Skip to content

Extract go tool dependencies in seperate module#328

Merged
nickytd merged 6 commits intomainfrom
chore/tools-module
Mar 9, 2026
Merged

Extract go tool dependencies in seperate module#328
nickytd merged 6 commits intomainfrom
chore/tools-module

Conversation

@nickytd
Copy link
Collaborator

@nickytd nickytd commented Mar 9, 2026 •
edited by hyperspace-insights bot
Loading

How to categorize this PR?
/kind cleanup
/area oidc-apps

What this PR does / why we need it:
This PR extracts Go tool dependencies (golangci-lint, gci, gosec, govulncheck, gotestsum, mockgen, setup-envtest, addlicense) into a dedicated separate Go module located at tools/go.mod, decoupling them from the root go.mod. This eliminates the tool block and all tool-only indirect dependencies from the root module, significantly reducing its dependency footprint. The Makefile is updated to define a GO_TOOL variable using go tool -modfile=$(TOOLS_MOD) so all tool invocations reference the separate tools module, and tidy now runs go mod tidy for both modules. The hack/add-license-header.sh, hack/sast.sh, and pkg/certificates/doc.go scripts are updated accordingly to pass the -modfile flag pointing to tools/go.mod.

Code changes:

  • Added tools/go.mod (and corresponding tools/go.sum) as a new separate Go module containing the tool block and all tool-related dependencies.
  • Removed the tool block and ~100+ tool-only indirect dependencies from the root go.mod/go.sum.
  • Introduced TOOLS_MOD and GO_TOOL variables in the Makefile; replaced all go tool <cmd> invocations with $(GO_TOOL) <cmd>; added cd $(TOOLS_DIR) && go mod tidy to the tidy target.
  • Updated .gitignore to track tools/k8s/ (previously ignored all of tools/).
  • Updated hack/add-license-header.sh and hack/sast.sh to use -modfile=${root_dir}/tools/go.mod.
  • Updated pkg/certificates/doc.go go:generate directive to use -modfile=../../tools/go.mod.

Additional context:
Separating tool dependencies into their own module is a best practice that prevents tool-only transitive dependencies from polluting the main module's dependency graph, speeds up go mod tidy for the main module, and avoids unintended version conflicts between application and tooling dependencies.

Which issue(s) this PR fixes:
N/A

Special notes for your reviewer:

Release note:

Tool dependencies (golangci-lint, gosec, govulncheck, gotestsum, gci, mockgen, setup-envtest, addlicense) have been extracted into a dedicated `tools/go.mod` module, removing them from the root `go.mod` to reduce dependency noise.
  • 🔄 Regenerate and Update Summary

📬 Subscribe to the Hyperspace PR Bot DL to get the latest announcements and pilot features!

PR Bot Information

Version: 1.17.97 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

  • Event Trigger: issue_comment.edited
  • Correlation ID: a05ee980-1b7e-11f1-8011-dd61de74cfec

nickytd added 3 commits March 9, 2026 07:07
@nickytd
Add separate Go module for tool dependencies
7a0943e 
Create tools/go.mod to isolate tool dependencies (golangci-lint, gci,
gosec, govulncheck, gotestsum, setup-envtest, addlicense, mockgen)
from the main module. This prevents tool-only indirect dependencies
from polluting the project's go.mod and go.sum.
@nickytd
Remove tool block and tool-only indirects from root go.mod
239947d 
With tools now managed in tools/go.mod, remove the tool directive and
run go mod tidy to drop ~220 indirect dependencies that were only
needed by tools. This reduces go.mod from 317 to 97 lines.
@nickytd
Update Makefile and scripts to use tools module via -modfile
877d102 
Introduce GO_TOOL variable that wraps 'go tool -modfile=tools/go.mod'
and update all tool invocations in the Makefile. Also update hack/sast.sh,
hack/add-license-header.sh, and the go:generate directive in
pkg/certificates/doc.go. The tidy target now tidies both modules.
Update .gitignore to track tools/ but ignore tools/k8s/ (envtest binaries).
@gardener-prow gardener-prow bot added do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Mar 9, 2026
@gardener-prow
Copy link

gardener-prow bot commented Mar 9, 2026

@hyperspace-insights[bot]: The label(s) area/oidc-apps cannot be applied, because the repository doesn't have them.

Details

In response to this:

Summary

The following content is AI-generated and provides a summary of the pull request:

How to categorize this PR?
/kind cleanup
/area oidc-apps

What this PR does / why we need it:
This PR extracts Go tool dependencies (golangci-lint, gci, gosec, govulncheck, gotestsum, mockgen, setup-envtest, addlicense) into a dedicated separate Go module located at tools/go.mod, decoupling them from the root go.mod. This eliminates the tool block and all tool-only indirect dependencies from the root module, significantly reducing its dependency footprint. The Makefile is updated to define a GO_TOOL variable using go tool -modfile=$(TOOLS_MOD) so all tool invocations reference the separate tools module, and tidy now runs go mod tidy for both modules. The hack/add-license-header.sh, hack/sast.sh, and pkg/certificates/doc.go scripts are updated accordingly to pass the -modfile flag pointing to tools/go.mod.

Code changes:

  • Added tools/go.mod (and corresponding tools/go.sum) as a new separate Go module containing the tool block and all tool-related dependencies.
  • Removed the tool block and ~100+ tool-only indirect dependencies from the root go.mod/go.sum.
  • Introduced TOOLS_MOD and GO_TOOL variables in the Makefile; replaced all go tool <cmd> invocations with $(GO_TOOL) <cmd>; added cd $(TOOLS_DIR) && go mod tidy to the tidy target.
  • Updated .gitignore to track tools/k8s/ (previously ignored all of tools/).
  • Updated hack/add-license-header.sh and hack/sast.sh to use -modfile=${root_dir}/tools/go.mod.
  • Updated pkg/certificates/doc.go go:generate directive to use -modfile=../../tools/go.mod.

Additional context:
Separating tool dependencies into their own module is a best practice that prevents tool-only transitive dependencies from polluting the main module's dependency graph, speeds up go mod tidy for the main module, and avoids unintended version conflicts between application and tooling dependencies.

Which issue(s) this PR fixes:
N/A

Special notes for your reviewer:

Release note:

Tool dependencies (golangci-lint, gosec, govulncheck, gotestsum, gci, mockgen, setup-envtest, addlicense) have been extracted into a dedicated `tools/go.mod` module, removing them from the root `go.mod` to reduce dependency noise.
  • 🔄 Regenerate and Update Summary
  • ✏️ Insert as PR Description (deletes this comment)
  • 🗑️ Delete comment
PR Bot Information

Version: 1.17.97 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

  • Output Template: PR Template File
  • Summary Prompt: PR Prompt File
  • Correlation ID: 7b806f80-1b7e-11f1-9550-dd81f64b6313
  • Event Trigger: pull_request.opened
  • LLM: anthropic--claude-4.6-sonnet

💌 Have ideas or want to contribute? Create an issue and share your thoughts with us!
📑 Check out the documentation for more information.
📬 Subscribe to the Hyperspace PR Bot DL to get the latest announcements and pilot features!

Made with ❤️ by Hyperspace.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@gardener-prow gardener-prow bot added kind/cleanup Something that is not needed anymore and can be cleaned up cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. and removed do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Mar 9, 2026
nickytd added 3 commits March 9, 2026 07:12
@nickytd
chore(deps): update tool dependencies
1ff6d04 
Update all tool dependencies to their latest compatible versions.
Pin github.com/denis-tingaikin/go-header to v0.5.0 as v1.0.0 has
breaking API changes incompatible with golangci-lint v2.11.2.
@nickytd
chore(deps): update indirect dependecies
64a2c73
@nickytd
Fix Docker build for separate tools module
1a96c8c 
Add tools/go.mod and tools/go.sum to the .dockerignore allowlist so
they are included in the Docker build context. Download both root and
tools module dependencies in the Dockerfile.
@nickytd
Copy link
Collaborator Author

nickytd commented Mar 9, 2026

/approve

@gardener-prow
Copy link

gardener-prow bot commented Mar 9, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nickytd

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@gardener-prow gardener-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 9, 2026
@nickytd nickytd merged commit 07cd5ba into main Mar 9, 2026
29 of 30 checks passed
@nickytd nickytd deleted the chore/tools-module branch March 9, 2026 06:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. kind/cleanup Something that is not needed anymore and can be cleaned up size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nickytd