Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ require (
github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
github.com/leodido/go-urn v1.4.0 // indirect
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
github.com/lufia/plan9stats c963978e514e // indirect
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚑ Quick win

Missing go.sum update for dependency change.

When go.mod is updated with a new dependency version, the corresponding go.sum file should also be updated to include the checksums for the new version. The absence of go.sum changes in this PR suggests the module files may not be in a valid state, which could cause checksum verification failures during builds.

After correcting the version format, run go mod tidy to regenerate the go.sum entries:

go mod tidy

This will ensure the go.sum file contains the proper checksums for the updated dependency.

πŸ€– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 102, The go.mod change added/modified the dependency entry
"github.com/lufia/plan9stats c963978e514e" but go.sum wasn't updated; run "go
mod tidy" to regenerate and add the missing checksums, verify the version string
is a valid module version (replace the short commit ref with a proper
pseudo-version if needed), and commit the updated go.sum so checksum
verification succeeds during builds.

⚠️ Potential issue | πŸ”΄ Critical | ⚑ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Fetch the correct pseudo-version for the commit hash c963978e514e

# Get commit timestamp and construct proper pseudo-version
git clone --quiet https://github.com/lufia/plan9stats.git /tmp/plan9stats 2>/dev/null || true
cd /tmp/plan9stats

# Verify the commit exists
if git cat-file -e c963978e514e^{commit} 2>/dev/null; then
  # Get commit timestamp in the format Go expects
  timestamp=$(git show -s --format=%cd --date=format:'%Y%m%d%H%M%S' c963978e514e)
  short_hash=$(git rev-parse --short=12 c963978e514e)
  echo "Correct pseudo-version format: v0.0.0-${timestamp}-${short_hash}"
else
  echo "ERROR: Commit c963978e514e not found in repository"
fi

# Clean up
cd - > /dev/null
rm -rf /tmp/plan9stats

Repository: openshift-hyperfleet/hyperfleet-api

Length of output: 253


🏁 Script executed:

#!/bin/bash
# Check the actual go.mod content around line 102
echo "=== go.mod around line 102 ==="
sed -n '100,105p' go.mod

echo -e "\n=== Check for plan9stats in go.mod ==="
rg 'plan9stats' go.mod

echo -e "\n=== Check for plan9stats in go.sum ==="
if [ -f go.sum ]; then
  rg 'plan9stats' go.sum || echo "No plan9stats entries in go.sum"
else
  echo "go.sum not found"
fi

Repository: openshift-hyperfleet/hyperfleet-api

Length of output: 810


🏁 Script executed (no clone):

# Verify if a bare commit hash without pseudo-version prefix is valid in Go modules
cat <<'EOF'
According to Go module versioning specification (https://go.dev/doc/modules/version-numbers):
- Pseudo-versions must follow format: vX.Y.Z-prerelease+metadata or v0.0.0-YYYYMMDDHHMMSS-hash
- Bare commit hashes (like c963978e514e) are NOT valid module versions

Go will reject bare hashes and require `go get module@commit` syntax during fetch,
which is then converted to a pseudo-version in go.mod.

The version "c963978e514e" appears malformed. If this came from `go get`, Go itself
would have converted it to a proper pseudo-version during resolution.
EOF

Length of output: 585


Invalid Go module version format β€” go.mod and go.sum are mismatched.

Line 102 contains c963978e514e, a bare commit hash that violates Go's module versioning specification. Valid pseudo-versions must follow the format v0.0.0-YYYYMMDDHHMMSS-hash. Your go.sum still references the proper pseudo-version v0.0.0-20211012122336-39d0f177ccd0, but go.mod's bare hash will cause go mod tidy and go build to fail. Additionally, other hyperfleet services (sentinel, adapter, broker) already use the newer version v0.0.0-20251013123823-9fd1530e3ec3. Either revert go.mod to match go.sum's version, or run go mod tidy to reconcile both files with a valid pseudo-version.

πŸ€– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 102, go.mod contains an invalid bare commit hash for the
dependency github.com/lufia/plan9stats (c963978e514e) which breaks module
versioning; replace the bare hash with a valid pseudo-version or reconcile
modules by running `go mod tidy` so go.mod matches go.sum (either restore the
pseudo-version v0.0.0-20211012122336-39d0f177ccd0 referenced in go.sum or update
to the newer pseudo-version used by other services
v0.0.0-20251013123823-9fd1530e3ec3), ensuring the entry for
github.com/lufia/plan9stats is a proper pseudo-version string rather than a raw
commit hash.

github.com/magiconair/properties v1.8.10 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
Expand Down