NO-ISSUE: Stop tracking go.work.sum to fix recurring merge conflicts

[eliorerz]

Why

Almost every recent PR touching Go code has been hitting a merge conflict on go.work.sum, blocking otherwise-unrelated merges. Root cause: go.work.sum is not a real dependency lock file the way go.sum is -- it's a derived, workspace-level checksum cache that go build/go test/go mod download silently regenerates and grows whenever anyone builds from the repo root. Different contributors build different subsets of the workspace, in different orders, at different times, so their local go.work.sum diverges non-deterministically. Any two PRs open at the same time end up touching overlapping lines of the same growing file in incompatible ways -- conflicts that have nothing to do with either PR's actual change.

Solution

Stop tracking go.work.sum and add it to .gitignore. go.work itself stays committed -- it's a plain, repo-relative module list (use ./fulfillment-service ./osac-operator ...), not personal/absolute paths, so there's nothing machine-specific about it. Only the derived checksum cache is being untracked.

This matches GitHub's own default Go .gitignore template, which excludes go.work/go.work.sum by default for this reason. Note the upstream discussion in golang/go#53502 is specifically about whether to commit go.work -- it isn't a settled, universal verdict on go.work.sum on its own, and I'm not claiming every module's go.sum is a strict superset of what go.work.sum records (workspace-mode dependency resolution can in principle select versions that don't appear in any single module's own go.sum). What actually makes untracking safe here is the Containerfile fix below, not a general dependency-lock equivalence argument.

Real bug caught in an earlier version of this PR, now fixed: 4 of 5 component Containerfiles (fulfillment-service, osac-operator, bare-metal-fulfillment-operator, osac-csi-driver) explicitly did COPY go.work go.work.sum ./. On a fresh checkout go.work.sum no longer exists, so that COPY fails outright -- breaking every one of those image builds, not just producing a warning. Fixed by dropping go.work.sum from the COPY line; each Containerfile already runs a go mod download step immediately after (needed regardless, to fetch the module's actual dependencies), which regenerates go.work.sum inside the build using the go.sum files already copied in per module.

Verified, not just reasoned about:

• No workflow, script, or Makefile in this repo references go.work.sum by name or content.
• No workflow sets -mod=readonly/GOFLAGS that would prevent Go from silently regenerating it.
• Built osac-csi-driver's image for real with podman build, from a clean git archive checkout (so go.work.sum was genuinely absent, matching what CI sees) -- succeeded end-to-end, confirming go mod download correctly regenerates it inside the build.

What changed

• .gitignore: added /go.work.sum with an explanatory comment.
• Removed go.work.sum from version control (git rm --cached).
• fulfillment-service/Containerfile, osac-operator/Containerfile, bare-metal-fulfillment-operator/Containerfile, osac-csi-driver/Containerfile: dropped go.work.sum from the COPY go.work go.work.sum ./ line (kept go.work), each with a comment explaining why.
• osac-metering/metering-service/Containerfile needed no change -- it doesn't reference go.work/go.work.sum at all (standalone module, not part of the shared workspace build).

Summary by CodeRabbit

• Chores
  • Updated project exclusions to omit generated workspace checksum files from version control.
  • Simplified container builds to copy only the workspace configuration; required checksum data is regenerated automatically during dependency setup.
  • Added documentation clarifying the generated nature of workspace checksum files and their build-time regeneration.

[openshift-ci-robot]

@eliorerz: This pull request explicitly references no jira issue.

Details

In response to this:

Why

Almost every recent PR touching Go code has been hitting a merge conflict on go.work.sum, blocking otherwise-unrelated merges. Root cause: go.work.sum is not a real dependency lock file the way go.sum is -- it's a derived, workspace-level checksum cache that go build/go test silently regenerates and grows whenever anyone builds from the repo root. Different contributors build different subsets of the workspace, in different orders, at different times, so their local go.work.sum diverges non-deterministically. Any two PRs open at the same time end up touching overlapping lines of the same growing file in incompatible ways -- conflicts that have nothing to do with either PR's actual change.

Each individual module (fulfillment-service, osac-operator, osac-operator/api, bare-metal-fulfillment-operator, osac-csi-driver, osac-metering/metering-service) already has its own committed go.sum, which is the real, reproducible dependency lock for that module. go.work.sum is redundant on top of that -- it exists purely to speed up local/CI builds run from the workspace root, not to guarantee reproducibility.

Solution

Stop tracking go.work.sum and add it to .gitignore. go.work itself stays committed -- it's a plain, repo-relative module list (use ./fulfillment-service ./osac-operator ...), not personal/absolute paths, so there's nothing machine-specific about it. Only the derived checksum cache is being untracked.

This matches GitHub's own default Go .gitignore template, which excludes go.work/go.work.sum by default for exactly this reason, and the broader Go community consensus discussed in golang/go#53502.

Verified this doesn't affect build reproducibility or break CI before opening this PR:

• No workflow, script, or Makefile in this repo references go.work.sum by name or content.
• No workflow sets -mod=readonly/GOFLAGS that would prevent Go from silently regenerating it (Go's default behavior auto-writes/updates it as needed, same as it does for a per-module go.sum during a normal build).
• The only place go build runs directly against the workspace (codeql.yml's Go analysis step) builds per-module (cd fulfillment-service && go build ./..., etc.), using each module's own already-correct, already-committed go.sum -- unaffected by this change.

What changed

• .gitignore: added /go.work.sum with an explanatory comment.
• Removed go.work.sum from version control (git rm --cached). It'll keep working locally and in CI exactly as before, just regenerated transparently instead of tracked.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The repository ignores the generated /go.work.sum file. Four Containerfiles copy only go.work and regenerate go.work.sum during dependency download.

Changes

Workspace checksum handling

Layer / File(s)	Summary
Handle generated workspace checksum .gitignore, */Containerfile	Documents and ignores /go.work.sum. Containerfiles copy only go.work and regenerate the workspace checksum during dependency download.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: ygalblum, rgolangh

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Ai-Attribution	⚠️ Warning	The PR metadata mentions CodeRabbit, but both PR commits lack an Assisted-by or Generated-by trailer; no AI Co-Authored-By trailer is present.	Add an Assisted-by or Generated-by trailer naming the AI tool to each AI-assisted PR commit, and do not use Co-Authored-By for the tool.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes removing go.work.sum tracking to prevent recurring merge conflicts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The PR adds only .gitignore comments and COPY directives; scans found no API keys, tokens, passwords, private-key material, credential URLs, or long encoded literals.
No-Weak-Crypto	✅ Passed	The PR changes only .gitignore and four Containerfiles; added lines contain no flagged weak algorithms, crypto implementation, or secret-comparison logic.
No-Injection-Vectors	✅ Passed	The cumulative diff only updates ignore/comments, deletes go.work.sum, and removes it from COPY lines; no SQL, eval/exec, unsafe YAML/pickle, os.system, shell=True, or DOM injection appears.
Container-Privileges	✅ Passed	The diff adds no privileged, host namespace, SYS_ADMIN, or allowPrivilegeEscalation settings; changed runtime Containerfiles use USER 1001. Existing CSI privilege settings are outside the diff.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only .gitignore and Containerfiles; review of all PR additions found no logging statements or sensitive values, and go.work.sum is dependency metadata, not log output.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.gitignore:
- Around line 28-37: Update the repository’s container build flow alongside the
.gitignore change: ensure each relevant Containerfile generates go.work.sum
before its COPY step or otherwise includes the required file so clean builds
succeed. Keep go.work.sum tracked or generated consistently, and revise the
adjacent .gitignore rationale to remove the claim that module go.sum files fully
replace it and accurately qualify golang/go#53502 as guidance about committing
go.work.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3c376aed-6c50-42f8-bfb4-c6869506ab94

📥 Commits

Reviewing files that changed from the base of the PR and between 7f331a0 and 4435584.

⛔ Files ignored due to path filters (1)

• go.work.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• .gitignore

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eliorerz, omer-vishlitzky

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [eliorerz,omer-vishlitzky]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment