build(deps): bump sigs.k8s.io/controller-runtime/tools/setup-envtest from 0.0.0-20260125163108-a19ec76a3c5d to 0.24.1 in /hack/tools in the k8s-dependencies group across 1 directory

[dependabot]

Bumps the k8s-dependencies group with 1 update in the /hack/tools directory: sigs.k8s.io/controller-runtime/tools/setup-envtest.

Updates sigs.k8s.io/controller-runtime/tools/setup-envtest from 0.0.0-20260125163108-a19ec76a3c5d to 0.24.1

Release notes

Sourced from sigs.k8s.io/controller-runtime/tools/setup-envtest's releases.

v0.24.1

What's Changed

• [release-0.24] 🐛 Fix regression in Apply typed error handling by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3516

Full Changelog: kubernetes-sigs/controller-runtime@v0.24.0...v0.24.1

v0.24.0

⚠️ Breaking Changes

• Dependencies: Update to k8s.io/* v1.36 (#3506 #3462 #3486 #3450)

🐛 Bug Fixes

• Cache: Fix IndexField blocking until informer is synced (#3445)
• Cache: Wait for cache sync when ReaderFailOnMissingInformer is true (#3425)
• Client: Update typed ApplyConfigurations with server response (#3475)
• Fakeclient: Fix SSA status patch resource version check (#3443)
• Fakeclient: Fix panic when using CRs with embedded pointer structs (#3431)
• Fakeclient: Fix status apply if existing object has managedFields set (#3430)
• Fakeclient: Retry GenerateName on AlreadyExists collisions (#3498)
• HTTP servers: Wire up base context into http servers (#3452)

🌱 Others

• Builder/Webhooks: Remove deprecated custom path function (#3465)
• Cache: Test cache reader waits for cache sync (#3434)
• Certwatcher: Deflake certwatcher tests (#3457)
• Dependencies: Use forked version of btree (#3449)
• Envtest: Ensure envtest stops the whole process group (#3447)
• Logging: Add missing space in zap-log-level flag description (#3492)
• Misc: Adopt new(x) over ptr.To(x) and re-enable newexpr lint (#3489)
• Owners: Cleanup (#3453)
• Recorder: Add logger into context for structured logging (#3454)
• Recorder: Switch to StartLogging for event debug logs (#3451)
• Scheme: Deprecate the scheme builder (#3461)
• Source/Kind: Improve logging for dynamic type kind source (#3494)
• Webhooks: Reduce memory usage of default webhooks (#3463 #3468)

🌱 CI & linters

• Chore: Update golangci-lint version to v2.8.0 (#3448)
• Chore: Update golangci-lint version to v2.10.1 (#3470)
• Chore: Update golangci-lint version to v2.11.3 (#3482)
• Migrate away from custom GitHub action approval workflow (#3491)
• Release: Auto-create git tags for the tools/setup-envtest submodule (#3476)

📖 Additionally, there has been 1 contribution to our documentation. (#3477)

Dependencies

... (truncated)

Commits

• See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The hack/tools/go.mod file was updated to bump the Go directive from 1.25.7 to 1.26.0. k8s.io/apimachinery was upgraded to v0.36.0. sigs.k8s.io/controller-runtime/tools/setup-envtest was changed to v0.24.1. The indirect google.golang.org/protobuf requirement was updated to v1.36.12-0.20260120151049-f2248ac996af. Four lines in the manifest were modified (+4/-4).

Suggested reviewers

• sjenning

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only modifies hack/tools/go.mod (dependency file), not Ginkgo test files. The custom check for stable test names is not applicable to dependency updates.
Test Structure And Quality	✅ Passed	PR is a dependency bump (hack/tools/go.mod) with no test file modifications. The Ginkgo test quality check does not apply to dependency-only changes.
Microshift Test Compatibility	✅ Passed	This PR updates dependencies in hack/tools/go.mod only. No new Ginkgo e2e tests are added, so MicroShift test compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR only updates Go dependencies in hack/tools/go.mod with no new Ginkgo e2e tests added. The SNO test compatibility check applies only to new tests, so it is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only updates hack/tools/go.mod (build tool dependencies), not deployment manifests, operator code, or controllers. Topology-aware scheduling check is not applicable.
Ote Binary Stdout Contract	✅ Passed	PR only updates go.mod dependencies (hack/tools/go.mod) with no changes to OTE test binaries or process-level code that could write to stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR adds e2e tests using standard Go testing patterns (TestXxx, t.Run), not Ginkgo. The check applies only to Ginkgo e2e tests, so it does not apply here.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main dependency change: upgrading setup-envtest in /hack/tools.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/hack/tools/k8s-dependencies-f437090dbb

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign bryan-cox for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jparrill]

The gitlint failure is a known issue — Dependabot's auto-generated commit body includes long URLs that exceed the body-max-line-length=140 rule in .gitlint. This will affect all future Dependabot PRs until we fix it.

Tracked in OCPBUGS-85084. Working on a fix in a follow-up PR.

Otherwise the dependency bump itself (setup-envtest → v0.24.0 in hack/tools/) looks good. The ci/prow/images failure is unrelated to this change.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@hack/tools/go.mod`:
- Around line 16-19: The require entry for k8s.io/apimachinery was updated to
v0.36.0 but the replace directive still pins k8s.io/apimachinery to v0.34.2, so
update the replace for k8s.io/apimachinery to v0.36.0 (or remove the replace if
unnecessary) to match the require; search for the replace directive referencing
k8s.io/apimachinery in the same go.mod and change its version to v0.36.0 and run
go mod tidy to ensure no further drift (check references around the replace
block and verify setup-envtest and other tools pick up the aligned version).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 01a81a2f-fab9-4900-9ae2-f6ed60aef425

📥 Commits

Reviewing files that changed from the base of the PR and between 3e1b279 and 21dc548.

⛔ Files ignored due to path filters (16)

• hack/tools/go.sum is excluded by !**/*.sum
• hack/tools/vendor/google.golang.org/protobuf/encoding/protodelim/protodelim.go is excluded by !**/vendor/**
• hack/tools/vendor/google.golang.org/protobuf/encoding/protojson/decode.go is excluded by !**/vendor/**
• hack/tools/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go is excluded by !**/vendor/**
• hack/tools/vendor/google.golang.org/protobuf/encoding/prototext/decode.go is excluded by !**/vendor/**
• hack/tools/vendor/google.golang.org/protobuf/internal/descfmt/stringer.go is excluded by !**/vendor/**
• hack/tools/vendor/google.golang.org/protobuf/internal/version/version.go is excluded by !**/vendor/**
• hack/tools/vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.go is excluded by !**/vendor/**
• hack/tools/vendor/modules.txt is excluded by !**/vendor/**
• hack/tools/vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest/README.md is excluded by !**/vendor/**
• hack/tools/vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest/env/env.go is excluded by !**/vendor/**
• hack/tools/vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest/env/exit.go is excluded by !**/vendor/**
• hack/tools/vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest/env/helpers.go is excluded by !**/vendor/**
• hack/tools/vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest/remote/http_client.go is excluded by !**/vendor/**
• hack/tools/vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest/store/store.go is excluded by !**/vendor/**
• hack/tools/vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest/versions/version.go is excluded by !**/vendor/**

📒 Files selected for processing (1)

• hack/tools/go.mod

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="hack/tools/go.mod"

echo "== Lines 1-60 =="
nl -ba "$FILE" | sed -n '1,80p'

echo
echo "== Lines 300-380 (replace block area) =="
nl -ba "$FILE" | sed -n '300,380p'

echo
echo "== rg k8s.io/apimachinery occurrences =="
rg -n "k8s\.io/apimachinery" "$FILE" || true

echo
echo "== rg setup-envtest occurrences =="
rg -n "setup-envtest" "$FILE" || true

Repository: openshift/hypershift

Length of output: 142

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="hack/tools/go.mod"

echo "== Lines 1-80 =="
awk 'NR>=1 && NR<=80 {printf "%d:%s\n", NR, $0}' "$FILE"

echo
echo "== Lines 300-420 =="
awk 'NR>=300 && NR<=420 {printf "%d:%s\n", NR, $0}' "$FILE"

echo
echo "== rg k8s.io/apimachinery occurrences =="
rg -n "k8s\.io/apimachinery" "$FILE" || true

echo
echo "== rg setup-envtest occurrences =="
rg -n "setup-envtest" "$FILE" || true

Repository: openshift/hypershift

Length of output: 6352

---

Align k8s.io/apimachinery require and replace in hack/tools/go.mod.

k8s.io/apimachinery is bumped to v0.36.0 in the require block (line 16), but replace pins it back to v0.34.2 (line 336), so the bump is effectively overridden (including for tools like setup-envtest v0.24.1). Update both entries together to prevent drift/confusion.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@hack/tools/go.mod` around lines 16 - 19, The require entry for
k8s.io/apimachinery was updated to v0.36.0 but the replace directive still pins
k8s.io/apimachinery to v0.34.2, so update the replace for k8s.io/apimachinery to
v0.36.0 (or remove the replace if unnecessary) to match the require; search for
the replace directive referencing k8s.io/apimachinery in the same go.mod and
change its version to v0.36.0 and run go mod tidy to ensure no further drift
(check references around the replace block and verify setup-envtest and other
tools pick up the aligned version).

[openshift-ci]

rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[hypershift-jira-solve-ci]

I now have the complete root cause. Here is the final report:

Test Failure Analysis Complete

Job Information

• Prow Job: pull-ci-openshift-hypershift-main-images
• Build ID: 2075387173158260736
• Target: images (multi-target: hypershift-cli, hypershift-operator, hypershift-tests)
• PR: build(deps): bump sigs.k8s.io/controller-runtime/tools/setup-envtest from 0.0.0-20260125163108-a19ec76a3c5d to 0.24.1 in /hack/tools in the k8s-dependencies group across 1 directory #8392 — build(deps): bump sigs.k8s.io/controller-runtime/tools/setup-envtest from 0.0.0-20260125163108-a19ec76a3c5d to 0.24.1 in /hack/tools

Test Failure Analysis

Error

go: go.mod requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)
make: *** [Makefile:482: e2e] Error 1

Summary

The hypershift-tests image build failed because PR #8392 bumped sigs.k8s.io/controller-runtime/tools/setup-envtest to v0.24.1, which transitively raised the go directive in hack/tools/go.mod from 1.25.7 to 1.26.0. The Dockerfile.e2e builder image (rhel-9-release-golang-1.25-openshift-4.23) only ships Go 1.25.8, and GOTOOLCHAIN=local prevents auto-downloading a newer toolchain. When the Makefile e2e target runs cd ./hack/tools; go build -tags=tools ... to build gotestsum, Go refuses to proceed because the module requires Go 1.26.0 but only 1.25.8 is available.

Root Cause

The dependency bump in PR #8392 changed hack/tools/go.mod to declare go 1.26.0, up from go 1.25.7. This is because sigs.k8s.io/controller-runtime/tools/setup-envtest v0.24.1 (and its transitive dependency k8s.io/apimachinery v0.36.0) requires Go 1.26.0.

The CI build environment uses the rhel-9-release-golang-1.25-openshift-4.23 builder image which contains Go 1.25.8. The Go toolchain policy in CI is GOTOOLCHAIN=local, meaning Go will NOT automatically download a newer toolchain to satisfy the go directive — it simply errors out.

The failure occurs specifically during the hypershift-tests image build (Dockerfile.e2e), at the Makefile e2e target. The e2e target includes the step:

cd ./hack/tools; GO111MODULE=on GOFLAGS=-mod=vendor GOWORK=off go build -tags=tools -o ../../bin/gotestsum gotest.tools/gotestsum

This cd ./hack/tools causes Go to load hack/tools/go.mod, which now demands Go 1.26.0. Since the builder only has 1.25.8, the build fails immediately.

The other image builds (hypershift-operator, hypershift, hypershift-cli) all succeeded because they use the main go.mod (which still declares go 1.25.8) and do not enter the hack/tools module.

Recommendations

1. Do not merge this PR as-is. The go 1.26.0 requirement in hack/tools/go.mod is incompatible with the current CI builder image (golang-1.25).

2. Option A — Downgrade the dependency: Find a version of sigs.k8s.io/controller-runtime/tools/setup-envtest that is compatible with Go 1.25.x (i.e., the previous pseudo-version v0.0.0-20260125163108-a19ec76a3c5d or another release that doesn't require Go 1.26). Similarly, keep k8s.io/apimachinery at v0.34.3 instead of v0.36.0.

3. Option B — Wait for Go 1.26 builder image: If the project plans to adopt Go 1.26 soon, coordinate the dependency bump with the builder image update. The Dockerfile.e2e would need to use a golang-1.26 base image.

4. Option C — Split the toolchain: If only setup-envtest needs Go 1.26, consider isolating it so it doesn't affect the gotestsum build path, or use a pre-built binary instead of building from source during the image build.

Evidence

Evidence	Detail
Failing build step	hypershift-tests-amd64 (Dockerfile.e2e image build)
Error message	go: go.mod requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)
Makefile target	e2e → cd ./hack/tools; go build -tags=tools -o ../../bin/gotestsum gotest.tools/gotestsum
PR change in go.mod	hack/tools/go.mod: go 1.25.7 → go 1.26.0
Dependency causing bump	sigs.k8s.io/controller-runtime/tools/setup-envtest v0.24.1 requires k8s.io/apimachinery v0.36.0 which requires Go 1.26
Builder image	registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.23 (Go 1.25.8)
Toolchain policy	GOTOOLCHAIN=local — auto-download of newer Go disabled
Other images	hypershift-operator, hypershift, hypershift-cli all built successfully (use main go.mod with go 1.25.8)

---

[openshift-ci]

@dependabot[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azure-v2-self-managed	3e1b279	link	false	/test e2e-azure-v2-self-managed

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.