HYPERFLEET-1651 - ci: prefetch tools module for Hermeto

[ciaranRoche]

Summary

Prefetches the tools Go module alongside the root module in the push and tag pipelines.

make build runs the code generator through go tool -modfile=tools/go.mod. The Hermeto prefetch added on 2026-09-04 covers only the root module, and Hermeto points GOPROXY at its prefetch output, so the build fails with oapi-codegen/v2@v2.7.2: ... no such file or directory. No on-push image has been produced since that change.

The build stays non-hermetic. Prefetching tools also gives its packages the Hermeto attribution the Conforma SBOM rule requires from 2026-10-01.

Validation

• go mod download all inside tools/ resolves every module with no errors, which is the resolution Hermeto performs
• Both changed YAML files parse; git diff --check clean
• Only the push pipeline exercises the prefetch, so the first on-push build after merge is the real test

Refs HYPERFLEET-1651

🤖 Generated with Claude Code

https://claude.ai/code/session_018EkLeTwdmrofNMwKRpDCWG

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a3ee77ff-10c8-4897-83e6-b7b41565e5ab

📥 Commits

Reviewing files that changed from the base of the PR and between 0ff88ae and 6f500a1.

📒 Files selected for processing (2)

• .tekton/hyperfleet-sentinel-push.yaml
• .tekton/hyperfleet-sentinel-tag.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)

Included review availability: Your plan provides up to 12 included reviews per hour; 7 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated automated build and tagging workflows to prefetch Go modules from both the repository root and tools directory.
  • Improved consistency of dependency setup across push and tag pipeline runs.

Walkthrough

The push and tag Tekton pipeline configurations now prefetch Go modules from . and tools. This replaces the previous generic Go module configuration.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 6f500

The push and tag builds prefetch both Go modules before building, with no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI change: prefetching the tools Go module for Hermeto. It matches the changeset and includes the relevant issue reference.
Description check	✅ Passed	The description directly explains the Hermeto prefetch change, the build failure it fixes, the SBOM attribution requirement, and the validation performed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	PASS: The pull request changes only the prefetch-input values in .tekton/hyperfleet-sentinel-push.yaml and .tekton/hyperfleet-sentinel-tag.yaml. The added values contain module paths only. The d…
No Hardcoded Secrets	✅ Passed	PASS. The pull request changes only two Tekton prefetch-input values. The added JSON contains module types and paths only. It contains no API key, token, password, private key, credential URL, or ba…
No Weak Cryptography	✅ Passed	PASS. The authoritative diff changes only two Tekton prefetch-input values from one Go module descriptor to two path-specific descriptors. The patch and changed YAML files contain no banned cryptogr…
No Injection Vectors	✅ Passed	PASS. The pull request changes only two Tekton YAML parameters. Each new value is static JSON containing the trusted paths . and tools, and both values parse successfully. The downstream wiring pa…
No Privileged Containers	✅ Passed	PASS. The pull request changes only prefetch-input values in two Tekton PipelineRun CI manifests. The changed lines add Go module paths and do not add privileged: true, host namespace settings, …
No Pii Or Sensitive Data In Logs	✅ Passed	PASS: The PR changes only the prefetch-input values in two Tekton YAML files. The new values contain module types and paths (. and tools) and introduce no slog, logr, zap, log, or `fmt.P…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign crizzo71 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hyperfleet-ci-bot]

Risk Score: 0 — risk/low

Signal	Detail	Points
PR size	4 lines	+0
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}