ROSAENG-61040 | refactor: remove 10 underutilized third-party dependencies#3411
Closed
markirish wants to merge 1 commit into
Closed
ROSAENG-61040 | refactor: remove 10 underutilized third-party dependencies#3411markirish wants to merge 1 commit into
markirish wants to merge 1 commit into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
Contributor
|
Skipping CI for Draft Pull Request. |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: markirish The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Warning Review limit reached
Next review available in: 10 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (70)
📒 Files selected for processing (28)
📝 WalkthroughWalkthroughThe pull request adds an internal ordered JSON map and switches its consumers from an external implementation. AWS logging is simplified to logrus-only usage. Mirror version extraction moves from goquery to streaming HTML tokenization. Command validation, terminal sizing, and error wrapping are updated. Shell quoting and download byte formatting become internal helpers, YAML imports move to yaml.v3, and module requirements are adjusted. Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (6)
internal/ordered/ordered.go (1)
10-10: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDocument the exported ordered-map API.
Add Go doc comments for
KVPair,OrderedMap,NewOrderedMap, and the exported methods.As per coding guidelines, “Use exported symbol doc comments when new public types or functions are introduced.”
Also applies to: 15-15, 20-20, 26-26, 33-33, 45-45, 68-68
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/ordered/ordered.go` at line 10, Add Go doc comments to the exported ordered-map symbols KVPair, OrderedMap, NewOrderedMap, and every exported method in internal/ordered/ordered.go. Ensure each comment starts with the corresponding symbol name and briefly describes its purpose, without changing implementation behavior.Source: Coding guidelines
cmd/list/gates/cmd.go (1)
188-191: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winExtract the fallback width into a named constant.
80is a behavior-defining default; name it instead of leaving a magic number in the terminal-sizing path.As per coding guidelines, avoid magic numbers when the value matters to behavior or readability.
Proposed fix
+const defaultTerminalWidth = 80 + ... - cols = 80 + cols = defaultTerminalWidth🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/list/gates/cmd.go` around lines 188 - 191, Define a named constant for the default terminal width used in the terminal-sizing path, then replace the literal 80 in the cols fallback within term.GetSize handling with that constant. Preserve the existing behavior when size detection fails or returns a non-positive width.Source: Coding guidelines
cmd/create/idp/google.go (1)
138-139: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAdd regression coverage for the validator change.
The supplied
cmd/create/idp/validators_test.gocontext only coversexample.comand"not a domain", while this change alters normalization and DNS validation rules. Add focused Ginkgo/Gomega cases for uppercase input, length limits, hyphens, underscores, trailing dots, and the intended value casing passed toHostedDomain.As per coding guidelines, behavior changes require focused automated tests using Ginkgo v2 and Gomega.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/create/idp/google.go` around lines 138 - 139, Add focused Ginkgo v2/Gomega regression cases in the existing validator tests for the hosted-domain validation flow around isValidHostedDomain: cover uppercase normalization, maximum and over-limit lengths, valid and invalid hyphen placement, underscore rejection, trailing-dot rejection, and verify HostedDomain receives the intended normalized casing. Reuse the existing test setup and assertions without changing unrelated validation behavior.Source: Coding guidelines
pkg/helper/helpers.go (2)
269-269: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDocument the new exported function.
Add a Go doc comment describing that
ShellQuotereturns a POSIX-shell-escaped single argument.As per coding guidelines, new exported functions require doc comments.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helper/helpers.go` at line 269, Document the exported ShellQuote function with a Go doc comment beginning with “ShellQuote” and describing that it returns a POSIX-shell-escaped single argument.Source: Coding guidelines
266-277: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAdd focused tests for the shell-quoting contract.
Cover empty strings, safe values, shell metacharacters, whitespace, and embedded single quotes to prevent regressions in this security-sensitive replacement.
Based on coding guidelines and path instructions, changed behavior should have focused Ginkgo v2/Gomega coverage.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helper/helpers.go` around lines 266 - 277, Add focused Ginkgo v2/Gomega coverage for ShellQuote, covering empty strings, safe unquoted values, shell metacharacters, whitespace, and embedded single quotes with exact expected outputs. Place the tests alongside the existing helper tests and preserve the current quoting contract.Sources: Coding guidelines, Path instructions
pkg/helper/download/download.go (1)
153-171: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAdd regression tests for
readableBytes.The custom formatter replaces
humanize.Bytesand changes user-facing rounding behavior. Cover 0/999/1000 bytes, values near 10 units, unit boundaries, andmath.MaxUint64to preserve output compatibility and catch edge cases.As per coding guidelines and path instructions, behavior changes require focused Ginkgo v2/Gomega tests.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helper/download/download.go` around lines 153 - 171, Add focused Ginkgo v2/Gomega regression tests for readableBytes covering 0, 999, and 1000 bytes; values just below, at, and above 10 units; each unit boundary; and math.MaxUint64. Assert the exact formatted strings to preserve the existing humanize.Bytes-compatible rounding behavior and expose overflow or suffix-index edge cases.Sources: Coding guidelines, Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/ordered/ordered.go`:
- Around line 116-117: Update the decoding logic in the ordered map around
om.keys and om.values to call om.Set(key, value) instead of appending the key
and assigning the value directly. Preserve the existing key order while ensuring
duplicate JSON members replace the prior value without creating duplicate
positions.
- Around line 68-70: Update OrderedMap.UnmarshalJSON to reset keys and allocate
a fresh values map before decoding, ensuring zero-value receivers cannot panic
and reused receivers discard keys absent from the new JSON document. Add
regression tests covering unmarshalling into a zero-value OrderedMap and reusing
an already populated receiver.
In `@pkg/version/retriever.go`:
- Around line 101-110: Update the parseVersionLinksFromHTML error return in the
version retrieval flow to wrap the original error with %w instead of %v,
preserving errors.Is/errors.As behavior while retaining the existing context
message.
- Around line 152-162: Update hasClass to treat the class attribute as a
space-separated token list and return true when any token equals the requested
class, preserving false for non-matching attributes. Add a retriever_test.go
fixture row such as class="file odd" to verify multi-class rows are included.
---
Nitpick comments:
In `@cmd/create/idp/google.go`:
- Around line 138-139: Add focused Ginkgo v2/Gomega regression cases in the
existing validator tests for the hosted-domain validation flow around
isValidHostedDomain: cover uppercase normalization, maximum and over-limit
lengths, valid and invalid hyphen placement, underscore rejection, trailing-dot
rejection, and verify HostedDomain receives the intended normalized casing.
Reuse the existing test setup and assertions without changing unrelated
validation behavior.
In `@cmd/list/gates/cmd.go`:
- Around line 188-191: Define a named constant for the default terminal width
used in the terminal-sizing path, then replace the literal 80 in the cols
fallback within term.GetSize handling with that constant. Preserve the existing
behavior when size detection fails or returns a non-positive width.
In `@internal/ordered/ordered.go`:
- Line 10: Add Go doc comments to the exported ordered-map symbols KVPair,
OrderedMap, NewOrderedMap, and every exported method in
internal/ordered/ordered.go. Ensure each comment starts with the corresponding
symbol name and briefly describes its purpose, without changing implementation
behavior.
In `@pkg/helper/download/download.go`:
- Around line 153-171: Add focused Ginkgo v2/Gomega regression tests for
readableBytes covering 0, 999, and 1000 bytes; values just below, at, and above
10 units; each unit boundary; and math.MaxUint64. Assert the exact formatted
strings to preserve the existing humanize.Bytes-compatible rounding behavior and
expose overflow or suffix-index edge cases.
In `@pkg/helper/helpers.go`:
- Line 269: Document the exported ShellQuote function with a Go doc comment
beginning with “ShellQuote” and describing that it returns a POSIX-shell-escaped
single argument.
- Around line 266-277: Add focused Ginkgo v2/Gomega coverage for ShellQuote,
covering empty strings, safe unquoted values, shell metacharacters, whitespace,
and embedded single quotes with exact expected outputs. Place the tests
alongside the existing helper tests and preserve the current quoting contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: b10a090b-7007-4d61-9648-99df9ff6e955
⛔ Files ignored due to path filters (70)
go.sumis excluded by!**/*.sumvendor/github.com/PuerkitoBio/goquery/.gitattributesis excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/.gitignoreis excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/array.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/expand.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/filter.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/iteration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/manipulation.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/property.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/query.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/traversal.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/type.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/utilities.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/.travis.ymlis excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/parser.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/pseudo_classes.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/selector.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/serialize.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/specificity.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dchest/validator/.travis.ymlis excluded by!vendor/**,!**/vendor/**vendor/github.com/dchest/validator/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/dchest/validator/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/dchest/validator/domain.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dchest/validator/email.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/.travis.ymlis excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/README.markdownis excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/big.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/bigbytes.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/bytes.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/comma.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/commaf.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/ftoa.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/humanize.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/number.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/ordinals.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/si.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/times.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/nathan-fiscaletti/consolesize-go/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/nathan-fiscaletti/consolesize-go/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/nathan-fiscaletti/consolesize-go/consolesize_unix.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/nathan-fiscaletti/consolesize-go/consolesize_windows.gois excluded by!vendor/**,!**/vendor/**vendor/gitlab.com/c0b/go-ordered-json/.gitlab-ci.ymlis excluded by!vendor/**,!**/vendor/**vendor/gitlab.com/c0b/go-ordered-json/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/gitlab.com/c0b/go-ordered-json/README.mdis excluded by!vendor/**,!**/vendor/**vendor/gitlab.com/c0b/go-ordered-json/ordered.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/.travis.ymlis excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/LICENSE.libyamlis excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/NOTICEis excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/README.mdis excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/apic.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/decode.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/emitterc.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/encode.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/parserc.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/readerc.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/resolve.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/scannerc.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/sorter.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/writerc.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/yaml.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/yamlh.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/yamlprivateh.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (25)
cmd/create/idp/google.gocmd/list/gates/cmd.gocmd/upgrade/machinepool/cmd.gogo.modinternal/ordered/ordered.gointernal/ordered/ordered_test.gopkg/aws/client.gopkg/aws/client_test.gopkg/aws/cloudformation_test.gopkg/aws/idps_test.gopkg/aws/logging.gopkg/aws/policies_test.gopkg/aws/sts_test.gopkg/clusterregistryconfig/flags.gopkg/helper/download/download.gopkg/helper/helpers.gopkg/logging/round_tripper.gopkg/output/output.gopkg/test/arg_generator.gopkg/test/arg_verifier.gopkg/test/structure_verifier.gopkg/version/retriever.gopkg/version/retriever_test.gotests/e2e/hcp_tuning_config_test.gotests/utils/exec/rosacli/ocm_resource_service.go
markirish
force-pushed
the
ROSAENG-61040-review-dependencies
branch
from
July 23, 2026 14:08
286b64a to
8ffe71a
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/ordered/ordered_test.go`:
- Around line 126-139: Strengthen the test “unmarshals arrays as []interface{}”
by asserting each decoded array element preserves the expected json.Number
values 1, 2, and 3, in addition to checking the slice type and length. Keep the
existing unmarshalling and iteration setup unchanged.
In `@pkg/helper/download/download.go`:
- Around line 166-171: Update readableBytes to round the scaled val before
evaluating the val < 10 precision branch, so values such as readableBytes(9999)
select the rounded 10 kB output. Preserve the existing suffix selection and
formatting paths for other values.
In `@pkg/helper/helpers.go`:
- Line 269: Add a Go doc comment immediately before the exported ShellQuote
function, beginning with “ShellQuote” and describing its purpose.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 1a6f5025-e2e4-43ae-91e6-c0ebf29d6182
⛔ Files ignored due to path filters (70)
go.sumis excluded by!**/*.sumvendor/github.com/PuerkitoBio/goquery/.gitattributesis excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/.gitignoreis excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/array.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/expand.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/filter.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/iteration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/manipulation.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/property.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/query.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/traversal.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/type.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/PuerkitoBio/goquery/utilities.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/.travis.ymlis excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/parser.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/pseudo_classes.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/selector.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/serialize.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/andybalholm/cascadia/specificity.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dchest/validator/.travis.ymlis excluded by!vendor/**,!**/vendor/**vendor/github.com/dchest/validator/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/dchest/validator/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/dchest/validator/domain.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dchest/validator/email.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/.travis.ymlis excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/README.markdownis excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/big.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/bigbytes.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/bytes.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/comma.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/commaf.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/ftoa.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/humanize.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/number.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/ordinals.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/si.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/dustin/go-humanize/times.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/nathan-fiscaletti/consolesize-go/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/nathan-fiscaletti/consolesize-go/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/nathan-fiscaletti/consolesize-go/consolesize_unix.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/nathan-fiscaletti/consolesize-go/consolesize_windows.gois excluded by!vendor/**,!**/vendor/**vendor/gitlab.com/c0b/go-ordered-json/.gitlab-ci.ymlis excluded by!vendor/**,!**/vendor/**vendor/gitlab.com/c0b/go-ordered-json/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/gitlab.com/c0b/go-ordered-json/README.mdis excluded by!vendor/**,!**/vendor/**vendor/gitlab.com/c0b/go-ordered-json/ordered.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/.travis.ymlis excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/LICENSE.libyamlis excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/NOTICEis excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/README.mdis excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/apic.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/decode.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/emitterc.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/encode.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/parserc.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/readerc.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/resolve.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/scannerc.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/sorter.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/writerc.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/yaml.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/yamlh.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/yaml.v2/yamlprivateh.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (25)
cmd/create/idp/google.gocmd/list/gates/cmd.gocmd/upgrade/machinepool/cmd.gogo.modinternal/ordered/ordered.gointernal/ordered/ordered_test.gopkg/aws/client.gopkg/aws/client_test.gopkg/aws/cloudformation_test.gopkg/aws/idps_test.gopkg/aws/logging.gopkg/aws/policies_test.gopkg/aws/sts_test.gopkg/clusterregistryconfig/flags.gopkg/helper/download/download.gopkg/helper/helpers.gopkg/logging/round_tripper.gopkg/output/output.gopkg/test/arg_generator.gopkg/test/arg_verifier.gopkg/test/structure_verifier.gopkg/version/retriever.gopkg/version/retriever_test.gotests/e2e/hcp_tuning_config_test.gotests/utils/exec/rosacli/ocm_resource_service.go
🚧 Files skipped from review as they are similar to previous changes (21)
- pkg/test/arg_generator.go
- pkg/aws/policies_test.go
- pkg/test/arg_verifier.go
- pkg/aws/sts_test.go
- pkg/aws/cloudformation_test.go
- pkg/aws/idps_test.go
- tests/e2e/hcp_tuning_config_test.go
- pkg/logging/round_tripper.go
- pkg/output/output.go
- pkg/test/structure_verifier.go
- cmd/create/idp/google.go
- pkg/aws/client_test.go
- pkg/aws/logging.go
- internal/ordered/ordered.go
- pkg/version/retriever.go
- tests/utils/exec/rosacli/ocm_resource_service.go
- pkg/clusterregistryconfig/flags.go
- cmd/list/gates/cmd.go
- cmd/upgrade/machinepool/cmd.go
- pkg/aws/client.go
- go.mod
…ncies - dchest/validator: single-call domain validation, replaced with existing k8s.io/apimachinery validator - dustin/go-humanize: byte formatting only, replaced with ~15-line readableBytes helper - nathan-fiscaletti/consolesize-go: terminal size only, replaced with golang.org/x/term.GetSize - alessio/shellescape: shell quoting only, replaced with ~10-line ShellQuote helper - pkg/errors: 3 Wrapf calls, replaced with fmt.Errorf %w wrapping - PuerkitoBio/goquery: HTML parsing only, replaced with golang.org/x/net/html tokenizer - c0b/go-ordered-json: abandoned ordered map lib, replaced with internal/ordered package - go-logr/logr: dead code (CapaLogger never called), removed entirely - gopkg.in/yaml.v2: 5 files using Marshal/Unmarshal only, migrated to yaml.v3 - google/uuid: dead code (IsValidUUID never called), removed entirely
markirish
force-pushed
the
ROSAENG-61040-review-dependencies
branch
from
July 23, 2026 14:37
8ffe71a to
6f65241
Compare
Contributor
Author
|
Closing this PR in favor of individual PRs for each library, which will be easier to review and reason about later |
This was referenced Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
10 third-party dependencies are removed from the code base and replaced with either extended standard library package functionality, well-supported third-party packages already used elsewhere (e.g.
k8s.io/apimachinery/pkg/util/validation), or custom implementation.Detailed Description of the Issue
Our ROSA CLI project currently imports several third-party libraries that are only utilized in a single file (e.g., exclusively within a test file or for a single validation function). Relying on entire external dependencies for isolated use cases unnecessarily increases our security attack surface, complicates dependency management, and bloats the project.
This PR audits our current dependencies and eliminate those that are underutilized. If a library is only used for a simple utility—like a validation function—it was extracted or rewritten directly in our codebase to remove the external dependency entirely.
Dependencies removed are:
dchest/validator: single-call domain validation, replaced with existing k8s.io/apimachinery validatordustin/go-humanize: byte formatting only, replaced with ~15-line readableBytes helpernathan-fiscaletti/consolesize-go: terminal size only, replaced with golang.org/x/term.GetSizealessio/shellescape: shell quoting only, replaced with ~10-line ShellQuote helperpkg/errors: 3 Wrapf calls, replaced with fmt.Errorf %w wrappingPuerkitoBio/goquery: HTML parsing only, replaced with golang.org/x/net/html tokenizerc0b/go-ordered-json: abandoned ordered map lib, replaced with internal/ordered packagego-logr/logr: dead code (CapaLogger never called), removed entirelygopkg.in/yaml.v2: 5 files using Marshal/Unmarshal only, migrated to yaml.v3google/uuid: dead code (IsValidUUID never called), removed entirely"Related Issues and PRs
Type of Change
Previous Behavior
Default CLI behavior
Behavior After This Change
Default CLI behavior, slightly stricter domain check
How to Test (Step-by-Step)
Preconditions
Test Steps
make testExpected Results
all tests should pass
Proof of the Fix
All tests pass
Breaking Changes
Developer Verification Checklist
[JIRA-TICKET] | [TYPE]: <MESSAGE>.make install-hookshas been run in this clone.make testpasses.make lintpasses.make rosapasses.Summary by CodeRabbit
Bug Fixes
New Features
Refactor / Tests