@@ -2,7 +2,7 @@
 # (GitHub releases), so both gate on exactly the same checks.
 # The calling job must check out the repository first.
 name: go-checks
-description: Gofmt/license checks, go vet, generated-code drift check and unit tests with coverage.
+description: Gofmt/license checks, go vet, generated-code drift check, build-tool regression tests and unit tests with coverage.
 
 runs:
   using: composite
@@ -13,6 +13,9 @@ runs:
     - name: Gofmt and license checks
       shell: bash
       run: make check
+    - name: Build-tool regression tests
+      shell: bash
+      run: python3 -B -m unittest discover -s scripts -p 'test_*.py'
     - name: go vet
       shell: bash
       run: go vet ./...
 
@@ -39,7 +39,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.13.2
+          version: v2.15.0
           # The existing code base still carries legacy findings; only report
           # issues introduced by the change under review.
           only-new-issues: true
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
       - uses: azure/setup-helm@v5
         with:
-          version: v3.22.0
+          version: v4.3.1
       - name: Check values schema json
         uses: losisin/helm-values-schema-json-action@v3
         with:
 
@@ -40,10 +40,11 @@ jobs:
           registry: true
       # Pre-install kustomize into ./bin with the Makefile's version instead of
       # the install script, which trips GitHub's unauthenticated API rate limit.
+      # Its compiler requirement can be newer than the operator's Go version.
       - name: Install kustomize
         run: |
           version="$(sed -n 's/^KUSTOMIZE_VERSION ?= //p' Makefile)"
-          GOBIN="${PWD}/bin" go install "sigs.k8s.io/kustomize/kustomize/v5@${version}"
+          GOTOOLCHAIN=auto GOBIN="${PWD}/bin" go install "sigs.k8s.io/kustomize/kustomize/v5@${version}"
       - name: Build and push operator image
         env:
           IMAGE: ${{ steps.kind.outputs.LOCAL_REGISTRY }}/zookeeper-operator:e2e
 
@@ -266,7 +266,7 @@ jobs:
           persist-credentials: false
       - uses: azure/setup-helm@v5
         with:
-          version: v3.22.0
+          version: v4.3.1
       - uses: sigstore/cosign-installer@v4.1.2
       - name: Log into GitHub Container Registry ${{ env.GHCR_REGISTRY }}
         uses: docker/login-action@v4
 
@@ -0,0 +1,96 @@
+name: update-dependencies
+
+on:
+  schedule:
+    - cron: '17 8 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: update-dependencies
+  cancel-in-progress: false
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Check publishing credential
+        env:
+          UPDATE_TOKEN: ${{ secrets.PAT }}
+        run: |
+          if [ -z "$UPDATE_TOKEN" ]; then
+            echo "::error::Configure the PAT secret with Contents, Pull requests, and Workflows read/write permissions."
+            exit 1
+          fi
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+      - uses: docker/setup-buildx-action@v4
+      - name: Update Go and dependencies
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: ./update-go-deps.sh
+      - name: Validate updates
+        env:
+          GOTOOLCHAIN: auto
+        run: |
+          python3 -B -m unittest discover -s scripts -p 'test_*.py'
+          make check
+          go vet ./...
+          make test
+      - name: Create or update dependency PR
+        uses: peter-evans/create-pull-request@v8.1.1
+        with:
+          token: ${{ secrets.PAT }}
+          base: ${{ github.event.repository.default_branch }}
+          branch: automation/update-dependencies
+          title: 'chore(deps): refresh Go and dependencies'
+          commit-message: |
+            chore(deps): refresh Go and dependencies
+
+            Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
+          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+          add-paths: |
+            go.mod
+            go.sum
+            Dockerfile
+            Makefile
+            .github/workflows
+            api
+            config
+            charts
+          body: |
+            ### Change log description
+
+            - Update Go and synchronize the Dockerfile fallback.
+            - Refresh Go modules, build-tool pins, and CI image tags/digests.
+            - Regenerate code, manifests, and the Helm chart CRD.
+
+            ### Purpose of the change
+
+            Keep dependencies current through the weekly dependency updater.
+
+            ### What the code does
+
+            Runs `./update-go-deps.sh` against the default branch. Review the
+            generated diff for the exact version changes before merging.
+
+            ### How to verify it
+
+            The following commands passed in this workflow run:
+
+            - `./update-go-deps.sh` (includes `go build ./...` and `make manifests generate`).
+            - `python3 -B -m unittest discover -s scripts -p 'test_*.py'`.
+            - `make check`.
+            - `go vet ./...`.
+            - `make test`.
+
+            Validation uses `GOTOOLCHAIN=auto` for the updated Go version.
+            Review the PR's remaining CI checks, including image builds and chart validation.
@@ -46,7 +46,6 @@ jobs:
       - name: zizmor
         uses: zizmorcore/zizmor-action@v0.6.4
         with:
-          version: v1.30.1
           # Fail the job and annotate the PR instead of uploading SARIF, which
           # also works for pull requests from forks (read-only token).
           advanced-security: false
 
@@ -2,7 +2,7 @@
 # from the `go` directive in go.mod) so the builder image always matches the
 # toolchain version the module actually requires. The default below is only a
 # fallback for ad-hoc `docker build .` invocations without --build-arg.
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27
 FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:${GO_VERSION}-alpine3.24 AS go-builder
 
 # Populated automatically by BuildKit with the target platform of each build.
 
@@ -93,21 +93,22 @@ KUSTOMIZE ?= $(LOCALBIN)/kustomize
 CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
 ## Tool Versions
 # Upgraded to modern stable versions
-KUSTOMIZE_VERSION ?= v5.7.1
-CONTROLLER_TOOLS_VERSION ?= v0.19.0
+KUSTOMIZE_VERSION ?= v5.8.3
+CONTROLLER_TOOLS_VERSION ?= v0.23.0
 KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
 .PHONY: kustomize
 kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
 $(KUSTOMIZE): $(LOCALBIN)
 	test -s $(LOCALBIN)/kustomize || { curl -s $(KUSTOMIZE_INSTALL_SCRIPT) | bash -s -- $(subst v,,$(KUSTOMIZE_VERSION)) $(LOCALBIN); }
 .PHONY: controller-gen
-controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
-$(CONTROLLER_GEN): $(LOCALBIN)
-	test -s $(LOCALBIN)/controller-gen || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
+controller-gen: $(LOCALBIN) ## Install controller-gen locally at the configured version.
+	test -x "$(CONTROLLER_GEN)" && \
+		test "$$("$(CONTROLLER_GEN)" --version)" = "Version: $(CONTROLLER_TOOLS_VERSION)" || \
+		GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
 
 all: generate check build
 
-generate:
+generate: controller-gen
 	$(CONTROLLER_GEN) object paths="./..."
 	make manifests
 	# sync crd generated to helm-chart
 
@@ -30,6 +30,7 @@ The project is currently beta. While no breaking API changes are currently plann
       - [Manual uninstall](#manual-uninstall-1)
     - [The AdminServer](#the-adminserver)
   - [Development](#development)
+    - [Update dependencies](#update-dependencies)
     - [Build the operator image](#build-the-operator-image)
     - [Published Docker Images](#published-docker-images)
     - [Direct access to the cluster](#direct-access-to-the-cluster)
@@ -379,6 +380,46 @@ The list of available commands are
 
 ## Development
 
+### Update dependencies
+
+Run `./update-go-deps.sh` to update Go to the latest stable release, Go modules,
+and build-tool pins in the Makefile and CI workflows: kustomize (within v5),
+controller-tools, golangci-lint, Helm, kubeconform and actionlint.
+CI image tags and digests are updated together;
+Helm versions stay synchronized between CI and releases.
+The Go version in `go.mod` and the Dockerfile's major.minor fallback stay
+synchronized; CI and Makefile builds derive their Go version from `go.mod`.
+Go version downgrades are rejected.
+
+Requires Go, Make, curl, Python 3.9+, authenticated GitHub CLI (`gh auth login`),
+and Docker CLI with Buildx. The script enables automatic Go toolchain downloads
+with `GOTOOLCHAIN=auto`. All Go/build-tool lookups and pin matches must succeed
+before build configuration is written. Go module updates are then checked with
+`go build ./...`.
+Finally, `make manifests generate` regenerates code, CRDs and the Helm chart CRD;
+generation failures stop the updater.
+Review the diff and run the relevant CI checks before committing: stable releases
+can still introduce breaking changes.
+
+GitHub Actions references, general Docker images and Gradle dependencies remain
+managed by Dependabot. Zizmor uses the default binary version selected by its
+action. Java and ZooKeeper versions are not changed by this script.
+Test the updater without network access or real dependency upgrades with
+`python3 -B -m unittest discover -s scripts -p 'test_update_deps.py'`.
+
+The `update-dependencies` workflow runs every Monday at 08:17 UTC and can also
+be started manually. It runs the updater and regression, formatting, license,
+vet, and unit checks before creating or updating one PR from
+`automation/update-dependencies`. No PR is created when nothing changes;
+merging remains manual.
+
+The workflow requires the repository secret `PAT`, with Contents, Pull requests,
+and Workflows read/write permissions for this repository. Workflow permission
+is needed because the updater changes CI version pins. The PAT is used only
+to publish the PR, allowing normal PR checks to run; release lookups use the
+read-only workflow token. Scheduled runs start after the workflow is merged
+into the default branch.
+
 ### Build the operator image
 
 Requirements:
 
@@ -4,7 +4,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: zookeeperclusters.zookeeper.pravega.io
 spec:
   group: zookeeper.pravega.io