chore: replace bingo with Go 1.24 tool directives

[kuudori]

HYPERFLEET-1333

Remove bingo tool management in favor of native tool directives in go.mod (Go 1.24+).
Tool versions are pinned in go.mod/go.sum and resolved via go tool <name>.

Pinned versions (unchanged from bingo):

• golangci-lint v2.7.0

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ma-hill for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated project tooling to install a pinned version of the Go linter locally.
  • Simplified linter setup by removing obsolete generated configuration.
  • The existing lint command now automatically uses the locally installed tool.

Walkthrough

The Bingo ignore, variable, and golangci-lint module files are removed. The Makefile now defines a pinned golangci-lint version and local binary path, and adds a rule that downloads and executes the upstream installer to place the binary in ./bin. The existing lint target uses this local binary.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title matches the main change: replacing bingo-managed tooling with native Go tool directives.
Description check	✅ Passed	Description matches the changes and states the pinned golangci-lint version.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	PR diff only touches Makefile/.bingo; no added log statements with token/password/credential/secret fields or interpolated strings. No CWE-532 exposure.
No Hardcoded Secrets	✅ Passed	No CWE-798/CWE-259 secret literals, embedded creds, private keys, or token/password assignments appear in added hunks; only deleted checksum data in .sum.
No Weak Cryptography	✅ Passed	No CWE-327/CWE-208 weak-crypto primitives, custom crypto, or secret compares were added; the patch only removes bingo files and changes lint tooling.
No Injection Vectors	✅ Passed	No CWE-89/78/79/502 patterns in touched files; only a pinned Makefile install rule and deleted bingo config.
No Privileged Containers	✅ Passed	PASS: Diff only touches .bingo helpers and Makefile; no Kubernetes/OpenShift manifests, Helm templates, or Dockerfiles, and no privileged flags found in changed files.
No Pii Or Sensitive Data In Logs	✅ Passed	The PR only changes build/tooling files (.bingo, Makefile, go.mod); no new slog/logr/zap/fmt.Print logging paths or PII-bearing logs are introduced (CWE-532).

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Around line 147-149: Replace the curl-piped installer in the $(GOLANGCI_LINT)
target with a checksum-verified installation approach, preferably a pinned Go
module install consistent with the project’s native Go tool directives. Ensure
the target still installs the requested golangci-lint version into ./bin without
executing an unverified remote script.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 6f893cf8-502e-423a-b076-d7ca8e2aec0c

📥 Commits

Reviewing files that changed from the base of the PR and between df6016b and 7bc6c3c.

⛔ Files ignored due to path filters (1)

• .bingo/golangci-lint.sum is excluded by !**/*.sum

📒 Files selected for processing (4)

• .bingo/.gitignore
• .bingo/Variables.mk
• .bingo/golangci-lint.mod
• Makefile

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual) → reviewed against open PR #26 chore/replace-bingo-with-go-tool-directives instead of the default branch

💤 Files with no reviewable changes (3)

• .bingo/.gitignore
• .bingo/golangci-lint.mod
• .bingo/Variables.mk

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

CWE-494: unverified curl-pipe-sh executes remote script with no integrity check.

curl -sSfL ... | sh -s -- pipes a remote install script directly into a shell with zero checksum/signature verification. A compromised endpoint or DNS/TLS MITM yields arbitrary code execution during make lint / CI, running with the invoking user's/CI privileges. Path instructions for **/Makefile explicitly prohibit this pattern.

🔒 Checksummed-install alternative

 $(GOLANGCI_LINT):
-	curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b ./bin $(GOLANGCI_LINT_VERSION)
+	curl -sSfL -o /tmp/golangci-lint-install.sh https://golangci-lint.run/install.sh
+	echo "<pinned-sha256>  /tmp/golangci-lint-install.sh" | sha256sum -c -
+	sh /tmp/golangci-lint-install.sh -b ./bin $(GOLANGCI_LINT_VERSION)

Or avoid the installer script entirely and use go install with a pinned checksum-verified module (go.sum already covers integrity for go install/go tool), consistent with the PR's stated move to native Go tool directives.

As per path instructions, "No curl-pipe-bash for tool installation (use checksummed downloads)".

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	$(GOLANGCI_LINT):
	curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b ./bin $(GOLANGCI_LINT_VERSION)
	$(GOLANGCI_LINT):
	curl -sSfL -o /tmp/golangci-lint-install.sh https://golangci-lint.run/install.sh
	echo "<pinned-sha256> /tmp/golangci-lint-install.sh" | sha256sum -c -
	sh /tmp/golangci-lint-install.sh -b ./bin $(GOLANGCI_LINT_VERSION)

🧰 Tools

🪛 checkmake (0.3.2)

[warning] 147-147: Required target "all" is missing from the Makefile.

(minphony)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Makefile` around lines 147 - 149, Replace the curl-piped installer in the
$(GOLANGCI_LINT) target with a checksum-verified installation approach,
preferably a pinned Go module install consistent with the project’s native Go
tool directives. Ensure the target still installs the requested golangci-lint
version into ./bin without executing an unverified remote script.

Source: Path instructions