NO-ISSUE: bumping to to 1.25 in the backplane-2.7 branch

andrej1991 · andrej1991 · commit bf96fec44480 · 2026-02-04T15:17:27.000+01:00
diff --git a/.golangci.yml b/.golangci.yml
@@ -0,0 +1,78 @@
+version: "2"
+run:
+  concurrency: 4
+  timeout: 5m
+  issues-exit-code: 1
+  tests: true
+output:
+  print-issued-lines: true
+  print-linter-name: true
+linters:
+  enable:
+    - staticcheck
+    - unused
+    - govet
+    - gocyclo
+    - gosec
+    - unconvert
+  settings:
+    govet:
+      enable:
+        - shadow
+      settings:
+        printf:
+          funcs:
+            - Infof
+            - Warnf
+            - Errorf
+            - Fatalf
+    gosec:
+      excludes:
+        - G107
+        - G115
+        - G401
+        - G402
+        - G501
+    staticcheck:
+      checks:
+        - "all"
+        - "-ST1001"
+        - "-ST1003"
+        - "-ST1005"
+        - "-ST1008"
+        - "-ST1016"
+        - "-ST1019"
+        - "-ST1023"
+        - "-QF1001"
+        - "-QF1003"
+        - "-QF1011"
+  exclusions:
+    rules:
+    - linters:
+        - staticcheck
+      text: 'QF1008: could remove embedded field'
+    - linters:
+        - gosec
+      text: 'G306: Expect WriteFile permissions to be 0600 or less'
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+issues:
+  uniq-by-line: true
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21 as builder
+FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.21 as builder
 ARG TARGETOS
 ARG TARGETARCH
 
diff --git a/Dockerfile.konflux b/Dockerfile.konflux
@@ -1,4 +1,4 @@
-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24 as builder
+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.25 as builder
 ARG TARGETOS
 ARG TARGETARCH
 
diff --git a/Makefile b/Makefile
@@ -60,6 +60,8 @@ else
 GOBIN=$(shell go env GOBIN)
 endif
 
+TEST ?= $(shell go list -f '{{if or .TestGoFiles .XTestGoFiles}}{{.ImportPath}}{{end}}' ./...)
+
 # Setting SHELL to bash allows bash commands to be executed by recipes.
 # Options are set to exit when a recipe line exits non-zero or a piped command fails.
 SHELL = /usr/bin/env bash -o pipefail
@@ -110,7 +112,7 @@ golangci-lint: ## Run golangci-lint against code.
 
 .PHONY: test
 test: manifests generate fmt vet ## Run tests.
-	go test ./... -coverprofile cover.out
+	go test $(TEST) -coverprofile cover.out
 
 .PHONY: deploy-integration-test
 deploy-integration-test:
@@ -181,7 +183,7 @@ CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
 
 ## Tool Versions
 KUSTOMIZE_VERSION ?= v5.4.3
-CONTROLLER_TOOLS_VERSION ?= v0.16.2
+CONTROLLER_TOOLS_VERSION ?= v0.17.0
 
 KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
 .PHONY: kustomize
diff --git a/cmd/manager/main.go b/cmd/manager/main.go
@@ -20,7 +20,7 @@ import (
 	"flag"
 	"fmt"
 	"net/http"
-	_ "net/http/pprof"
+	_ "net/http/pprof" //nolint:gosec // G108: pprof only enabled via --start-pprof and bound to localhost:6060
 	"net/url"
 	"os"
 	"time"
diff --git a/cmd/server/main.go b/cmd/server/main.go
@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"sync"
 	"syscall"
+	"time"
 
 	"github.com/kelseyhightower/envconfig"
 	"github.com/openshift/image-based-install-operator/internal/imageserver"
@@ -44,7 +45,8 @@ func main() {
 	}
 	http.Handle("/images/", s)
 	server := &http.Server{
-		Addr: fmt.Sprintf(":%s", Options.Port),
+		Addr:              fmt.Sprintf(":%s", Options.Port),
+		ReadHeaderTimeout: 5 * time.Second,
 	}
 
 	go func() {
diff --git a/config/crd/bases/extensions.hive.openshift.io_imageclusterinstalls.yaml b/config/crd/bases/extensions.hive.openshift.io_imageclusterinstalls.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.17.0
   name: imageclusterinstalls.extensions.hive.openshift.io
 spec:
   group: extensions.hive.openshift.io
diff --git a/controllers/imageclusterinstall_controller.go b/controllers/imageclusterinstall_controller.go
@@ -19,6 +19,7 @@ package controllers
 import (
 	"bytes"
 	"context"
+
 	// These are required for image parsing to work correctly with digest-based pull specs
 	// See: https://github.com/opencontainers/go-digest/blob/v1.0.0/README.md#usage
 	_ "crypto/sha256"
@@ -499,7 +500,7 @@ func (r *ImageClusterInstallReconciler) updateBMHProvisioningState(ctx context.C
 	if bmh.Status.Provisioning.State != bmh_v1alpha1.StateAvailable && bmh.Status.Provisioning.State != bmh_v1alpha1.StateExternallyProvisioned {
 		return nil
 	}
-	log.Infof("Updating BareMetalHost %s/%s provisioning state, current PoweredOn status is: %s", bmh.Namespace, bmh.Name, bmh.Status.PoweredOn)
+	log.Infof("Updating BareMetalHost %s/%s provisioning state, current PoweredOn status is: %t", bmh.Namespace, bmh.Name, bmh.Status.PoweredOn)
 	if bmh.Status.Provisioning.State == bmh_v1alpha1.StateAvailable {
 		if !bmh.Spec.ExternallyProvisioned {
 			log.Infof("Setting BareMetalHost (%s/%s) ExternallyProvisioned spec", bmh.Namespace, bmh.Name)
@@ -849,7 +850,7 @@ func (r *ImageClusterInstallReconciler) getClusterInfoFromFile(log logrus.FieldL
 	clusterInfo := lca_api.SeedReconfiguration{}
 	err = json.Unmarshal(data, &clusterInfo)
 	if err != nil {
-		log.Warnf("failed to marshal cluster info: %w", err)
+		log.Warnf("failed to marshal cluster info: %s", err)
 		return nil
 	}
 	return &clusterInfo
diff --git a/controllers/imageclusterinstall_controller_test.go b/controllers/imageclusterinstall_controller_test.go
@@ -105,7 +105,7 @@ var _ = Describe("Reconcile", func() {
 		clusterInstall          *v1alpha1.ImageClusterInstall
 		clusterDeployment       *hivev1.ClusterDeployment
 		pullSecret              *corev1.Secret
-		testPullSecretVal       = `{"auths":{"cloud.openshift.com":{"auth":"dXNlcjpwYXNzd29yZAo=","email":"r@r.com"}}}`
+		testPullSecretVal       = `{"auths":{"cloud.openshift.com":{"auth":"dXNlcjpwYXNzd29yZAo=","email":"r@r.com"}}}` //nolint:gosec //fake credentials for testing
 	)
 
 	BeforeEach(func() {
@@ -1493,7 +1493,7 @@ var _ = Describe("Reconcile with DataImageCoolDownPeriod set to 1 second", func(
 		clusterInstall          *v1alpha1.ImageClusterInstall
 		clusterDeployment       *hivev1.ClusterDeployment
 		pullSecret              *corev1.Secret
-		testPullSecretVal       = `{"auths":{"cloud.openshift.com":{"auth":"dXNlcjpwYXNzd29yZAo=","email":"r@r.com"}}}`
+		testPullSecretVal       = `{"auths":{"cloud.openshift.com":{"auth":"dXNlcjpwYXNzd29yZAo=","email":"r@r.com"}}}` //nolint:gosec //fake credentials for testing
 	)
 
 	BeforeEach(func() {
diff --git a/controllers/imageclusterinstall_monitor_test.go b/controllers/imageclusterinstall_monitor_test.go
@@ -38,7 +38,7 @@ var _ = Describe("Monitor", func() {
 		clusterDeployment       *hivev1.ClusterDeployment
 		bmh                     *bmh_v1alpha1.BareMetalHost
 		pullSecret              *corev1.Secret
-		testPullSecretVal       = `{"auths":{"cloud.openshift.com":{"auth":"dXNlcjpwYXNzd29yZAo=","email":"r@r.com"}}}`
+		testPullSecretVal       = `{"auths":{"cloud.openshift.com":{"auth":"dXNlcjpwYXNzd29yZAo=","email":"r@r.com"}}}` //nolint:gosec //fake credentials for testing
 	)
 
 	BeforeEach(func() {
diff --git a/hack/golangci-lint.sh b/hack/golangci-lint.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-VERSION="1.55.2"
+VERSION="2.8.0"
 
 rootdir=$(git rev-parse --show-toplevel)
 if [ -z "${rootdir}" ]; then
diff --git a/internal/certs/certs_test.go b/internal/certs/certs_test.go
@@ -56,6 +56,7 @@ var _ = Describe("KubeConfigCertManager", func() {
 		Expect(block).NotTo(Equal(nil))
 		// Parse the CA certificate
 		ingressCert, err := x509.ParseCertificate(block.Bytes)
+		Expect(err).NotTo(HaveOccurred())
 		checkCertValidity(ingressCert, time.Duration(validityTwoYearsInDays)*24*time.Hour)
 		// verify ingress cert in certificateAuthData
 		Expect(cm.certificateAuthData).ToNot(BeNil())
@@ -67,6 +68,7 @@ var _ = Describe("KubeConfigCertManager", func() {
 
 	It("generateAdminUserCertificate success", func() {
 		ca, err := generateSelfSignedCACertificate("admin-kubeconfig-signer", validityTenYearsInDays)
+		Expect(err).NotTo(HaveOccurred())
 		userCert, _, err := generateAdminUserCertificate(ca)
 		Expect(err).NotTo(HaveOccurred())
 
diff --git a/internal/credentials/credentials.go b/internal/credentials/credentials.go
@@ -28,7 +28,7 @@ import (
 )
 
 const (
-	SecretResourceLabel = "image-based-installed.openshift.io/created"
+	SecretResourceLabel = "image-based-installed.openshift.io/created" //nolint:gosec
 	SecretResourceValue = "true"
 	DefaultUser         = "kubeadmin"
 	kubeconfig          = "kubeconfig"

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21 as builder`
	`1`	`+FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.21 as builder`
`2`	`2`	`ARG TARGETOS`
`3`	`3`	`ARG TARGETARCH`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24 as builder`
	`1`	`+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.25 as builder`
`2`	`2`	`ARG TARGETOS`
`3`	`3`	`ARG TARGETARCH`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -38,7 +38,7 @@ var _ = Describe("Monitor", func() {`
`38`	`38`	`clusterDeployment *hivev1.ClusterDeployment`
`39`	`39`	`bmh *bmh_v1alpha1.BareMetalHost`
`40`	`40`	`pullSecret *corev1.Secret`
`41`		- testPullSecretVal = `{"auths":{"cloud.openshift.com":{"auth":"dXNlcjpwYXNzd29yZAo=","email":"r@r.com"}}}`
	`41`	+ testPullSecretVal = `{"auths":{"cloud.openshift.com":{"auth":"dXNlcjpwYXNzd29yZAo=","email":"r@r.com"}}}` //nolint:gosec //fake credentials for testing
`42`	`42`	`)`
`43`	`43`
`44`	`44`	`BeforeEach(func() {`