fix: update module ocm.software/open-component-model/bindings/go/oci to v0.0.40 (#2331) by frewilhelm · Pull Request #2352 · open-component-model/open-component-model

frewilhelm · 2026-04-21T09:03:14Z

What this PR does / why we need it

Adapts all consumers to the breaking change introduced in #2275: GlobalAccessPolicy now defaults to Never, meaning localBlob resources no longer have a globalAccess field populated after transfer.

This upgrades bindings/go/oci from v0.0.39 to v0.0.40 and updates go.mod/go.sum across 8 consuming modules (constructor, helm, oci/integration, transfer, transfer/integration, cli, cli/integration, kubernetes/controller).

Test fixes:

transfer/integration: Rewrites the CopyModeAllResources test — instead of verifying globalAccess is non-nil and resolvable in the target registry, it now asserts globalAccess is nil and verifies the blob is directly readable from the target repository via GetLocalResource
cli/integration: Replaces weak output assertions (checking registry addresses from globalAccess image references) with a stronger negative test that proves component-b is unreachable from registry-a without resolver config, confirming resolver routing actually works

Conformance scenario fixes:

RGD: Replaces resource.access.globalAccess.imageReference.toOCI() with resource.access.toOCI(), which constructs the OCI reference directly from the component's repository spec and local reference digest
RGD: Uses image.digest instead of image.tag in HelmRelease values, since toOCI() on a localBlob returns only a digest reference (no tag)
RGD: Drops the tag field from additionalStatusFields — no longer available without globalAccess
Helm chart templates (notes + postgres): Switches image references from :tag to @digest format
Helm chart values: Replaces tag field with digest field

Documentation:

Sovereign cloud ADR: Updates CEL expression examples from resource.access.globalAccess.imageReference.toOCI() to resource.access.toOCI()
OCM controllers concept page: Updates CEL example from resource.access.globalAccess.imageReference.split('/')[0] to resource.access.toOCI().registry

How it was tested

Unit tests: all modules pass
Integration tests: transfer/integration and cli/integration pass
E2E tests: 12/12 pass on Kind cluster
Conformance scenario: passes with both the current CLI (0.0.0-main, which still populates globalAccess) and a locally-built CLI using OCI v0.0.40 (which does not)

Which issue(s) this PR fixes

Fixes #2331

…o/oci to v0.0.40

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

netlify · 2026-04-21T09:03:20Z

✅ Deploy Preview for ocm-website ready!

Name	Link
🔨 Latest commit	`9f6a881`
🔍 Latest deploy log	https://app.netlify.com/projects/ocm-website/deploys/69f04bf8451f870008af5b8f
😎 Deploy Preview	https://deploy-preview-2352--ocm-website.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

coderabbitai · 2026-04-21T09:03:27Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1c516ae2-76cc-4a80-9fd0-f383621bf728

📥 Commits

Reviewing files that changed from the base of the PR and between 9270ae7 and ea19b4d.

⛔ Files ignored due to path filters (7)

bindings/go/constructor/go.sum is excluded by !**/*.sum
bindings/go/helm/go.sum is excluded by !**/*.sum
bindings/go/transfer/go.sum is excluded by !**/*.sum
bindings/go/transfer/integration/go.sum is excluded by !**/*.sum
cli/go.sum is excluded by !**/*.sum
cli/integration/go.sum is excluded by !**/*.sum
kubernetes/controller/go.sum is excluded by !**/*.sum

📒 Files selected for processing (16)

bindings/go/constructor/go.mod
bindings/go/helm/go.mod
bindings/go/oci/integration/go.mod
bindings/go/transfer/go.mod
bindings/go/transfer/integration/go.mod
bindings/go/transfer/integration/integration_test.go
cli/go.mod
cli/integration/go.mod
cli/integration/resolver_integration_test.go
conformance/scenarios/sovereign/README.md
conformance/scenarios/sovereign/components/notes/deploy/chart/templates/deployment.yaml
conformance/scenarios/sovereign/components/notes/deploy/chart/values.yaml
conformance/scenarios/sovereign/components/postgres/deploy/chart/values.yaml
conformance/scenarios/sovereign/components/product/deploy/rgd.yaml
docs/adr/0013_sovereign_cloud_reference_scenario.md
kubernetes/controller/go.mod

✅ Files skipped from review due to trivial changes (9)

conformance/scenarios/sovereign/README.md
bindings/go/oci/integration/go.mod
cli/integration/go.mod
kubernetes/controller/go.mod
bindings/go/helm/go.mod
cli/go.mod
bindings/go/transfer/integration/go.mod
bindings/go/constructor/go.mod
bindings/go/transfer/go.mod

🚧 Files skipped from review as they are similar to previous changes (4)

conformance/scenarios/sovereign/components/postgres/deploy/chart/values.yaml
docs/adr/0013_sovereign_cloud_reference_scenario.md
conformance/scenarios/sovereign/components/notes/deploy/chart/templates/deployment.yaml
conformance/scenarios/sovereign/components/notes/deploy/chart/values.yaml

📝 Walkthrough

Walkthrough

Bumped multiple Go module references to ocm.software/open-component-model/bindings/go/oci v0.0.40, adjusted integration tests to assert local blob behavior, migrated Helm charts from tag-based to digest-based image references, and replaced CEL/docs usages with resource.access.toOCI() status extraction.

Changes

Cohort / File(s)	Summary
Go module updates `bindings/go/constructor/go.mod`, `bindings/go/helm/go.mod`, `bindings/go/oci/integration/go.mod`, `bindings/go/transfer/go.mod`, `bindings/go/transfer/integration/go.mod`, `cli/go.mod`, `cli/integration/go.mod`, `kubernetes/controller/go.mod`	Bumped `ocm.software/open-component-model/bindings/go/oci` from `v0.0.39` → `v0.0.40` in multiple `go.mod` files.
Integration tests `bindings/go/transfer/integration/integration_test.go`, `cli/integration/resolver_integration_test.go`	Updated assertions to expect local blob access (no globalAccess/remote imageReference checks); simplified resolver reachability assertions and updated imports.
Helm charts & values `conformance/scenarios/sovereign/components/notes/deploy/chart/templates/deployment.yaml`, `conformance/scenarios/sovereign/components/postgres/deploy/chart/templates/deployment.yaml`, `conformance/scenarios/sovereign/components/notes/deploy/chart/values.yaml`, `conformance/scenarios/sovereign/components/postgres/deploy/chart/values.yaml`	Switched image references from tag-based (`repository:tag`) to digest-based (`repository@digest`); removed `image.tag`, added/used `image.digest`.
RGD / CEL / Docs `conformance/scenarios/sovereign/components/product/deploy/rgd.yaml`, `docs/adr/0013_sovereign_cloud_reference_scenario.md`, `website/content/docs/concepts/ocm-controllers.md`	Replaced `resource.access.globalAccess.imageReference.toOCI()`-style extraction with `resource.access.toOCI()` and adjusted status shape/field references (use `additional.oci.*`).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

feat: update toOCI to handle OCI and localBlob transparently #1943 — Adjusts toOCI behavior and callers; aligns with test and CEL/status changes here.
fix(deps): update ocm monorepo go module dependencies (no ctf) #2174 — Related dependency/version updates for bindings/go/oci across go.mod files.
fix: Normalize scheme handling and update identity type to OCIRegistry #1964 — Related updates in oci bindings and integration tests affecting identity/url handling.

Suggested labels

kind/dependency

Suggested reviewers

morri-son
jakobmoellerdev

Poem

🐇 I hopped through go.mod and charts tonight,
Digests now shining, tags out of sight.
Tests sniff local blobs, quiet and sweet,
CELs trimmed tidy—status fields neat,
🥕 A tiny rabbit’s commit — quick and light.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the primary change: updating the ocm.software/open-component-model/bindings/go/oci module from v0.0.39 to v0.0.40, which is the core dependency upgrade across all modules.
Description check	✅ Passed	The description clearly relates to the changeset, explaining the breaking change in GlobalAccessPolicy, detailing test fixes, conformance scenario updates, documentation changes, and testing results.
Linked Issues check	✅ Passed	The PR successfully addresses the linked issue `#2331` by updating ocm.software/open-component-model/bindings/go/oci from v0.0.39 to v0.0.40 across all required modules and adapting code, tests, and documentation to the breaking change where GlobalAccessPolicy defaults to Never.
Out of Scope Changes check	✅ Passed	All changes are directly in scope: dependency version bumps in go.mod files, test adaptations to the breaking change, conformance scenario updates for RGD/Helm, and documentation updates reflecting the new API. No unrelated changes detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…omponent-model into fix-2331

frewilhelm · 2026-04-21T09:06:30Z

@coderabbitai review

coderabbitai · 2026-04-21T09:06:36Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@bindings/go/transfer/integration/integration_test.go`:
- Around line 921-925: The test currently only asserts the resource descriptor
type (gotDesc.Component.Resources[0].Access -> descriptorv2.LocalBlobAccessType)
but doesn't verify the blob is actually present in the target; update the test
to retrieve the localBlob from the target repository and assert it can be
resolved/downloaded (use targetRepo or the resource repository used in the
test), e.g. locate the resource's local blob reference from gotAccess and call
the repository's Resolve/Fetch method and assert the blob exists and is readable
so CopyModeAllResources failures are caught at test-time.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3b1971fa-15b7-4ced-b129-28b8592d40e2

📥 Commits

Reviewing files that changed from the base of the PR and between 21aeadb and 4a00a61.

⛔ Files ignored due to path filters (7)

bindings/go/constructor/go.sum is excluded by !**/*.sum
bindings/go/helm/go.sum is excluded by !**/*.sum
bindings/go/transfer/go.sum is excluded by !**/*.sum
bindings/go/transfer/integration/go.sum is excluded by !**/*.sum
cli/go.sum is excluded by !**/*.sum
cli/integration/go.sum is excluded by !**/*.sum
kubernetes/controller/go.sum is excluded by !**/*.sum

📒 Files selected for processing (15)

bindings/go/constructor/go.mod
bindings/go/helm/go.mod
bindings/go/oci/integration/go.mod
bindings/go/transfer/go.mod
bindings/go/transfer/integration/go.mod
bindings/go/transfer/integration/integration_test.go
cli/go.mod
cli/integration/go.mod
cli/integration/resolver_integration_test.go
conformance/scenarios/sovereign/components/notes/deploy/chart/templates/deployment.yaml
conformance/scenarios/sovereign/components/postgres/deploy/chart/templates/deployment.yaml
conformance/scenarios/sovereign/components/product/deploy/rgd.yaml
docs/adr/0013_sovereign_cloud_reference_scenario.md
kubernetes/controller/go.mod
website/content/docs/concepts/ocm-controllers.md

💤 Files with no reviewable changes (1)

cli/integration/resolver_integration_test.go

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

…omponent-model into fix-2331

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

…omponent-model into fix-2331

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

…to v0.0.40 (#2331) (#2352) #### What this PR does / why we need it Adapts all consumers to the breaking change introduced in #2275: `GlobalAccessPolicy` now defaults to `Never`, meaning `localBlob` resources no longer have a `globalAccess` field populated after transfer. This upgrades `bindings/go/oci` from v0.0.39 to v0.0.40 and updates `go.mod`/`go.sum` across 8 consuming modules (constructor, helm, oci/integration, transfer, transfer/integration, cli, cli/integration, kubernetes/controller). **Test fixes:** - `transfer/integration`: Rewrites the `CopyModeAllResources` test — instead of verifying `globalAccess` is non-nil and resolvable in the target registry, it now asserts `globalAccess` is nil and verifies the blob is directly readable from the target repository via `GetLocalResource` - `cli/integration`: Replaces weak output assertions (checking registry addresses from `globalAccess` image references) with a stronger negative test that proves component-b is unreachable from registry-a without resolver config, confirming resolver routing actually works **Conformance scenario fixes:** - RGD: Replaces `resource.access.globalAccess.imageReference.toOCI()` with `resource.access.toOCI()`, which constructs the OCI reference directly from the component's repository spec and local reference digest - RGD: Uses `image.digest` instead of `image.tag` in HelmRelease values, since `toOCI()` on a `localBlob` returns only a digest reference (no tag) - RGD: Drops the `tag` field from `additionalStatusFields` — no longer available without `globalAccess` - Helm chart templates (notes + postgres): Switches image references from `:tag` to `@digest` format - Helm chart values: Replaces `tag` field with `digest` field **Documentation:** - Sovereign cloud ADR: Updates CEL expression examples from `resource.access.globalAccess.imageReference.toOCI()` to `resource.access.toOCI()` - OCM controllers concept page: Updates CEL example from `resource.access.globalAccess.imageReference.split('/')[0]` to `resource.access.toOCI().registry` #### How it was tested - Unit tests: all modules pass - Integration tests: `transfer/integration` and `cli/integration` pass - E2E tests: 12/12 pass on Kind cluster - Conformance scenario: passes with both the current CLI (`0.0.0-main`, which still populates `globalAccess`) and a locally-built CLI using OCI v0.0.40 (which does not) #### Which issue(s) this PR fixes Fixes #2331 --------- Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com> Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com> Co-authored-by: Matthias Bruns <github@matthiasbruns.com> f71796b

ocmbot Bot and others added 5 commits April 20, 2026 14:02

fix(deps): update module ocm.software/open-component-model/bindings/g…

bdb816f

…o/oci to v0.0.40

fix transfer integration scenario

f8c70ae

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

fix cli integration test

e3d6f80

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

fix conformance scenario

15ec978

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

adjust website doc

b41d337

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

github-actions Bot added the kind/bugfix Bug label Apr 21, 2026

github-actions Bot added size/m Medium area/documentation Documentation related labels Apr 21, 2026

Merge branch 'main' of https://github.com/open-component-model/open-c…

4a00a61

…omponent-model into fix-2331

coderabbitai Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread bindings/go/transfer/integration/integration_test.go

frewilhelm added 2 commits April 21, 2026 11:35

make sure local blob is present

c4a3371

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

adjust tag to digest

4acd2b4

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

frewilhelm marked this pull request as ready for review April 21, 2026 11:24

frewilhelm requested a review from a team as a code owner April 21, 2026 11:24

frewilhelm requested a review from fabianburth April 21, 2026 11:26

morri-son previously approved these changes Apr 21, 2026

View reviewed changes

frewilhelm marked this pull request as draft April 21, 2026 12:01

Merge branch 'main' of https://github.com/open-component-model/open-c…

6f1ab01

…omponent-model into fix-2331

frewilhelm dismissed morri-son’s stale review via 6f1ab01 April 21, 2026 12:34

frewilhelm marked this pull request as ready for review April 21, 2026 13:00

Merge branch 'main' into fix-2331

8351fcd

frewilhelm requested a review from morri-son April 21, 2026 13:22

morri-son previously approved these changes Apr 21, 2026

View reviewed changes

frewilhelm added 2 commits April 22, 2026 10:52

Merge branch 'main' into fix-2331

5e2af75

Merge branch 'main' of https://github.com/open-component-model/open-c…

b6ce869

…omponent-model into fix-2331

frewilhelm dismissed morri-son’s stale review via b6ce869 April 22, 2026 09:27

frewilhelm mentioned this pull request Apr 23, 2026

fix(deps): update module ocm.software/open-component-model/bindings/go/credentials to v0.0.10 #2331

Closed

1 task

morri-son previously approved these changes Apr 23, 2026

View reviewed changes

Merge branch 'main' of https://github.com/open-component-model/open-c…

e635b89

…omponent-model into fix-2331

frewilhelm dismissed morri-son’s stale review via e635b89 April 23, 2026 13:38

frewilhelm requested a review from morri-son April 23, 2026 13:53

frewilhelm and others added 4 commits April 23, 2026 17:22

make sure digest is required in the conformance scenario

44bca89

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

add assertions

70b8656

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

Merge branch 'main' of https://github.com/open-component-model/open-c…

abd748a

…omponent-model into fix-2331

Merge branch 'main' into fix-2331

caed01c

matthiasbruns previously approved these changes Apr 24, 2026

View reviewed changes

frewilhelm dismissed matthiasbruns’s stale review via 57db94a April 27, 2026 11:24

Merge branch 'main' of https://github.com/open-component-model/open-c…

5f47312

…omponent-model into fix-2331

frewilhelm force-pushed the fix-2331 branch from 57db94a to 5f47312 Compare April 27, 2026 11:26

frewilhelm requested a review from matthiasbruns April 27, 2026 12:11

Merge branch 'main' into fix-2331

12abe5d

matthiasbruns previously approved these changes Apr 27, 2026

View reviewed changes

Merge branch 'main' into fix-2331

80ff4f2

fabianburth reviewed Apr 27, 2026

View reviewed changes

Comment thread conformance/scenarios/sovereign/components/product/deploy/rgd.yaml Outdated

Comment thread conformance/scenarios/sovereign/components/notes/deploy/chart/values.yaml

flatten additional status fields

f037bc5

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

frewilhelm dismissed matthiasbruns’s stale review via f037bc5 April 27, 2026 16:07

add comment about empty digest field

ea19b4d

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

frewilhelm requested review from fabianburth and matthiasbruns April 27, 2026 16:16

Merge branch 'main' into fix-2331

9f6a881

fabianburth approved these changes Apr 28, 2026

View reviewed changes

frewilhelm enabled auto-merge (squash) April 28, 2026 06:28

matthiasbruns approved these changes Apr 28, 2026

View reviewed changes

frewilhelm merged commit f71796b into open-component-model:main Apr 28, 2026
64 checks passed

coderabbitai Bot mentioned this pull request Apr 29, 2026

feat(oci): push ownership referrer on local artifact upload #2368

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: update module ocm.software/open-component-model/bindings/go/oci to v0.0.40 (#2331)#2352

fix: update module ocm.software/open-component-model/bindings/go/oci to v0.0.40 (#2331)#2352
frewilhelm merged 29 commits into
open-component-model:mainfrom
frewilhelm:fix-2331

frewilhelm commented Apr 21, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Apr 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 21, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

frewilhelm commented Apr 21, 2026

Uh oh!

coderabbitai Bot commented Apr 21, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

frewilhelm commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it

How it was tested

Which issue(s) this PR fixes

Uh oh!

netlify Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for ocm-website ready!

Uh oh!

coderabbitai Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

frewilhelm commented Apr 21, 2026

Uh oh!

coderabbitai Bot commented Apr 21, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

frewilhelm commented Apr 21, 2026 •

edited

Loading

netlify Bot commented Apr 21, 2026 •

edited

Loading

coderabbitai Bot commented Apr 21, 2026 •

edited

Loading