HYPERFLEET-1337 - chore: replace bingo with Go 1.24 tool directives by kuudori · Pull Request #11 · openshift-hyperfleet/maestro-cli

kuudori · 2026-07-10T18:58:20Z

HYPERFLEET-1337

Replace Bingo / standalone go install with a single tools/go.mod using Go 1.24+ tool directives.
Tools are pinned in tools/go.mod and invoked via $(call gotool,<name>) in the Makefile.

Tools:

golangci-lint v2.7.0

Also adds tools and verify-tools Make targets.

Follow-up changes (review comment fixes)

Quote $(GOCMD) and $(TOOL_MOD) in Makefile gotool and tool recipes to prevent shell injection (CWE-78)
verify-tools now compares against HEAD (git diff HEAD --) instead of the working tree

coderabbitai · 2026-07-10T18:58:29Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Bingo-managed tool metadata and helper files are removed. The main go.mod declares goimports, while tools/go.mod declares golangci-lint and its indirect dependencies. The Makefile invokes both tools through Go modules, adds tools and verify-tools targets, and removes the Bingo include. The linter guidance comment is updated accordingly.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	No non-test log/printf call contains token/password/credential/secret; CWE-532 not introduced.
No Hardcoded Secrets	✅ Passed	No hardcoded secrets, credentialed URLs, private keys, or secret-name string literals found in the changed tooling/config files; no CWE-798 issue detected.
No Weak Cryptography	✅ Passed	PASS: PR only alters Makefile/tooling; no crypto/md5, crypto/des, crypto/rc4, SHA1-for-security, ECB, custom crypto, or secret comparisons. No CWE-327/CWE-208 findings.
No Injection Vectors	✅ Passed	PASS: No CWE-78/89/79/502 sink was introduced; the Makefile uses hardcoded tool names and quoted GOCMD/TOOL_MOD, so no user-controlled injection path.
No Privileged Containers	✅ Passed	Only Makefile changed; no manifest/Dockerfile edits, and no privileged settings (privileged, host*, SYS_ADMIN, allowPrivilegeEscalation, root) were present. No CWE-269/CWE-732 hit.
No Pii Or Sensitive Data In Logs	✅ Passed	PASS: No new slog/logr/zap/log/fmt.Print* statements were added; only tooling/docs changed, with no PII-bearing log output (CWE-200/CWE-532).
Title check	✅ Passed	It accurately summarizes the shift from Bingo to Go tool directives and matches the main change set.
Description check	✅ Passed	It is directly related to the changes, describing the tools/go.mod migration and new Makefile targets.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

✨ Simplify code

Create PR with simplified code

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Around line 37-39: Harden the GOLANGCI_LINT_VERSION-driven installation flow
and the related recipe sections by preventing arbitrary Make overrides, either
making the version immutable or validating it against strict semver before use.
Quote all command and filesystem variable expansions in affected recipes, and
use mv -- when moving downloaded files; update references to GOLANGCI_LINT and
the installation targets consistently.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 602b4bef-3688-43c9-a527-d2619b16dcb8

📥 Commits

Reviewing files that changed from the base of the PR and between 71d48d0 and 236f9eb.

⛔ Files ignored due to path filters (3)

.bingo/goimports.sum is excluded by !**/*.sum
.bingo/golangci-lint.sum is excluded by !**/*.sum
go.sum is excluded by !**/*.sum, !**/go.sum

📒 Files selected for processing (10)

.bingo/.gitignore
.bingo/README.md
.bingo/Variables.mk
.bingo/go.mod
.bingo/goimports.mod
.bingo/golangci-lint.mod
.bingo/variables.env
.golangci.yml
Makefile
go.mod

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

openshift-hyperfleet/architecture (manual)
openshift-hyperfleet/hyperfleet-api (manual)
openshift-hyperfleet/hyperfleet-sentinel (manual)
openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against branch chore/replace-bingo-with-go-tool-directives instead of the default branch
openshift-hyperfleet/hyperfleet-broker (manual) → reviewed against open PR #26 chore/replace-bingo-with-go-tool-directives instead of the default branch

💤 Files with no reviewable changes (7)

.bingo/go.mod
.bingo/golangci-lint.mod
.bingo/README.md
.bingo/Variables.mk
.bingo/.gitignore
.bingo/variables.env
.bingo/goimports.mod

coderabbitai

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Around line 34-38: Harden the Makefile tool invocation and all affected lint,
fmt, and tools recipes against overridden GOCMD and TOOL_MOD values by making
them immutable or strictly allowlisted, setting TOOL_MOD to an absolute path,
and consistently shell-quoting path arguments. Update the gotool definition and
the referenced recipe commands while preserving their existing behavior.
- Around line 126-128: Update the verify-tools target to avoid mutating the
checkout: verify tools/go.sum is tracked using git ls-files --error-unmatch,
then run the tools module tidy/check in a temporary copy and compare its
go.mod/go.sum output against the committed files. Preserve the existing failure
message and nonzero exit behavior when files are missing or drifted.

In `@tools/go.mod`:
- Around line 1-5: Remove the direct golangci-lint tool declaration from the
tools module and restore its pinning through the repository’s approved Bingo
flow, including the corresponding .bingo/Variables.mk entry and generated
metadata. If retaining the Go tool directive is required, obtain and document
the explicit standards exception instead of bypassing dependency pinning.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: bdeed585-0218-448f-a4a2-b6f406200a12

📥 Commits

Reviewing files that changed from the base of the PR and between 236f9eb and 43475f2.

⛔ Files ignored due to path filters (3)

.bingo/goimports.sum is excluded by !**/*.sum
go.sum is excluded by !**/*.sum, !**/go.sum
tools/go.sum is excluded by !**/*.sum, !**/go.sum

📒 Files selected for processing (11)

.bingo/.gitignore
.bingo/README.md
.bingo/Variables.mk
.bingo/go.mod
.bingo/goimports.mod
.bingo/golangci-lint.mod
.bingo/variables.env
.golangci.yml
Makefile
go.mod
tools/go.mod

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

openshift-hyperfleet/architecture (manual)
openshift-hyperfleet/hyperfleet-api (manual)
openshift-hyperfleet/hyperfleet-sentinel (manual)
openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against branch chore/replace-bingo-with-go-tool-directives instead of the default branch
openshift-hyperfleet/hyperfleet-broker (manual) → reviewed against open PR #26 chore/replace-bingo-with-go-tool-directives instead of the default branch

💤 Files with no reviewable changes (7)

.bingo/README.md
.bingo/variables.env
.bingo/goimports.mod
.bingo/.gitignore
.bingo/golangci-lint.mod
.bingo/go.mod
.bingo/Variables.mk

🚧 Files skipped from review as they are similar to previous changes (2)

.golangci.yml
go.mod

- Quote Make variables in gotool and tool recipes (CWE-78) - Compare tool files against HEAD in verify-tools

rh-amarin · 2026-07-21T14:55:06Z

/lgtm

kuudori force-pushed the chore/replace-bingo-with-go-tool-directives branch 2 times, most recently from 95ffe5c to eb5ea75 Compare July 10, 2026 19:31

kuudori marked this pull request as ready for review July 10, 2026 19:40

kuudori marked this pull request as draft July 13, 2026 03:33

kuudori force-pushed the chore/replace-bingo-with-go-tool-directives branch 3 times, most recently from db190c9 to 236f9eb Compare July 14, 2026 02:09

kuudori changed the title ~~chore: replace bingo with Go 1.24 tool directives~~ HYPERFLEET-1337 - chore: replace bingo with Go 1.24 tool directives Jul 14, 2026

kuudori marked this pull request as ready for review July 20, 2026 18:01

coderabbitai Bot reviewed Jul 20, 2026

View reviewed changes

Comment thread Makefile Outdated

kuudori force-pushed the chore/replace-bingo-with-go-tool-directives branch from 236f9eb to 1e74ca4 Compare July 20, 2026 18:37

HYPERFLEET-1337 - chore: replace bingo with Go 1.24 tool directives

43475f2

kuudori force-pushed the chore/replace-bingo-with-go-tool-directives branch from 1e74ca4 to 43475f2 Compare July 20, 2026 18:38

coderabbitai Bot reviewed Jul 20, 2026

View reviewed changes

Comment thread Makefile

Comment thread Makefile Outdated

Comment thread tools/go.mod

kuudori added 2 commits July 20, 2026 14:38

HYPERFLEET-1337 - chore: address PR review comments

932688d

- Quote Make variables in gotool and tool recipes (CWE-78) - Compare tool files against HEAD in verify-tools

HYPERFLEET-1337 - fix: remove GOWORK=off from gotool macro

6f95f78

kuudori force-pushed the chore/replace-bingo-with-go-tool-directives branch from 108e27d to 6f95f78 Compare July 20, 2026 21:07

chore: bump Go to 1.26.0

cbabb1a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

HYPERFLEET-1337 - chore: replace bingo with Go 1.24 tool directives - #11

HYPERFLEET-1337 - chore: replace bingo with Go 1.24 tool directives#11
kuudori wants to merge 4 commits into
openshift-hyperfleet:mainfrom
kuudori:chore/replace-bingo-with-go-tool-directives

kuudori commented Jul 10, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading

Reviews paused

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rh-amarin commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

kuudori commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Follow-up changes (review comment fixes)

Uh oh!

coderabbitai Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rh-amarin commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kuudori commented Jul 10, 2026 •

edited

Loading

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading