build: resolve Bazel Go deps through GOPROXY (#69503)

[dillon-zheng]

This is a manual cherry-pick of #69503 to release-nextgen-202603.

The bot-created PR #69841 left conflict markers in DEPS.bzl, so this branch resolves the small cmd/mirror conflict and regenerates DEPS.bzl with the updated generator instead of hand-resolving thousands of DEPS.bzl hunks.

Validation:

• go test ./cmd/mirror
• regenerated DEPS.bzl with cmd/mirror and verified no diff
• rg '<<<<<<<|=======|>>>>>>>' DEPS.bzl cmd/mirror/mirror.go Makefile cmd/mirror/BUILD.bazel go.mod go.sum
• rg 'pingcapmirror|cache.hawkingrei.com|bazel-cache.pingcap.net|ats.apps.svc|sha256 =|strip_prefix =|urls =' DEPS.bzl
• git -c core.whitespace=-tab-in-indent diff --check HEAD~1..HEAD

Issue Number: close #69513

Release note:

None

Summary by CodeRabbit

• New Features

  • Bazel dependency generation now uses module information from Go module downloads, including version, checksum, and replacement details.
  • Added clear errors when required module download information is unavailable.

• Bug Fixes

  • Removed reliance on obsolete mirror and upload behavior during dependency generation.

• Chores

  • Deprecated mirror upload commands now provide guidance to use GOPROXY and regenerate dependencies with make bazel_mirror.

[ti-chi-bot]

Hi @dillon-zheng. Thanks for your PR.

I'm waiting for a pingcap member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: e2834756-91bd-41f5-85ba-f6109bd996cc

📥 Commits

Reviewing files that changed from the base of the PR and between 8c0a0f0 and 8245839.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (6)

• DEPS.bzl
• Makefile
• cmd/mirror/BUILD.bazel
• cmd/mirror/mirror.go
• cmd/mirror/skylarkutil.go
• go.mod

💤 Files with no reviewable changes (2)

• cmd/mirror/skylarkutil.go
• go.mod

---

📝 Walkthrough

Walkthrough

The Bazel mirror tool no longer uploads or reuses GCS mirror artifacts. It generates go_repository entries from downloaded module metadata, removes Skylark parsing dependencies, updates Makefile invocations, and deprecates the upload target.

Changes

Mirror generation

Layer / File(s)	Summary
Generate repositories from downloaded modules cmd/mirror/mirror.go	Deprecated flags are ignored, upload and existing-mirror logic is removed, and go_repository entries use downloaded sums, versions, and replacements.
Prune mirror tool dependencies cmd/mirror/BUILD.bazel, go.mod	Skylark parsing sources and related dependencies are removed from the Bazel target and Go module requirements.
Update Makefile mirror targets Makefile	Mirror targets redirect generated output without deprecated arguments, while bazel_mirror_upload prints a deprecation message.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Makefile
  participant MirrorBinary
  participant GoModuleDownload
  Makefile->>MirrorBinary: invoke Bazel mirror target
  MirrorBinary->>GoModuleDownload: resolve module metadata
  GoModuleDownload-->>MirrorBinary: return sum, version, and replacement data
  MirrorBinary-->>Makefile: write DEPS.bzl entries

Loading

Possibly related PRs

• pingcap/tidb#69503: Applies the same mirror and Skylark dependency refactor.
• pingcap/tidb#69842: Contains the same cmd/mirror and Makefile changes.
• pingcap/tidb#69320: Also changes dumpNewDepsBzl URL generation.

Suggested labels: do-not-merge/hold

Suggested reviewers: cfzjywxk, jmpotato, yangkeao

Poem

I’m a bunny with a Bazel-bound pen,
No cloud uploads to chase again.
Sums and versions hop in line,
DEPS blooms neat, repository-fine.
“Deprecated,” I whisper, and nibble some pine.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main change: Bazel Go dependency resolution moved to GOPROXY.
Description check	✅ Passed	The description covers the cherry-pick, issue number, and validation, but it omits most template sections like the checklist and side effects.
Linked Issues check	✅ Passed	The changes remove mirror uploads and switch cmd/mirror to generate DEPS.bzl entries from downloaded modules, matching #69513.
Out of Scope Changes check	✅ Passed	The modified files stay focused on the Bazel mirror workflow and related dependency cleanup, with no clear unrelated changes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: context deadline exceeded"
level=error msg="Timeout exceeded: try increasing it by passing --timeout option"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[wuhuizuo]

/ok-to-test

[ti-chi-bot]

@wuhuizuo: adding LGTM is restricted to approvers and reviewers in OWNERS files.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-nextgen-202603@8c0a0f0). Learn more about missing BASE report.

Additional details and impacted files

@@                     Coverage Diff                     @@
##             release-nextgen-202603     #69843   +/-   ##
===========================================================
  Coverage                          ?   76.1578%           
===========================================================
  Files                             ?       1936           
  Lines                             ?     540873           
  Branches                          ?          0           
===========================================================
  Hits                              ?     411917           
  Misses                            ?     128956           
  Partials                          ?          0           

Flag	Coverage Δ
unit	76.1578% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
dumpling	61.5065% <0.0000%> (?)
parser	∅ <0.0000%> (?)
br	48.7600% <0.0000%> (?)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-07-15 01:57:49.59624773 +0000 UTC m=+765255.632342785: ☑️ agreed by D3Hunter.
• 2026-07-15 01:58:11.454444571 +0000 UTC m=+765277.490539617: ☑️ agreed by YangKeao.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cfzjywxk, D3Hunter, wuhuizuo, YangKeao

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [D3Hunter,YangKeao,cfzjywxk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment