Skip to content

chore: remove --new-from-rev scoping from api-lint to prove pre-exist…#9063

Open
stevekuznetsov wants to merge 1 commit into
openshift:mainfrom
stevekuznetsov:skuznets/prove-api-lint-broken
Open

chore: remove --new-from-rev scoping from api-lint to prove pre-exist…#9063
stevekuznetsov wants to merge 1 commit into
openshift:mainfrom
stevekuznetsov:skuznets/prove-api-lint-broken

Conversation

@stevekuznetsov

@stevekuznetsov stevekuznetsov commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

…ing failures

The api-lint and api-lint-fix targets use --new-from-rev=$(PULL_BASE_SHA) --whole-files, which scopes linting to files changed since the base SHA. On main this means zero files are scanned, hiding 50 pre-existing kube-api-linter violations in hosted_controlplane.go and hostedcluster_types.go.

Any PR that touches either of those files triggers the full-file scan, and the auto-fixer produces broken code (e.g. +kubebuilder:default → +default, +kubebuilder:validation:Pattern → +kubebuilder:validation:XValidation), causing make lint-fix to fail.

This commit removes the scoping to expose the issue in CI.

Summary by CodeRabbit

  • Chores
    • Updated API linting commands to run consistently across the full API directory.
    • Removed conditional linting behavior based on pull request revision settings.

…ing failures

The api-lint and api-lint-fix targets use --new-from-rev=$(PULL_BASE_SHA)
--whole-files, which scopes linting to files changed since the base SHA.
On main this means zero files are scanned, hiding 50 pre-existing
kube-api-linter violations in hosted_controlplane.go and
hostedcluster_types.go.

Any PR that touches either of those files triggers the full-file scan,
and the auto-fixer produces broken code (e.g. +kubebuilder:default →
+default, +kubebuilder:validation:Pattern → +kubebuilder:validation:XValidation),
causing make lint-fix to fail.

This commit removes the scoping to expose the issue in CI.

Signed-off-by: Steve Kuznetsov <stekuznetsov@microsoft.com>
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Please specify an area label

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@coderabbitai

coderabbitai Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor
📝 Walkthrough

Walkthrough

The Makefile’s api-lint and api-lint-fix targets no longer conditionally pass --new-from-rev=$(PULL_BASE_SHA) or --whole-files to golangci-lint. Both targets retain their existing configuration, module-download, verbosity, and, for auto-fix, --fix options.

Suggested reviewers: bryan-cox, enxebre

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: removing --new-from-rev scoping from api-lint.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed This PR only changes Makefile lint targets; no Ginkgo tests or test titles were added or modified.
Test Structure And Quality ✅ Passed PR only changes Makefile lint targets; no Ginkgo or test files were modified, so the test-quality check is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed Only Makefile lint target flags changed; no manifests, operator code, or controllers were modified, so no scheduling constraints were introduced.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed Only Makefile changed; no new Ginkgo e2e tests or network-sensitive code were added, so this compatibility check is not applicable.
No-Weak-Crypto ✅ Passed PR only changes Makefile lint scoping; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or secret-comparison code is added or modified.
Container-Privileges ✅ Passed The patch only changes Makefile lint targets; no container/K8s manifests were modified, so it introduces no privileged settings.
No-Sensitive-Data-In-Logs ✅ Passed PR only changes Makefile lint flags; no logging code or new log statements were added, so no sensitive data exposure.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@stevekuznetsov

Copy link
Copy Markdown
Contributor Author

/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-v2-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke
/test unit
/test verify

@openshift-ci
openshift-ci Bot requested review from devguyio and ironcladlou July 22, 2026 18:16
@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: stevekuznetsov
Once this PR has been reviewed and has the lgtm label, please assign devguyio for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Around line 115-116: Update the api-lint-fix target to pass
--new-from-rev=$(PULL_BASE_SHA) --whole-files to the golangci-lint invocation,
ensuring fixes are limited to files changed from the pull request base while
checking complete files. Keep the existing api directory, configuration, fix
mode, and verbosity behavior unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 492ff18c-32c5-474d-8804-0775ffc42650

📥 Commits

Reviewing files that changed from the base of the PR and between 09265ac and c66b9a3.

📒 Files selected for processing (1)
  • Makefile

Comment thread Makefile
Comment on lines 115 to +116
api-lint-fix: $(GOLANGCI_LINT) $(KUBEAPILINTER_PLUGIN)
cd api && $(GOLANGCI_LINT) run --config ./.golangci.yml --fix -v $(if $(PULL_BASE_SHA),--new-from-rev=$(PULL_BASE_SHA) --whole-files)
cd api && $(GOLANGCI_LINT) run --config ./.golangci.yml --fix -v

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== relevant files ==\n'
git ls-files 'Makefile' '.pre-commit-config.yaml' | sed 's#^`#-` #'

printf '\n== Makefile excerpt ==\n'
nl -ba Makefile | sed -n '105,125p'

printf '\n== pre-commit excerpt ==\n'
nl -ba .pre-commit-config.yaml | sed -n '30,55p'

Repository: openshift/hypershift

Length of output: 281


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== search for api-lint-fix usage ==\n'
rg -n "api-lint-fix|PULL_BASE_SHA|new-from-rev|whole-files|--fix" -S .

printf '\n== golangci-lint docs/config mentions in repo ==\n'
rg -n "new-from-rev|whole-files|golangci-lint" -S README* docs . 2>/dev/null || true

Repository: openshift/hypershift

Length of output: 50377


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== Makefile lines 120-130 ==\n'
sed -n '120,130p' Makefile | cat -n

printf '\n== .pre-commit-config.yaml lines 37-44 ==\n'
sed -n '37,44p' .pre-commit-config.yaml | cat -n

printf '\n== Makefile api-lint-fix context ==\n'
sed -n '112,118p' Makefile | cat -n

Repository: openshift/hypershift

Length of output: 1445


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== golangci-lint flag docs in vendored source ==\n'
sed -n '120,145p' hack/tools/vendor/github.com/golangci/golangci-lint/v2/pkg/commands/flagsets.go | cat -n

printf '\n== any local docs for api-lint-fix ==\n'
sed -n '1,40p' docs/content/contribute/precommit-hook-help.md | cat -n

Repository: openshift/hypershift

Length of output: 4843


Scope api-lint-fix to the diff. This target ignores PULL_BASE_SHA, so the pre-commit hook can rewrite any file under api/ instead of only the staged change. Pass --new-from-rev=$(PULL_BASE_SHA) --whole-files through here, or split out a separate full-tree fix target.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Makefile` around lines 115 - 116, Update the api-lint-fix target to pass
--new-from-rev=$(PULL_BASE_SHA) --whole-files to the golangci-lint invocation,
ensuring fixes are limited to files changed from the pull request base while
checking complete files. Keep the existing api directory, configuration, fix
mode, and verbosity behavior unchanged.

@stevekuznetsov

Copy link
Copy Markdown
Contributor Author

The make lint-fix fixes for API linters are broken on main and cause PRs that touch the API to fail checks for pre-existing issues they did not touch.

I surmise what happened here is that from 1266ceb61, commits like 978f3ccd7 added new lint rules, but because they did not touch the API files directly, those PRs were not made to reckon with their implication for existing failures.

I would really recommend not trying to be clever in CI - it's really difficult to capture all possible inputs that make something fail and correctly map them to which subset needs to be validated. Just run the full thing.

cc @JoelSpeed @bryan-cox @enxebre

@cwbotbot

cwbotbot commented Jul 22, 2026

Copy link
Copy Markdown

Test Results

e2e-aws

Failed Tests

Total failed tests: 13

  • TestCreateCluster
  • TestCreateCluster/Main
  • TestCreateCluster/Main/EnsureGlobalPullSecret
  • TestCreateCluster/Main/EnsureGlobalPullSecret/Create_a_pod_which_uses_the_restricted_image,_should_succeed
  • TestCreateCluster/Main/EnsureGlobalPullSecret/Wait_for_pull_secret_synchronization_to_stabilize_across_all_nodes

... and 8 more failed tests

e2e-aks

@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

@stevekuznetsov: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-v2-aws c66b9a3 link true /test e2e-v2-aws
ci/prow/e2e-aws c66b9a3 link true /test e2e-aws
ci/prow/e2e-kubevirt-aws-ovn-reduced c66b9a3 link true /test e2e-kubevirt-aws-ovn-reduced
ci/prow/e2e-azure-v2-self-managed c66b9a3 link true /test e2e-azure-v2-self-managed
ci/prow/e2e-aws-upgrade-hypershift-operator c66b9a3 link true /test e2e-aws-upgrade-hypershift-operator

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@JoelSpeed

Copy link
Copy Markdown
Contributor

FWIW, we have had no issues with --new-from-rev in either o/api or o/hypershift up until --whole-files was added in hypershift recently. I think that is being reverted so the issue should go away again

@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 23, 2026
@openshift-ci

openshift-ci Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/needs-area needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants