Simplify project tool dependencies into seperate go module#461
Merged
gardener-prow[bot] merged 6 commits intomasterfrom Mar 10, 2026
Merged
Simplify project tool dependencies into seperate go module#461gardener-prow[bot] merged 6 commits intomasterfrom
gardener-prow[bot] merged 6 commits intomasterfrom
Conversation
- Replace sort.Strings with slices.Sort in otlp_log_record_builder.go - Add nolint directive for intentional `log` package name
Move tool dependencies out of the main module into a dedicated tools/go.mod module (github.com/gardener/logging/v1/tools). Includes all previous tool directives plus gosec, which was previously installed ad-hoc via go install in tools.mk.
- Replace `include hack/tools.mk` with inline TOOLS_MODFILE variable - Remove GOSEC install target; gosec is now a go tool directive - Update all `go tool <cmd>` calls to `go tool -modfile=$(TOOLS_MODFILE) <cmd>` - Run `cd tools && go mod tidy` in the tidy target - Update add-license-header.sh and sast.sh to use go tool -modfile - Delete hack/tools.mk (no longer needed)
Change /tools ignore pattern to /tools/* so tool binaries remain ignored, but add negation rules to explicitly track go.mod and go.sum.
The .dockerignore uses an allowlist; add the tools module files so `cd tools && go mod tidy` succeeds inside the Docker builder stage.
The tools/ directory only ever contains go.mod and go.sum — tool binaries are installed at runtime into GOBIN. Remove the complex allowlist patterns and simply track the whole tools/ directory.
gardener-prow
bot
added
do-not-merge/needs-kind
Collaborator
Author
|
/approve |
gardener-prow
bot
added
the
approved
Collaborator
Author
|
/lgtm |
|
@nickytd: you cannot LGTM your own PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Bobi-Wan, nickytd The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
LGTM label has been added. DetailsGit tree hash: 4065f9eb9bafbd3f7a8677dc69eeb112d837694b |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
How to categorize this PR?
/kind technical-debt
/area logging
What this PR does / why we need it:
This PR separates build/development tool dependencies into a dedicated Go module at
tools/go.mod, decoupling them from the main project module (go.mod). Previously, tools likegolangci-lint,gci,gotestsum,kind,addlicense, andgosecwere tracked astooldirectives and indirect dependencies in the maingo.mod, polluting it with hundreds of linter and toolchain-only packages. The newtools/go.modis a standalone module (github.com/gardener/logging/v1/tools) that exclusively manages these tool dependencies. TheMakefileis updated to usego tool -modfile=$(TOOLS_MODFILE)for all tool invocations,hack/scripts are updated accordingly, and thehack/tools.mkfile is removed. Thetools/directory is now included in the Docker build context and tracked in git, while.gitignoreand.dockerignorerules are cleaned up. Additionally,sort.Stringsis replaced with the modernslices.Sortinpkg/client/otlp_log_record_builder.go, and arevivepackage-naming lint suppression comment is added topkg/log/logger.go.Code changes:
tools/go.mod(new): Introduces a separate Go module for build tools (golangci-lint,gci,gotestsum,kind,addlicense,gosec), removing these from the main module.go.mod: Removes all tooltooldirectives and their associated transitive dependencies (~100+ indirect entries), significantly slimming the main module.Makefile: AddsTOOLS_MODFILEvariable pointing totools/go.mod; updates allgo toolinvocations to use-modfile=$(TOOLS_MODFILE); addscd $(TOOLS_DIR) && go mod tidyto thetidytarget; removesinclude hack/tools.mkand the$(GOSEC)dependency fromsast/sast-reporttargets.hack/tools.mk: Deleted (superseded bytools/go.mod).hack/add-license-header.shandhack/sast.sh: Updated to referencetools/go.modvia-modfile..dockerignore: Added!tools/to include tools module in Docker build context..gitignore: Cleaned up and reorganized; removedtools/from the ignore list.pkg/client/otlp_log_record_builder.go: Replacedsort.Stringswithslices.Sort.pkg/log/logger.go: Added// nolint:revivecomment to suppress package-naming lint warning.Additional context:
This change requires
go 1.26.1(which supportsgo tool -modfile) and ensures that tool dependency churn no longer affects the main module'sgo.sumor dependency graph. Thetools/go.sumis committed alongsidetools/go.mod.Which issue(s) this PR fixes:
N/A
Special notes for your reviewer:
The
tools/go.sumfile is large but should be reviewed to confirm it only contains tool-related dependencies. Any CI pipeline invokinggo toolcommands will need access to thetools/directory at build time.Release note:
📬 Subscribe to the Hyperspace PR Bot DL to get the latest announcements and pilot features!
PR Bot Information
Version:
1.17.99| 📖 Documentation | 🚨 Create Incident | 💬 Feedback0642ead0-1c56-11f1-9579-3c66935d40a9issue_comment.edited