HYPERFLEET-1332 - chore: replace bingo with Go 1.24 tool directives

[kuudori]

HYPERFLEET-1332

Replace Bingo / standalone go install with a single tools/go.mod using Go 1.24+ tool directives.
Tools are pinned in tools/go.mod and invoked via $(call gotool,<name>) in the Makefile.

Tools:

• golangci-lint v2.7.0

Also adds tools and verify-tools Make targets.

Follow-up changes (review comment fixes)

• Quote $(GO) and $(TOOL_MOD) in Makefile gotool and tool recipes to prevent shell injection (CWE-78)
• verify-tools now compares against HEAD (git diff HEAD --) instead of the working tree

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign crizzo71 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Bingo-managed metadata and lint installation logic were removed. The Makefile now runs golangci-lint through tools/go.mod and adds tools and verify-tools targets. The tools module declares Go 1.25.0, the lint tool, and pinned indirect dependencies. Repository documentation was updated to describe the new workflow.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Makefile
  participant GoTool as go tool
  participant ToolsModule as tools/go.mod
  participant Linter as golangci-lint
  Makefile->>GoTool: Run golangci-lint with tools/go.mod
  GoTool->>ToolsModule: Resolve tool dependency
  GoTool->>Linter: Execute lint ./...
  Makefile->>ToolsModule: Tidy and verify module files

Loading

Suggested reviewers: aredenba-rh, mbrudnoy, rafabene

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	PASS: No non-test/example log call includes token/password/credential/secret fields or interpolations; only masked-password comments in broker/broker.go. CWE-532.
No Hardcoded Secrets	✅ Passed	No added apiKey/secret/password literals or embedded-credential URLs; tools/go.sum contains expected Go checksum h1 hashes, not secrets.
No Weak Cryptography	✅ Passed	PASS: PR only changes Makefile/docs/tooling; diff search found no crypto/md5, crypto/des, crypto/rc4, SHA1 security use, ECB, or secret compares (CWE-327).
No Injection Vectors	✅ Passed	No CWE-89/78/79/502 pattern in the Makefile diff; tool names and paths are hardcoded, not user-controlled.
No Privileged Containers	✅ Passed	PASS: PR only changes Makefile; no Kubernetes/OpenShift manifests, Helm templates, or Dockerfiles were modified, so no privileged-container paths to flag (CWE-250/CWE-269).
No Pii Or Sensitive Data In Logs	✅ Passed	No changed logging statements expose PII or secrets; the diff is a Makefile recipe with a static error echo. CWE-532 not triggered.
Title check	✅ Passed	The title accurately identifies the main change: replacing Bingo with Go tool directives.
Description check	✅ Passed	The description matches the changeset and mentions the new tools module and Makefile targets.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/replace-bingo-with-go-tool-directives

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch chore/replace-bingo-with-go-tool-directives

---

_{Comment @coderabbitai help to get the list of available commands.}

[hyperfleet-ci-bot]

Risk Score: 1 — risk/low

Signal	Detail	Points
PR size	391 lines (>200)	+1
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Line 2: Update the gotool definition to quote TOOL_MOD when it is expanded
into the shell command, preventing command-line overrides from being interpreted
as separate commands while preserving the existing go tool invocation.
- Around line 15-16: Update the verify-tools target to compare tools/go.mod and
tools/go.sum against HEAD, including both staged and unstaged changes, and to
reject untracked generated files. Preserve the existing failure message and
tidy-tools remediation while ensuring any missing or modified tool files cause
the target to fail.

In `@tools/go.mod`:
- Around line 1-5: Align the repository’s tooling standards and documentation
with the new tools module and make lint workflow: update the dependency-pinning
and lint-installation guidance, including the relevant AGENTS.md section, to
consistently use the new approach instead of Bingo, or document an approved
exception if Bingo must remain required. Ensure the declared tooling and
supply-chain contract matches the implementation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 596c3e7f-cb55-460f-86f2-9ce08ce2d0aa

📥 Commits

Reviewing files that changed from the base of the PR and between 30c76de and 19ffcbf.

⛔ Files ignored due to path filters (1)

• tools/go.sum is excluded by !**/*.sum, !**/go.sum

📒 Files selected for processing (8)

• .bingo/.gitignore
• .bingo/README.md
• .bingo/Variables.mk
• .bingo/go.mod
• .bingo/golangci-lint.mod
• .bingo/variables.env
• Makefile
• tools/go.mod

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)

💤 Files with no reviewable changes (6)

• .bingo/.gitignore
• .bingo/Variables.mk
• .bingo/golangci-lint.mod
• .bingo/README.md
• .bingo/go.mod
• .bingo/variables.env

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

Makefile (1)

2-2: 🔒 Security & Privacy | 🟠 Major

Quote TOOL_MOD before shell expansion (CWE-78).

Line [2] inserts a command-line-overridable Make variable directly into a shell command. An override such as make TOOL_MOD='tools/go.mod; ...' lint can terminate the intended command and execute another command. Quote the expansion or enforce the fixed path. This is the same unresolved finding from the previous review.

Proposed fix

-gotool = go tool -modfile=$(TOOL_MOD) $(1)
+gotool = go tool -modfile="$(TOOL_MOD)" $(1)

As per path instructions, “Flag shell injection via unquoted variables in recipes.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Makefile` at line 2, Update the gotool definition to quote the TOOL_MOD
expansion before it is passed to the shell, preventing command-line overrides
from being interpreted as shell syntax. Preserve the existing go tool invocation
and $(1) argument behavior.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Line 16: Update the tool-module verification command in the Makefile target to
compare tools/go.mod and tools/go.sum against HEAD rather than the index, and
explicitly fail when either file is untracked. Preserve the existing out-of-date
message and make tools remediation behavior.

---

Duplicate comments:
In `@Makefile`:
- Line 2: Update the gotool definition to quote the TOOL_MOD expansion before it
is passed to the shell, preventing command-line overrides from being interpreted
as shell syntax. Preserve the existing go tool invocation and $(1) argument
behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 4561c429-2c24-43b3-861f-261a20cd7a1d

📥 Commits

Reviewing files that changed from the base of the PR and between 19ffcbf and e35ac9b.

⛔ Files ignored due to path filters (1)

• tools/go.sum is excluded by !**/*.sum, !**/go.sum

📒 Files selected for processing (10)

• .bingo/.gitignore
• .bingo/README.md
• .bingo/Variables.mk
• .bingo/go.mod
• .bingo/golangci-lint.mod
• .bingo/variables.env
• AGENTS.md
• Makefile
• README.md
• tools/go.mod

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against branch chore/replace-bingo-with-go-tool-directives instead of the default branch
• openshift-hyperfleet/hyperfleet-broker (manual)

💤 Files with no reviewable changes (6)

• .bingo/.gitignore
• .bingo/README.md
• .bingo/Variables.mk
• .bingo/go.mod
• .bingo/golangci-lint.mod
• .bingo/variables.env

🚧 Files skipped from review as they are similar to previous changes (1)

• tools/go.mod

[kuudori]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Line 17: Update the tool-module validation command in the Makefile’s
verify-tools flow to detect untracked tools/go.mod and tools/go.sum in addition
to tracked-file differences. Preserve the existing failure message and exit
behavior, while ensuring newly generated metadata causes verification to fail.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 7071aaf1-9f49-42fe-9cc0-43b4fa8a04fc

📥 Commits

Reviewing files that changed from the base of the PR and between cc63a62 and 94f077e.

📒 Files selected for processing (1)

• Makefile

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against branch chore/replace-bingo-with-go-tool-directives instead of the default branch
• openshift-hyperfleet/hyperfleet-broker (manual)

[kuudori]

/test unit

[kuudori]

/test lint

[kuudori]

/test lint