Repository navigation
fix(deps): complete origin-ca vendor refresh - #5185
Conversation
![botantler-1[bot]](https://avatars.githubusercontent.com/in/1025824?s=60&v=4){kind=small}
Pull request was converted to draft
The failing provenance check is expected at unchanged head Upstream range review: 40ff6b2…987e227 contains one commit, release v0.15.1. Its changes update the upstream Go builder, supporting Go modules and controller image; neither CRD changes. Release-page notes were not published at collection, so this assessment uses the complete commit and four-file comparison. Those build/runtime changes do not apply to this CRD-source-only update, and no controller security remediation is claimed. The separately pinned chart and runtime image remain unchanged; no workaround, schema, default, licence or minimum-platform adaptation is indicated by this range. The required generator execution remains pending the existing validation-capacity prerequisite tracked in monorepo #4310. This PR is now a draft with automatic merge disabled, verified at the unchanged head. Resume with the maintained generator and pinned scanner, verify its generated output and existing regressions, then require fresh hosted CI and a substantive review of any adapted head. |
Refresh the generated CRD source record through the maintained updater. Bind cert-approver findings to the already-adopted 0.12.1 image and startup probe, with a real scanner regression tied to the committed deployment. Fixes #5188
devantler
changed the title
At The update exposed an older cert-approver binding left behind by #4114. The pinned v0.12.1 source passes its existing content digest; reversing only the adopted image and startup-probe changes reproduces the old resource fingerprint. This adaptation updates that resource-specific binding without changing any check, exception, scan threshold or source digest. A regression using the real pinned Checkov report fails before the repair and passes after it. The generator's real scans and secret canaries, committed-bundle validation, source-pin and remote-render regressions, Go tests/vet/lint, formatting and shell lint pass locally. Tracked by #5188. Fresh hosted CI now exposes a separate root-toolchain prerequisite: the reachable scan runs Go 1.26.9 and rejects GO-2026-6809. Existing #5164 tracks it, with root-module hotfix #5187 and the admission-module work in #5153. Keep this PR draft with auto-merge off. After the protected toolchain repair lands, refresh this branch from patched main and require fresh all-green CI, a substantive current-head review and normal protected delivery. No review request is being spent on this red build; the review lock acquired before reading the CI failure is unused. |
Blocker resolved: #5164 | upstream | last-verified 2026-10-21: closed. The Go 1.26.10 hotfix (#5187) is on |
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Readiness at
Upstream release review. The source pin moves to the origin-ca-issuer commit that carries v0.15.1. Both upstream CRDs and every committed vendored manifest stay byte-identical. The deployed chart and image do not change, so there is nothing to adopt. Promoting this PR and sending it through the merge queue. |
Post-merge source and hosted-validation verification: this PR's source head The complete merge-queue CI run has 23 settled jobs, including the expected skips. Its complete Go regression job actually ran This records independently checked source adoption, hosted validation and release publication for the completed change. The separate signed-tenant acceptance tracked by #4897 remains open. |
Why
The certificate issuer update cannot pass because the shared refresh process still expects an older reviewed resource.
What
Complete the upstream refresh and repair the check that rejects the certificate approver already in use. Detect this mismatch during future updates before it blocks delivery.
Fixes #5188