” rule. Restrict this to read-only repository tools and exact required commands; remove gh entirely. Claude Code documents allowed-tools as permissionless access during the skill turn. (code.claude.com)

As per path instructions, IDE and AI-tool configuration must be reviewed for broad filesystem or network access.

🧰 Tools
🪛 markdownlint-cli2 (0.23.1)

[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)


[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)


[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)


[warning] 8-8: Spaces inside emphasis markers

(MD037, no-space-in-emphasis)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.agents/skills/bump-k8s-go/SKILL.md around lines 7 - 8, Narrow the
allowed-tools declaration for the skill to read-only repository operations and
only the exact commands required by its documented workflow. Remove gh entirely
and exclude unrestricted git, make, curl, find, cat, grep, and go access unless
each is replaced with a narrowly scoped read-only or required command that
cannot mutate files, access the network, or execute arbitrary Makefile targets.

Source: Path instructions

Comment on lines +52 to +58
```
go get github.com/openshift/api@release-4.XX
go get github.com/openshift/client-go@release-4.XX
go get github.com/openshift/library-go@release-4.XX
go get github.com/openshift/cluster-api-actuator-pkg/testutils@release-4.XX
go get github.com/openshift/controller-runtime-common@release-4.XX
```

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Add languages to fenced code blocks.

markdownlint-cli2 reports MD040 for these fences. Use bash for command examples and text for commit-message examples.

Proposed fix
-  ```
+  ```bash
...
-   ```
+   ```text

Also applies to: 67-69, 108-110, 113-115, 118-120

🧰 Tools
🪛 markdownlint-cli2 (0.23.1)

[warning] 52-52: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/development/bump-k8s-go.md` around lines 52 - 58, Update every fenced
code block in bump-k8s-go.md to declare a language, using bash for shell command
examples and text for commit-message examples, including the additional
referenced blocks.

Source: Linters/SAST tools

Comment on lines +80 to +87
#### Step 5: Vendor
```bash
bash hack/go-mod.sh
```
This script handles:
1. `openshift-tests/ccm-aws-tests` vendoring (outside workspace, `GOWORK=off`)
2. Workspace module discovery, two-pass `go mod tidy`, `go work sync`, `go mod verify`
3. Unified `go work vendor -v`

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Resolve the commit-boundary contradiction.

go.work.sum is assigned to both the version-bump commit and the vendor commit, while hack/go-mod.sh reruns go mod tidy and go work sync, which can rewrite module metadata. Define one owner per file and add a clean-diff checkpoint after vendoring.

Also applies to: 103-117

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/development/bump-k8s-go.md` around lines 80 - 87, Update the commit
instructions around Step 5 and the referenced commit-boundary section so each
generated file, including go.work.sum, has exactly one owning commit; account
for metadata rewrites caused by hack/go-mod.sh by assigning those changes
consistently to the vendor commit. Add a clean-diff checkpoint immediately after
vendoring, requiring the expected vendor-related files to be reviewed and no
unintended changes to remain before committing.

Comment on lines +124 to +129
### Verification (Step 9)

1. `make build` — all binaries compile
2. `go vet ./...` — no vet errors
3. `make test` — unit tests pass (integration tests via envtest are heavy, prefer CI)
4. `make lint` — no lint violations

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Top-level files:\n'
git ls-files | sed -n '1,200p'

printf '\nRelevant document excerpt:\n'
nl -ba docs/development/bump-k8s-go.md | sed -n '110,150p'

printf '\nSearch for module/workspace/test guidance:\n'
rg -n --hidden --glob '!**/.git/**' -e 'ccm-aws-tests|openshift-tests/operator-tests|GOWORK=off|race|integration|envtest|go vet ./\\.\\.|make test|make lint|make build' .

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 14007


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Relevant Go module/workspace files:\n'
git ls-files '*.mod' '*.sum' 'go.work' 'go.work.sum' | sed -n '1,200p'

printf '\nOutline likely relevant docs/scripts if present:\n'
fd -t f 'bump-k8s-go.md|Makefile|go.work|go.mod' .

printf '\nExact section around Step 9:\n'
nl -ba docs/development/bump-k8s-go.md | sed -n '120,135p'

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 9257


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Step 9 section:\n'
sed -n '118,145p' docs/development/bump-k8s-go.md

printf '\nMakefile targets mentioning test/vet/lint/build/race/integration:\n'
rg -n -C 2 '^(build|test|lint|vet|race|integration)|go test|go vet|GOWORK=off|openshift-tests/operator-tests|ccm-aws-tests' Makefile hack docs .github .ci-operator.yaml

printf '\ngo.work contents:\n'
sed -n '1,120p' go.work

printf '\noperator-tests module file header:\n'
sed -n '1,120p' openshift-tests/operator-tests/go.mod

printf '\nccm-aws-tests module file header:\n'
sed -n '1,120p' openshift-tests/ccm-aws-tests/go.mod

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 8864


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Race/integration target search:\n'
rg -n --hidden --glob '!**/.git/**' '\brace\b|integration|test-race|race-test|go test -race' Makefile docs hack .ci-operator.yaml .github openshift-tests

printf '\nMakefile around test targets:\n'
sed -n '1,130p' Makefile

printf '\nDocs mentioning testing commands:\n'
rg -n --hidden --glob '!**/.git/**' 'make test|go test -race|integration tests|envtest|GOWORK=off|operator-tests|ccm-aws-tests' docs README.md hack openshift-tests

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 50407


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'make targets list (names only):\n'
awk 'BEGIN{FS=":"}
     /^[A-Za-z0-9_.-]+:/ {
       tgt=$1
       sub(/^\./,"",tgt)
       if (tgt !~ /^`#/` && tgt !~ /%/ ) print tgt
     }' Makefile | sed -n '1,120p'

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 502


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'hack/ci-test.sh relevant lines:\n'
sed -n '1,80p' hack/ci-test.sh

printf '\nMakefile unit target:\n'
sed -n '30,45p' Makefile

printf '\nMakefile build target:\n'
sed -n '40,65p' Makefile

printf '\nStep 9 section again:\n'
sed -n '122,130p' docs/development/bump-k8s-go.md

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 4621


Step 9 still needs the non-root modules. make test covers the root workspace and already runs with --race there, but it does not exercise openshift-tests/operator-tests or openshift-tests/ccm-aws-tests; add explicit module-level checks, with GOWORK=off for ccm-aws-tests, so the bump covers every Go module in the repo.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/development/bump-k8s-go.md` around lines 124 - 129, Update the Step 9
verification checklist to add explicit test commands for the non-root modules
openshift-tests/operator-tests and openshift-tests/ccm-aws-tests, running the
latter with GOWORK=off. Keep the existing root make test check and ensure the
checklist covers every Go module.

Source: Learnings

@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

@Leo6Leo: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/regression-clusterinfra-vsphere-ipi-ccm 15572ea link false /test regression-clusterinfra-vsphere-ipi-ccm

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants