fix: webhook initialization order by gusfcarvalho · Pull Request #5901 · external-secrets/external-secrets

gusfcarvalho · 2026-01-31T19:37:29Z

Fixes webhook initialization order.

Edit: also bumps go version everywhere for a high vulnerability fix.

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

coderabbitai · 2026-01-31T19:37:47Z

Walkthrough

Webhook initialization in Generate is moved to the start of the function. Additionally, many module files update their Go toolchain directive to 1.25.6; no API or behavioral changes reported.

Changes

Cohort / File(s)	Summary
Webhook Initialization `generators/v1/webhook/webhook.go`	Initialized `w.wh` (the webhook object) earlier in `Generate`, before `EnforceLabels`, `ClusterScoped`, and `parseSpec`. No change to error handling or control flow.
Go toolchain bumps (module files) `go.mod`, `apis/go.mod`, `e2e/go.mod`, `runtime/go.mod`, `generators/v1/.../go.mod`, `providers/v1/.../go.mod`	Updated Go version directive across many module `go.mod` files to `go 1.25.6`. No other dependency, API, or code changes.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@providers/v1/akeyless/go.mod`:
- Line 3: Update your build and CI toolchains to use the Go version declared in
go.mod ("go 1.25.6"): ensure local developer toolchains, Docker images, build
runners, and CI configurations (e.g., Dockerfile base image, golang tool
installer steps, or CI matrix entries) are set to or install Go 1.25.6 so builds
match the module requirement and tests run with the same compiler version.

coderabbitai · 2026-01-31T20:22:55Z

providers/v1/akeyless/go.mod

 module github.com/external-secrets/external-secrets/providers/v1/akeyless

-go 1.25.5
+go 1.25.6


⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

Go 1.25.6 release availability latest version

💡 Result:

Go 1.25.6 is released and available now, and it is the latest stable Go version as of January 31, 2026. You can download installers/archives (Windows/macOS/Linux and source) from the official Go downloads page. [1][2]

If you install via Homebrew, the go formula is also at 1.25.6. [3]

Sources:
[1] https://go.dev/VERSION
[2] https://go.dev/dl/
[3] https://formulae.brew.sh/formula/go

Ensure Go 1.25.6 is available in your build environments and CI images.

Go 1.25.6 is the current stable release and widely available through official channels and package managers. Verify your toolchain configurations and CI pipelines have this version available before merging.

🤖 Prompt for AI Agents

In `@providers/v1/akeyless/go.mod` at line 3, Update your build and CI toolchains to use the Go version declared in go.mod ("go 1.25.6"): ensure local developer toolchains, Docker images, build runners, and CI configurations (e.g., Dockerfile base image, golang tool installer steps, or CI matrix entries) are set to or install Go 1.25.6 so builds match the module requirement and tests run with the same compiler version.

Well, thanks coderabbit, but that's the point of our CI. We use it to run it. If it is green, it was available :)

@gusfcarvalho Fair point! If the CI is green, that confirms Go 1.25.6 is working as expected in your build pipeline. Thanks for clarifying! 👍

🧠 Learnings used

Learnt from: rbstp Repo: external-secrets/external-secrets PR: 5712 File: config/crds/bases/external-secrets.io_secretstores.yaml:1958-2044 Timestamp: 2026-01-09T19:14:48.246Z Learning: In external-secrets CRDs, new providers are added to the GA v1 schema only; v1beta1 is maintained for backward compatibility and does not receive new features (e.g., DVLS should be v1-only).

Skarlso · 2026-02-01T13:58:59Z

You also need to bump it then in: cmd/esoctl/generator/templates/go.mod.tmpl.

We can do this another time.

sonarqubecloud · 2026-02-02T08:51:14Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `1.2.1` → `1.3.2` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v1.3.2`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2) [Compare Source](external-secrets/external-secrets@v1.3.1...v1.3.2) Image: `ghcr.io/external-secrets/external-secrets:v1.3.2` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart for v1.3.1 by [@Skarlso](https://github.com/Skarlso) in [#5860](external-secrets/external-secrets#5860) - chore(chart): Add missing tests for readinessProbe by [@jcpunk](https://github.com/jcpunk) in [#5769](external-secrets/external-secrets#5769) - docs: Update FluxCD example by [@umizoom](https://github.com/umizoom) in [#5862](external-secrets/external-secrets#5862) - fix(ci): Removed the unused check for Windows in Makefile by [@HauptJ](https://github.com/HauptJ) in [#5870](external-secrets/external-secrets#5870) - docs(release): Add actual dates for EOL of 1.x releases in stability and support page by [@n4zukker](https://github.com/n4zukker) in [#5889](external-secrets/external-secrets#5889) - docs: Passbolt provider maintenance ownership by [@stripthis](https://github.com/stripthis) in [#5886](external-secrets/external-secrets#5886) - chore: Update Passbolt MaintenanceStatus to MaintenanceStatusMaintained by [@stripthis](https://github.com/stripthis) in [#5887](external-secrets/external-secrets#5887) - fix(security): sanitize json.Unmarshal errors to prevent secret data … by [@moolen](https://github.com/moolen) in [#5884](external-secrets/external-secrets#5884) - fix: webhook initialization order by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5901](external-secrets/external-secrets#5901) - chore: Cleanup flags by [@evrardj-roche](https://github.com/evrardj-roche) in [#5845](external-secrets/external-secrets#5845) - fix: onepasswordsdk shared tenant by altering the provider in the client cache by [@Skarlso](https://github.com/Skarlso) in [#5921](external-secrets/external-secrets#5921) ##### Dependencies - chore(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5873](external-secrets/external-secrets#5873) - chore(deps): bump pymdown-extensions from 10.20 to 10.20.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5877](external-secrets/external-secrets#5877) - chore(deps): bump markdown from 3.10 to 3.10.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5880](external-secrets/external-secrets#5880) - chore(deps): bump ubi9/ubi from `22e9573` to `1f84f5c` by [@dependabot](https://github.com/dependabot)\[bot] in [#5871](external-secrets/external-secrets#5871) - chore(deps): bump actions/setup-python from 6.1.0 to 6.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5872](external-secrets/external-secrets#5872) - chore(deps): bump hashicorp/setup-terraform from [`93d5a27`](external-secrets/external-secrets@93d5a27) to [`dcc3150`](external-secrets/external-secrets@dcc3150) by [@dependabot](https://github.com/dependabot)\[bot] in [#5875](external-secrets/external-secrets#5875) - chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5876](external-secrets/external-secrets#5876) - chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5878](external-secrets/external-secrets#5878) - chore(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5874](external-secrets/external-secrets#5874) - chore(deps): bump packaging from 25.0 to 26.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5879](external-secrets/external-secrets#5879) - chore(deps): bump golang from `d9b2e14` to `98e6cff` by [@dependabot](https://github.com/dependabot)\[bot] in [#5907](external-secrets/external-secrets#5907) - chore(deps): bump alpine from `865b95f` to `2510918` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5914](external-secrets/external-secrets#5914) - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5909](external-secrets/external-secrets#5909) - chore(deps): bump actions/cache from 5.0.2 to 5.0.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5912](external-secrets/external-secrets#5912) - chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5910](external-secrets/external-secrets#5910) - chore(deps): bump hashicorp/setup-terraform from [`dcc3150`](external-secrets/external-secrets@dcc3150) to [`ce70bcf`](external-secrets/external-secrets@ce70bcf) by [@dependabot](https://github.com/dependabot)\[bot] in [#5911](external-secrets/external-secrets#5911) - chore(deps): bump ubi9/ubi from `1f84f5c` to `c8df11b` by [@dependabot](https://github.com/dependabot)\[bot] in [#5908](external-secrets/external-secrets#5908) - chore(deps): bump alpine from 3.23.2 to 3.23.3 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5915](external-secrets/external-secrets#5915) - chore(deps): bump alpine from `865b95f` to `2510918` by [@dependabot](https://github.com/dependabot)\[bot] in [#5906](external-secrets/external-secrets#5906) - chore(deps): bump pathspec from 1.0.3 to 1.0.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5916](external-secrets/external-secrets#5916) - chore(deps): bump babel from 2.17.0 to 2.18.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5917](external-secrets/external-secrets#5917) - chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5913](external-secrets/external-secrets#5913) #### New Contributors - [@umizoom](https://github.com/umizoom) made their first contribution in [#5862](external-secrets/external-secrets#5862) - [@HauptJ](https://github.com/HauptJ) made their first contribution in [#5870](external-secrets/external-secrets#5870) - [@n4zukker](https://github.com/n4zukker) made their first contribution in [#5889](external-secrets/external-secrets#5889) - [@stripthis](https://github.com/stripthis) made their first contribution in [#5886](external-secrets/external-secrets#5886) **Full Changelog**: <external-secrets/external-secrets@v1.3.1...v1.3.2> ### [`v1.3.1`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.1) [Compare Source](external-secrets/external-secrets@v1.2.1...v1.3.1) Image: `ghcr.io/external-secrets/external-secrets:v1.3.1` Image: `ghcr.io/external-secrets/external-secrets:v1.3.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.1-ubi-boringssl`  For a Full release please referre to <https://github.com/external-secrets/external-secrets/releases/tag/v1.3.0>. This is a fix build for the docker publish flow. #### What's Changed ##### General - fix: ignore the in-toto manifest when promoting the docker build by [@Skarlso](https://github.com/Skarlso) in [#5859](external-secrets/external-secrets#5859) **Full Changelog**: <external-secrets/external-secrets@v1.3.0...v1.3.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://kubara.git.onstackit.cloud/STACKIT/kubara/pulls/250

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com>

fix: webhook initialization order

00ba146

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

github-project-automation bot added this to External Secrets Jan 31, 2026

github-actions bot added kind/bug Categorizes issue or PR as related to a bug. size/xs labels Jan 31, 2026

fix: bump go version

de83feb

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

github-actions bot added kind/dependency dependabot and upgrades size/m labels Jan 31, 2026

coderabbitai bot reviewed Jan 31, 2026

View reviewed changes

moolen approved these changes Jan 31, 2026

View reviewed changes

Merge branch 'main' into gc-fix-webhook-initialization

84a1465

Skarlso merged commit 25aa092 into main Feb 2, 2026
15 of 16 checks passed

Skarlso deleted the gc-fix-webhook-initialization branch February 2, 2026 08:50

github-project-automation bot moved this to Done in External Secrets Feb 2, 2026

nutmos pushed a commit to nutmos/external-secrets that referenced this pull request Feb 11, 2026

fix: webhook initialization order (external-secrets#5901)

8a07c39

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

nutmos pushed a commit to nutmos/external-secrets that referenced this pull request Feb 18, 2026

fix: webhook initialization order (external-secrets#5901)

d5b9186

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

nutmos pushed a commit to nutmos/external-secrets that referenced this pull request Feb 18, 2026

fix: webhook initialization order (external-secrets#5901)

680f991

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

dsp0x4 pushed a commit to dsp0x4/external-secrets that referenced this pull request Mar 22, 2026

fix: webhook initialization order (external-secrets#5901)

32e9b4b

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: webhook initialization order#5901

fix: webhook initialization order#5901
Skarlso merged 3 commits intomainfrom
gc-fix-webhook-initialization

gusfcarvalho commented Jan 31, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Jan 31, 2026 •

edited

Loading

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot Jan 31, 2026 •

edited

Loading

Uh oh!

gusfcarvalho Jan 31, 2026 •

edited

Loading

Uh oh!

coderabbitai bot Jan 31, 2026

Uh oh!

Skarlso commented Feb 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

sonarqubecloud bot commented Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

gusfcarvalho commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gusfcarvalho Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Skarlso commented Feb 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Feb 2, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gusfcarvalho commented Jan 31, 2026 •

edited

Loading

coderabbitai bot commented Jan 31, 2026 •

edited

Loading

coderabbitai bot Jan 31, 2026 •

edited

Loading

gusfcarvalho Jan 31, 2026 •

edited

Loading

Skarlso commented Feb 1, 2026 •

edited

Loading