Build(deps): Bump cloud.google.com/go/iam from 1.5.3 to 1.6.0#1065
Build(deps): Bump cloud.google.com/go/iam from 1.5.3 to 1.6.0#1065dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [cloud.google.com/go/iam](https://github.com/googleapis/google-cloud-go) from 1.5.3 to 1.6.0. - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md) - [Commits](googleapis/google-cloud-go@iam/v1.5.3...iap/v1.6.0) --- updated-dependencies: - dependency-name: cloud.google.com/go/iam dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
WalkthroughUpdated Go toolchain version from 1.24.13 to 1.25.0 and bumped direct and indirect dependencies, including cloud.google.com/go/iam, github.com/googleapis/gax-go/v2, Google API libraries, OpenTelemetry components, and golang.org/x libraries. No exported API changes. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
go.mod (1)
6-31: Scope drift: dependency-only PR now includes broad stack upgradesThis PR objective is an IAM bump, but it also upgrades gax, grpc, google API stack, OTel, x/*, and genproto. Recommend splitting into: (1)
cloud.google.com/go/iamtargeted bump, (2) bulk dependency/toolchain refresh. It will reduce blast radius and simplify rollback if regressions appear.Also applies to: 40-40, 100-100, 142-146, 149-159
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` around lines 6 - 31, This change set intended to bump cloud.google.com/go/iam also contains broad upgrades (gax-go, grpc, google API, golang.org/x/*, genproto, OTel, etc. listed in go.mod) which widens the blast radius; revert all unrelated dependency bumps in go.mod so only cloud.google.com/go/iam is updated in this PR (ensure the version line for cloud.google.com/go/iam is the only modification), then create a separate follow-up PR that performs the coordinated bulk refresh for github.com/googleapis/gax-go/v2, google.golang.org/grpc, google.golang.org/api, golang.org/x/text, golang.org/x/term, genproto/OTel-related modules and any other entries shown in go.mod to keep the IAM bump isolated and easier to test/rollback.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 3: go.mod declares go 1.25.0 but CI workflows are pinned to older Go
versions; open go.mod and the workflow files check-pull-request.yaml and
publish-release.yaml and either update all go-version entries in those workflows
to "1.25.0" to match go.mod or change the go directive in go.mod back to the
lower version used in CI; ensure every occurrence of go-version in both
check-pull-request.yaml and publish-release.yaml is consistent with the go.mod
setting before merging.
---
Nitpick comments:
In `@go.mod`:
- Around line 6-31: This change set intended to bump cloud.google.com/go/iam
also contains broad upgrades (gax-go, grpc, google API, golang.org/x/*,
genproto, OTel, etc. listed in go.mod) which widens the blast radius; revert all
unrelated dependency bumps in go.mod so only cloud.google.com/go/iam is updated
in this PR (ensure the version line for cloud.google.com/go/iam is the only
modification), then create a separate follow-up PR that performs the coordinated
bulk refresh for github.com/googleapis/gax-go/v2, google.golang.org/grpc,
google.golang.org/api, golang.org/x/text, golang.org/x/term,
genproto/OTel-related modules and any other entries shown in go.mod to keep the
IAM bump isolated and easier to test/rollback.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 4e9c2ef3-042c-408c-8c95-3c4b87a554b4
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| module github.com/openshift-online/ocm-cli | ||
|
|
||
| go 1.24.13 | ||
| go 1.25.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify Go version pins across common project automation files.
# Expected: all references align with 1.25.x (or intentionally allow it).
fd -HI 'go\.mod|go\.work|Dockerfile|Containerfile|Makefile|\.tool-versions|\.github/workflows' . \
| xargs -r rg -n --no-heading -e 'go 1\.' -e 'go-version' -e 'golang:' -e 'GOLANG_VERSION' -e 'GO_VERSION'Repository: openshift-online/ocm-cli
Length of output: 140
🏁 Script executed:
#!/bin/bash
# Check for CI/workflow files and their Go version specifications
echo "=== Checking for .github/workflows ==="
find .github/workflows -type f 2>/dev/null | head -20
echo -e "\n=== Checking for Dockerfile or Containerfile ==="
fd -HI '(Dockerfile|Containerfile)' . | head -20
echo -e "\n=== Checking for .tool-versions if not found above ==="
[ -f .tool-versions ] && cat .tool-versions || echo "No .tool-versions file"
echo -e "\n=== Checking workflow files for go-version or go: patterns ==="
if [ -d .github/workflows ]; then
cat .github/workflows/*.{yml,yaml} 2>/dev/null | grep -i -E '(go.*version|uses:.*setup-go|golang)' | head -20
fiRepository: openshift-online/ocm-cli
Length of output: 689
🏁 Script executed:
#!/bin/bash
# Check Dockerfile for Go version
echo "=== Dockerfile content ==="
cat ./docker/Dockerfile | head -30
echo -e "\n=== Detailed workflow version breakdown ==="
echo "check-pull-request.yaml Go versions:"
grep -n 'go-version' .github/workflows/check-pull-request.yaml || echo "No go-version found"
echo -e "\npublish-release.yaml Go versions:"
grep -n 'go-version' .github/workflows/publish-release.yaml || echo "No go-version found"Repository: openshift-online/ocm-cli
Length of output: 1413
Update CI workflows to Go 1.25.0 before merging
go.mod specifies go 1.25.0, but CI workflows are pinned to earlier versions:
.github/workflows/check-pull-request.yaml: lines 51 and 77 usego-version: 1.22and1.23.github/workflows/publish-release.yaml: line 45 usesgo-version: 1.23
CI jobs will fail during build with the module dependency requirements. Update all workflow go-version values to 1.25.0, or revert go.mod to align with current CI pins.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 3, go.mod declares go 1.25.0 but CI workflows are pinned to
older Go versions; open go.mod and the workflow files check-pull-request.yaml
and publish-release.yaml and either update all go-version entries in those
workflows to "1.25.0" to match go.mod or change the go directive in go.mod back
to the lower version used in CI; ensure every occurrence of go-version in both
check-pull-request.yaml and publish-release.yaml is consistent with the go.mod
setting before merging.
Bumps cloud.google.com/go/iam from 1.5.3 to 1.6.0.
Release notes
Sourced from cloud.google.com/go/iam's releases.
... (truncated)
Changelog
Sourced from cloud.google.com/go/iam's changelog.
... (truncated)
Commits
947c9acchore: release main (#7211)06a54a1chore: fixup commit messages (#7210)fd71cbafeat(bigquery/datapolicies): start generating apiv1 (#7204)633feadchore(all): auto-regenerate gapics (#7208)02c04a7chore(storage): refactor retention_period to retention_duration (#7203)92d9d4crefactor: augment private getWriteStream with view support (#7196)3592917chore(storage): fix checksum for grpc simple write (#7195)a7720e4chore(storage): fix checksums for gRPC uploads (#7193)94723a2chore(run): regen snippets for run/apiv2 (#7192)ca3c0b3test(storage): skip a consistently failing test (#7189)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)