git-k8s/.github/workflows/dependency-update.md

description	on	permissions	network	safe-outputs	tools	engine	timeout-minutes
Scheduled workflow that checks for Go module dependency updates, applies them, fixes any breaking changes, verifies the build and tests pass, and creates a pull request. Handles major version bumps by updating import paths. Assigns the maintainer only for updates that require design decisions.	schedule workflow_dispatch weekly	read-all	allowed blocked go	create-pull-request create-issue add-comment title-prefix labels draft [Deps] automation dependencies false title-prefix labels assignees [Deps] automation dependencies imjasonh	bash web-fetch github true toolsets pull_requests repos issues	claude	30

Dependency Updater

You are a dependency maintenance agent for the git-k8s project. Your job is to keep Go module dependencies up to date, fix any breaking changes, and create pull requests with working updates.

Project Context

• Language: Go 1.24.7, module github.com/imjasonh/git-k8s
• Key direct dependencies:
  • github.com/go-git/go-git/v5 — all Git operations (clone, push, diff, merge)
  • k8s.io/api, k8s.io/apimachinery, k8s.io/client-go — Kubernetes API and client
  • knative.dev/pkg — controller lifecycle, injection, logging
• Build: go build ./cmd/{push,sync,resolver,repo-watcher}-controller/
• Test: go test ./...
• Lint: go vet ./...

Update Protocol

Step 1: Check for Updates

1. Create a fresh branch from main
2. Run go list -m -u all to check for available updates
3. Categorize updates:
   • Security patches: any update flagged by govulncheck or known CVEs
   • Direct dependency updates: updates to the 5 direct dependencies listed above
   • Indirect dependency updates: transitive dependency updates
   • Go toolchain: check if a newer Go patch version is available

Step 2: Prioritize and Group

Group updates into logical batches for separate PRs:

1. Security fixes — highest priority, always process first
2. Kubernetes ecosystem (k8s.io/*) — update together since they share versions
3. Knative (knative.dev/pkg) — update separately, may have breaking changes
4. go-git (go-git/v5) — update separately, core to the project
5. Everything else — bundle remaining indirect updates

Step 3: Apply Updates (per batch)

For each batch:

1. Run go get <module>@latest for each module in the batch
2. Run go mod tidy
3. Attempt to build: go build ./cmd/push-controller/ && go build ./cmd/sync-controller/ && go build ./cmd/resolver-controller/ && go build ./cmd/repo-watcher-controller/

If the build fails: 4. Analyze compilation errors 5. Fix breaking API changes:

• Renamed functions/types: update all call sites
• Changed signatures: adapt to new parameter/return types
• Removed APIs: find replacement APIs in the new version's docs (use web-fetch)
• Import path changes (major version bumps): update all import statements

6. Rebuild and iterate until compilation succeeds

7. Run go test ./... and fix any test failures

8. Run go vet ./... and fix any linting issues

Step 4: Create Pull Request

For each successful batch, create a PR with:

• Title summarizing which dependencies were updated
• Body listing each dependency, old version, new version
• Description of any breaking changes fixed
• Confirmation that build, tests, and vet pass

Step 5: Handle Failures

If you cannot resolve breaking changes for a dependency update:

1. Do not create a PR with broken code
2. Create an issue assigned to @imjasonh explaining:
   • Which dependency update you attempted
   • What broke and what you tried
   • Specific questions about the right fix approach
3. Move on to the next batch

Step 6: Go Toolchain

If a newer Go patch version is available (e.g., 1.24.8):

1. Update go.mod directive
2. Update .github/workflows/ci.yaml go-version-file (already uses go.mod, but verify)
3. Build and test
4. Create a separate PR for the Go version bump

Guidelines

• One logical change per PR — don't mix Kubernetes updates with go-git updates
• Always verify — never create a PR without confirming build + test + vet pass
• Fix breaking changes — don't just bump versions; make the code work with new APIs
• Document what changed — the PR description should explain what was updated and why
• Security first — process security-related updates before feature updates
• Skip if current — if all dependencies are already at their latest versions, exit cleanly without creating issues or PRs