[devantler]

🤖 Generated by the Agentic Engineer

Why

KSail's Kubernetes libraries have to move as one set, and there is already a rule holding that set back so the upgrade is done deliberately — but the controller-runtime library was never covered by it, so updates to it keep being raised automatically and can never build. The same update has already been raised, closed and raised again, each attempt spending a full CI run to rediscover the same incompatibility. Dependency updates get only five slots, four are already held by updates that cannot merge, so one more stuck update stops dependency updates for the whole project.

What

Brings controller-runtime under the existing rule, so its feature-level updates are taken deliberately alongside the rest of the Kubernetes set instead of arriving on their own. Security and bug-fix updates for it still come through as normal, and unrelated libraries are untouched.

Fixes #7133

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler: I will review the changes.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 0ac8a771-2145-4f66-8df1-c16b38ebc418

📥 Commits

Reviewing files that changed from the base of the PR and between 96528d7 and 0e30953.

📒 Files selected for processing (1)

• .github/dependabot.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Analyze (go)

🔇 Additional comments (1)

.github/dependabot.yaml (1)

59-73: LGTM!

---

📝 Walkthrough

Walkthrough

The Dependabot configuration adds an ignore rule for sigs.k8s.io/controller-runtime minor updates. Patch and security updates remain allowed. Other sigs.k8s.io/* dependencies are unaffected.

Priority: ⬇️ Low

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The reviewed .github/dependabot.yaml adds an ignore rule for exactly sigs.k8s.io/controller-runtime with version-update:semver-minor. The adjacent comment records the v0.24.1/Kubernetes 0.36.0 a…
Out of Scope Changes check	✅ Passed	The reviewed change is limited to the Dependabot ignore policy and its coupling rationale in .github/dependabot.yaml. The change directly implements #7133 and does not alter unrelated dependency pol…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Description check	✅ Passed	The description clearly explains the Dependabot change, its scope, the Kubernetes dependency coupling, and the intended patch and security update behavior.
Title check	✅ Passed	The title clearly identifies the dependency change and the reason for preventing controller-runtime minor proposals.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness record @ 0e309532f9b9a48ce14ea3b5acd980ea2f2af9f1

1. Programmatically tested.

• The file parses: yq eval '.' succeeds.
• Before/after control on the real target. Against origin/main, the gomod ignore list has 2 entries; at this head it has 3 — so the control confirms sigs.k8s.io/controller-runtime was genuinely uncovered before this change rather than merely under-documented.
• The new entry resolves to the intended shape: dependency-name: sigs.k8s.io/controller-runtime, update-types[0] = version-update:semver-minor.
• Diff scope is exactly 1 file, 15 insertions, 0 deletions — no other ecosystem, group, or rule touched.
• CI is green, and the change correctly drives 🔍 Detect Changes to skip the entire Go pipeline (Build, Test, golangci-lint, coverage, system tests all SKIPPED), with CI - Required Checks success.

2. Reviewed. CodeRabbit green at this exact head — no actionable comments, 0 review threads, 0 collapsed finding sections; head status Review completed.

3. Tried and evaluated as a user. This change has no exercisable runtime surface: it is configuration consumed by Dependabot's hosted service, which cannot be driven from here, so per the contract I traced it to its consumer and verified the claim it rests on rather than executing it.

The load-bearing claim is the version coupling, and I verified it directly against the module proxy rather than reasoning about it:

module@version	requires k8s.io/{api,apimachinery,apiserver,client-go}
controller-runtime@v0.24.1 (current)	v0.36.0
controller-runtime@v0.25.0 (what #7075 proposes)	v0.37.0

This module pins k8s.io/kubernetes v1.36.0 with the staging set on the 0.36 line, so the proposed minor moves the graph to 0.37 — and #7075 fails with precisely a 1.37-shaped API error (NodeAllocatableResourceClaimStatus has no field or method Resources). The same 0.37 requirement is what parks #6826, #6845 and #7127, all tracked under #6728.

I also checked the scoping decision as its user: sigs.k8s.io/* matches 13 further modules here (yaml, kind, kwok, kustomize/api, kustomize/kyaml, json, randfill, release-utils, knftables, cli-utils, gateway-api, apiserver-network-proxy, structured-merge-diff). Suppressing their minors would cost real updates for no benefit, which is why the rule names controller-runtime alone. CodeRabbit independently read the change the same way: "Patch and security updates remain allowed. Other sigs.k8s.io/* dependencies are unaffected."

Honest limit: I cannot make Dependabot run, so this is verified by structure and by the upstream coupling, not by observing a suppressed proposal. The observable confirmation is negative and arrives on the next cycle — controller-runtime minors stop being re-proposed.