feat: automated go fix PR on Go version bump

[Copilot]

Tracking Jira: ARO-25807

Adds a workflow to automatically open a PR running go fix on both Go modules (github.com/Azure/ARO-RP and github.com/Azure/ARO-RP/pkg/api) whenever the Go version directive in go.mod is bumped on master.

Changes

• Makefile — go-fix target: Runs go fix ./... on both modules, consistent with the existing fmt and lint-go-fix targets:

  .PHONY: go-fix
  go-fix: ## Run go fix on both Go modules
      go fix ./...
      cd pkg/api/ && go fix ./...

• .github/workflows/go-fix.yml:

  • Triggers on push to master with paths: ['go.mod'], plus workflow_dispatch for manual runs
  • Guards execution: compares the go directive between HEAD and HEAD~1 to skip unrelated go.mod changes
  • Runs make go-fix, then opens a PR using the GitHub CLI (gh pr create) on branch automated/go-fix-<version> — no third-party actions required
  • Uses --force-with-lease on push and skips PR creation gracefully if go fix produces no changes
  • Requires contents: write + pull-requests: write permissions

• test/e2e/{aks,aro,e2e_test}.go: Applied go fix to the current codebase — removes the redundant pre-Go 1.17 // +build constraint lines (superseded by //go:build).

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[openshift-ci]

Hi @copilot. Thanks for your PR.

I'm waiting for a Azure member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tuxerrante]

https://go.dev/blog/gofix

[tuxerrante]

Code review

Found 1 issue:

1. The workflow only monitors the root go.mod for Go version changes, but the project has two independent Go modules with separate go.mod files (CLAUDE.md marks "Two Go Modules" as critical). If pkg/api/go.mod is bumped independently -- which is a real scenario since the two modules currently have different Go versions (root: 1.25.3, pkg/api: 1.24.0) -- the workflow will not trigger. Both the paths filter and the version detection logic need to account for pkg/api/go.mod.

ARO-RP/.github/workflows/go-fix.yml

Lines 5 to 12 in ebdf630

	branches:
	- master
	paths:
	- 'go.mod'
	workflow_dispatch:
	permissions:
	contents: write

[Copilot]

Pull request overview

Adds automation to run go fix after Go version directive bumps and open a follow-up PR, while also applying the current go fix-driven build tag cleanup in existing e2e files.

Changes:

• Adds a make go-fix target to run go fix ./... in both the root module and pkg/api.
• Introduces a GitHub Actions workflow to detect go directive changes in go.mod / pkg/api/go.mod, run make go-fix, and open a PR with the results.
• Applies go fix output to e2e tests by removing legacy // +build constraints (keeping //go:build).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
Makefile	Adds go-fix target to run go fix across both Go modules.
.github/workflows/go-fix.yml	New workflow to detect Go version bumps and automatically open a PR with go fix results.
test/e2e/e2e_test.go	Removes redundant legacy build tag line per go fix.
test/e2e/aro.go	Removes redundant legacy build tag line per go fix.
test/e2e/aks.go	Removes redundant legacy build tag line per go fix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tuxerrante]

Fixes applied

Addressed 5 of the 6 review comments from Copilot:

1. Concurrency group — Added concurrency: group: go-fix to prevent parallel workflow runs from conflicting on the same branch/PR.

2. setup-go version — Changed from go-version-file: go.mod (always root) to go-version: <highest>, computed via sort -V across both modules. This ensures go fix runs with the correct Go version regardless of which module was bumped.

3. Branch naming — Changed from automated/go-fix-<root-version> to automated/go-fix-root-<root>-api-<api> to avoid collisions when only one module is bumped.

4. --force-with-lease → --force — The remote branch is never fetched (fetch-depth: 2 only fetches the main branch), so --force-with-lease provided no safety and could fail unexpectedly.

5. Idempotent PR creation — Added a check for an existing PR on the head branch before calling gh pr create, so reruns don't fail.

Not fixed (false positive): git show HEAD~1:pkg/api/go.mod failure — both go.mod files have existed since 2023, and the workflow only triggers when these files are modified (meaning they already exist in HEAD).

[tuxerrante]

@mociarain do we have the rights for these permissions?

[mociarain]

They look correct to me but I'm sure what you are asking. Do you mean:

• Are these the correct permissions for the workflow?
• Do we have the rights to grant these permissions?

[tuxerrante]

The second one, I know these could be an issue:

  contents: write
  pull-requests: write

[tuxerrante]

with the idempotent PR check we added, you could argue the workflow should just skip entirely if the branch already exists. We could replace the force push with a check-and-skip:

  if git ls-remote --exit-code origin "refs/heads/$BRANCH" >/dev/null 2>&1; then
    echo "Branch $BRANCH already exists, skipping."
    exit 0
  fi
  git push origin "$BRANCH"

[tuxerrante]

This workflow can't be tested via normal CI because:

• It triggers on pushes to master that modify go.mod
• workflow_dispatch only works if the workflow file already exists on the default branch

To actually test this, you'd need to either:

• Fork the repo and merge the workflow into the fork's default branch, then trigger workflow_dispatch
• Create a test workflow on a branch that uses on: push to that branch instead of master (temporary, just for validation)
• Merge to master and test live (risky for a first run)

[mociarain]

Could we do a PR off this one that bumps something in each of the go.mods to prove it works? Or does it have to be merged first?

[tuxerrante]

Could we do a PR off this one that bumps something in each of the go.mods to prove it works? Or does it have to be merged first?

@mociarain I can try if it would start also when pushing onto another branch which is not master

#4678 (comment)

[tuxerrante]

Pre-merge workflow validation update (second pass):

1. Obsolete action/runtime warning

• Updated .github/workflows/go-fix.yml from step-security/harden-runner@v2.15.0 to v2.16.1 (fe104658747b27e96e4f7e80cd0a94068e53901d).
• Merged via chore: bump harden-runner action to v2.16.1 #4746
• In subsequent runs, no Node.js 20 actions are deprecated annotation was observed.

2. Non-empty go-fix path validation for Go 1.26

• Temporarily enabled PR-branch trigger (merged): test: temporarily enable PR-branch go-fix trigger for go1.26 validation #4747
• Temporarily bumped both modules to Go 1.26.1 (merged): test: trigger go-fix non-empty path with temporary Go 1.26.1 bump #4748
• Triggered run: https://github.com/Azure/ARO-RP/actions/runs/23940156665
• Evidence from run logs:
  • go fix produced non-empty output: 410 files changed, 3303 insertions(+), 3485 deletions(-)
  • branch push succeeded: automated/go-fix-root-1.26.1-api-1.26.1
  • PR creation failed with permission error:
    GraphQL: GitHub Actions is not permitted to create or approve pull requests (createPullRequest)

Conclusion: PR creation was NOT skipped for empty output in the Go 1.26 scenario; it failed due GitHub Actions permissions.

3. Cleanup/restoration after test

• Reverted temporary Go 1.26.1 bumps (merged): test: revert temporary Go 1.26.1 module bumps #4749
• Removed temporary PR-branch trigger (merged): test: remove temporary PR-branch trigger after Go1.26 validation #4750
• Follow-up run after revert succeeded: https://github.com/Azure/ARO-RP/actions/runs/23940315685

Current branch state (copilot/automate-go-fix-commands):

• go.mod: go 1.25.3
• pkg/api/go.mod: go 1.24.0
• go-fix trigger scope: master only
• harden-runner pin: v2.16.1

Note: remote branch automated/go-fix-root-1.26.1-api-1.26.1 exists from the failed create-PR step, but no PR was created for it.