fix(deps): update ocm monorepo go module dependencies (no ctf) by frewilhelm · Pull Request #2174 · open-component-model/open-component-model

frewilhelm · 2026-04-07T11:39:14Z

What this PR does / why we need it

e2b46f9 introduced a change in ocm.software/open-component-model/bindings/go/ctf v0.4.0 that breaks tests in bindings/go/oci/ctf. A fix is already in progress but it includes a bigger implementation that is not ready to merge yet. This is why, this PR reverts the version bump for that module for now.

Which issue(s) this PR fixes

Fixes #2152

Testing

Run task test and task test/integration

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

coderabbitai · 2026-04-07T11:39:23Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR updates OCM-related Go module versions across multiple go.mod files, mainly advancing pseudo-version commits for descriptor/*, cel, transfer, transform, and bumping ctf (v0.3.0 → v0.4.0) and oci (v0.0.37 → v0.0.38).

Changes

Cohort / File(s)	Summary
Input Modules `bindings/go/input/dir/go.mod`, `bindings/go/input/file/go.mod`, `bindings/go/input/utf8/go.mod`	Updated indirect `descriptor/normalisation` and `descriptor/runtime` pseudo-versions from `...e120070fd921` → `...5b24debae3cf`.
Descriptor & Runtime `bindings/go/descriptor/normalisation/go.mod`, `bindings/go/oci/go.mod`, `bindings/go/repository/go.mod`, `bindings/go/rsa/go.mod`	Bumped `descriptor/runtime` pseudo-version to `...5b24debae3cf`.
Signing & Plugin `bindings/go/signing/go.mod`, `bindings/go/plugin/go.mod`	Advanced `descriptor/normalisation` and `descriptor/runtime` pseudo-versions; plugin updated `signing` pin.
Transfer & Integration `bindings/go/transfer/go.mod`, `bindings/go/transfer/integration/go.mod`	Updated `descriptor/runtime`, `signing`, `transform`, `cel`, and related indirects; bumped `ctf` v0.3.0 → v0.4.0.
OCI & Helm `bindings/go/oci/integration/go.mod`, `bindings/go/helm/go.mod`	Bumped `descriptor/runtime` pseudo-version and `oci` v0.0.37 → v0.0.38; helm also advanced related indirects.
Helm & Transform `bindings/go/helm/go.mod`, `bindings/go/transform/go.mod`	Advanced `descriptor/normalisation`, `descriptor/runtime`, and `cel` pseudo-versions.
Constructor `bindings/go/constructor/go.mod`	Bumped `descriptor/normalisation`, `descriptor/runtime`, `oci`, and indirect `ctf` to v0.4.0.
CLI & Integration `cli/go.mod`, `cli/integration/go.mod`	Updated many OCM binding pins (`cel`, `ctf`, `descriptor/*`, `helm`, `rsa`, `signing`, `transfer`, `transform`) to newer pseudo-versions and v0.4.0 for `ctf`; `oci` → v0.0.38 where present.
OCI Integration & Repository `bindings/go/oci/integration/go.mod`, `bindings/go/repository/go.mod`	Advanced `descriptor/runtime` and `oci` pins to newer versions.
Kubernetes Controller `kubernetes/controller/go.mod`	Bumped `ctf` to v0.4.0 and advanced `descriptor/normalisation`, `descriptor/runtime`, `rsa`, and `signing` pseudo-versions.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

feat: explicit transfer module #2047 — Changes touch the bindings/go/transfer module and its integration go.mod, overlapping dependency pins updated here.
Repository PR/Issue #2152 — Renovate-style dependency update for OCM Go modules; directly related to the monorepo go module bumps in this diff.

Suggested reviewers

Skarlso
fabianburth
jakobmoellerdev

Poem

🐰
I hopped through go.mod with care,
Bumped versions here and there,
From e120070 to 5b24deb's tune,
Modules align beneath the moon,
Cheers — a rabbit's tidy prune. 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: updating OCM monorepo Go module dependencies while explicitly excluding the ctf module version bump.
Description check	✅ Passed	The description clearly explains why the PR is needed: reverting a ctf version bump that broke tests, with context about an in-progress larger fix.
Linked Issues check	✅ Passed	The PR addresses issue `#2152` by updating Go module dependencies as required, but strategically reverts the ctf v0.4.0 bump to v0.3.0 to fix breaking tests caused by that specific change.
Out of Scope Changes check	✅ Passed	All changes are in-scope: Go module dependency updates across 18 go.mod files targeting modules from issue `#2152`, with the intentional exclusion of ctf v0.4.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…omponent-model into fix-2152

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@bindings/go/oci/integration/go.mod`:
- Line 16: Update the module version pin in bindings/go/oci/integration/go.mod
so the ctf dependency matches the main binding; change the
ocm.software/open-component-model/bindings/go/ctf entry (currently v0.4.0) to
v0.3.0 to align with bindings/go/oci/go.mod and keep versions consistent across
the bindings.

In `@bindings/go/transfer/integration/go.mod`:
- Line 14: Update the version of the ctf module in the go.mod entry for
ocm.software/open-component-model/bindings/go/ctf from v0.4.0 back to v0.3.0 so
it matches the main branch; edit the dependency line in
bindings/go/transfer/integration/go.mod to reference
ocm.software/open-component-model/bindings/go/ctf v0.3.0 and run go mod tidy to
verify there are no module resolution issues.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c5c97d9b-a433-42bc-b592-109c34bb0789

📥 Commits

Reviewing files that changed from the base of the PR and between 6d0ee2c and ce31d30.

⛔ Files ignored due to path filters (18)

bindings/go/constructor/go.sum is excluded by !**/*.sum
bindings/go/descriptor/normalisation/go.sum is excluded by !**/*.sum
bindings/go/helm/go.sum is excluded by !**/*.sum
bindings/go/input/dir/go.sum is excluded by !**/*.sum
bindings/go/input/file/go.sum is excluded by !**/*.sum
bindings/go/input/utf8/go.sum is excluded by !**/*.sum
bindings/go/oci/go.sum is excluded by !**/*.sum
bindings/go/oci/integration/go.sum is excluded by !**/*.sum
bindings/go/plugin/go.sum is excluded by !**/*.sum
bindings/go/repository/go.sum is excluded by !**/*.sum
bindings/go/rsa/go.sum is excluded by !**/*.sum
bindings/go/signing/go.sum is excluded by !**/*.sum
bindings/go/transfer/go.sum is excluded by !**/*.sum
bindings/go/transfer/integration/go.sum is excluded by !**/*.sum
bindings/go/transform/go.sum is excluded by !**/*.sum
cli/go.sum is excluded by !**/*.sum
cli/integration/go.sum is excluded by !**/*.sum
kubernetes/controller/go.sum is excluded by !**/*.sum

📒 Files selected for processing (18)

bindings/go/constructor/go.mod
bindings/go/descriptor/normalisation/go.mod
bindings/go/helm/go.mod
bindings/go/input/dir/go.mod
bindings/go/input/file/go.mod
bindings/go/input/utf8/go.mod
bindings/go/oci/go.mod
bindings/go/oci/integration/go.mod
bindings/go/plugin/go.mod
bindings/go/repository/go.mod
bindings/go/rsa/go.mod
bindings/go/signing/go.mod
bindings/go/transfer/go.mod
bindings/go/transfer/integration/go.mod
bindings/go/transform/go.mod
cli/go.mod
cli/integration/go.mod
kubernetes/controller/go.mod

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

This reverts commit 8f78457. Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

…omponent-model into fix-2152

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

netlify · 2026-04-08T08:53:13Z

❌ Deploy Preview for ocm-website failed. Why did it fail? →

Name	Link
🔨 Latest commit	`d9fbcab`
🔍 Latest deploy log	https://app.netlify.com/projects/ocm-website/deploys/69d6177725adb70008de56cd

…component-model#2174)  #### What this PR does / why we need it open-component-model@e2b46f9 introduced a change in `ocm.software/open-component-model/bindings/go/ctf v0.4.0` that [breaks tests](https://github.com/open-component-model/open-component-model/actions/runs/24078003573/job/70231212198?pr=2152) in `bindings/go/oci/ctf`. A [fix](open-component-model#2049) is already in progress but it includes a bigger implementation that is not ready to merge yet. This is why, this PR reverts the version bump for that module for now. #### Which issue(s) this PR fixes Fixes open-component-model#2152 #### Testing Run `task test` and `task test/integration` --------- Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com> Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

ocmbot Bot and others added 2 commits April 7, 2026 10:32

fix(deps): update ocm monorepo go module dependencies

e8156e8

revert version bump

39bf0e4

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

github-actions Bot added kind/bugfix Bug size/m Medium labels Apr 7, 2026

frewilhelm added 2 commits April 7, 2026 13:39

Merge branch 'main' of https://github.com/open-component-model/open-c…

374f517

…omponent-model into fix-2152

Merge branch 'main' into fix-2152

ce31d30

frewilhelm marked this pull request as ready for review April 7, 2026 11:57

frewilhelm requested a review from a team as a code owner April 7, 2026 11:57

coderabbitai Bot reviewed Apr 7, 2026

View reviewed changes

Comment thread bindings/go/oci/integration/go.mod Outdated

Comment thread bindings/go/transfer/integration/go.mod Outdated

frewilhelm changed the title ~~fix: revert breaking module version bump~~ fix: Fix breaking module in version bump Apr 7, 2026

frewilhelm added 2 commits April 7, 2026 14:53

revert version bump in integration module as well

200a1ed

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

bump oci module

8f78457

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

github-actions Bot added the size/l Large label Apr 7, 2026

jakobmoellerdev changed the title ~~fix: Fix breaking module in version bump~~ fix(deps): update ocm monorepo go module dependencies (no ocm) Apr 7, 2026

jakobmoellerdev changed the title ~~fix(deps): update ocm monorepo go module dependencies (no ocm)~~ fix(deps): update ocm monorepo go module dependencies (no ctf) Apr 7, 2026

jakobmoellerdev previously approved these changes Apr 7, 2026

View reviewed changes

github-actions Bot added the kind/dependency dependency update, etc. label Apr 7, 2026

jakobmoellerdev reviewed Apr 7, 2026

View reviewed changes

Comment thread bindings/go/constructor/go.mod Outdated

morri-son previously approved these changes Apr 8, 2026

View reviewed changes

frewilhelm dismissed stale reviews from morri-son and jakobmoellerdev via 992ddb4 April 8, 2026 07:51

frewilhelm added 2 commits April 8, 2026 09:52

Revert "bump oci module"

993c5c0

This reverts commit 8f78457. Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

Merge branch 'main' of https://github.com/open-component-model/open-c…

af162a1

…omponent-model into fix-2152

frewilhelm force-pushed the fix-2152 branch from 992ddb4 to af162a1 Compare April 8, 2026 07:54

resolve merge conflict artifact

6740953

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

frewilhelm requested review from jakobmoellerdev and morri-son April 8, 2026 07:58

frewilhelm added 2 commits April 8, 2026 10:00

Merge branch 'main' into fix-2152

549ed89

revert module bump for bindings/go/ctf

d9fbcab

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

frewilhelm requested a review from fabianburth April 8, 2026 09:03

fabianburth approved these changes Apr 8, 2026

View reviewed changes

morri-son approved these changes Apr 8, 2026

View reviewed changes

frewilhelm merged commit 845f5a1 into open-component-model:main Apr 8, 2026
79 of 83 checks passed

coderabbitai Bot mentioned this pull request Apr 10, 2026

feat: version aliasing #2049

Merged

This was referenced Apr 21, 2026

fix: update module ocm.software/open-component-model/bindings/go/oci to v0.0.40 (#2331) #2352

Merged

fix(deps): fixes update ocm monorepo go module dependencies (patch) (#2331) #2401

Merged

This was referenced May 26, 2026

fix(transfer): update dependencies for Open Component Model bindings #2643

Merged

chore: apply patch for helm bug #2722

Merged

coderabbitai Bot mentioned this pull request Jun 8, 2026

feat(replication): create the workerpool for the transfer resolution service #2750

Open

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update ocm monorepo go module dependencies (no ctf)#2174

fix(deps): update ocm monorepo go module dependencies (no ctf)#2174
frewilhelm merged 11 commits into
open-component-model:mainfrom
frewilhelm:fix-2152

frewilhelm commented Apr 7, 2026

Uh oh!

coderabbitai Bot commented Apr 7, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

netlify Bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

frewilhelm commented Apr 7, 2026

What this PR does / why we need it

Which issue(s) this PR fixes

Testing

Uh oh!

coderabbitai Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

netlify Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for ocm-website failed. Why did it fail? →

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coderabbitai Bot commented Apr 7, 2026 •

edited

Loading

netlify Bot commented Apr 8, 2026 •

edited

Loading