github-actions[bot] opened a new pull request, #70624: URL: https://github.com/apache/airflow/pull/70624
* Catch lang-SDK Go example module drift before it reaches main kubernetes-tests/lang_sdk/go_example is a separate Go module that resolves the SDK through a `replace` onto ../../../go-sdk, so it carries its own copy of the SDK's indirect requirements. Nothing re-tidies it when a dependency moves inside /go-sdk, and Dependabot bumps exactly one module per PR. The blast radius is what makes this worth guarding. Go refuses to build an inconsistent module, so once such a bump merges, "Kubernetes tests / K8S Lang-SDK" fails at the Build Go bundle step on every pull request until someone notices and tidies the module by hand — not just on the PR that caused it. Dependabot security updates do not consult .github/dependabot.yml, so no per-directory configuration prevents this, and a second Dependabot PR for the example module would merge at a different time and leave main red in between. The drift has to fail the bump PR itself. The check is `go mod tidy -diff` in the example module: it asks exactly the question the failing CI step asks, never writes to the working tree, and exits non-zero when the module is untidy. * Let prek provide the Go toolchain for the tidy check Static checks run on a runner whose preinstalled toolchains are deleted to free disk space before prek starts, so the check could never find `go` there and failed on every run. Asking prek for the toolchain is how the Go SDK's own tidy hook already gets one, and it pins the same version everywhere. (cherry picked from commit bce20ff30bbe9b96d0de5ee6456f2015611f4e53) Co-authored-by: Jarek Potiuk <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
