build: resolve Bazel Go deps through GOPROXY

[dillon-zheng]

Manual backport of #69503 to release-8.5.

This keeps the release-8.5-specific Bazel dependency generation behavior, regenerates DEPS.bzl with cmd/mirror, and removes the old pingcapmirror/static URL flow.

Validation:

• go test ./cmd/mirror
• regenerated DEPS.bzl with cmd/mirror and verified diff is empty
• checked DEPS.bzl has no old pingcapmirror/static cache URLs or sha256/strip_prefix/urls entries
• git -c core.whitespace=-tab-in-indent diff --check --cached

Issue Number: close #69513

Release note:

None

Summary by CodeRabbit

• New Features

  • Module dependency generation now resolves packages directly through GOPROXY.
  • Generated dependency metadata uses downloaded module versions and checksums.

• Deprecations

  • Legacy mirror and upload options are deprecated and ignored.
  • The mirror upload command now displays guidance to use the standard mirror generation command.

• Improvements

  • Removed legacy mirror artifact reuse and upload behavior, simplifying dependency preparation.

[ti-chi-bot]

Hi @dillon-zheng. Thanks for your PR.

I'm waiting for a pingcap member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

The mirror tool now relies on GOPROXY metadata to generate DEPS.bzl, removes legacy mirror discovery and upload behavior, trims related Bazel and Go dependencies, and updates Makefile targets and deprecation handling.

Changes

GOPROXY mirror refactor

Layer / File(s)	Summary
GOPROXY-based dependency generation cmd/mirror/..., go.mod	The mirror command removes storage, artifact parsing, and upload paths, emits repository metadata from downloaded modules, and deprecates --mirror and --upload.
Bazel mirror target integration Makefile, cmd/mirror/BUILD.bazel	Mirror preparation targets update command redirection and the upload target now prints deprecation guidance; Bazel and Go dependencies are trimmed accordingly.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• pingcap/tidb#69503: Contains the same GOPROXY-only mirror refactor and coordinated Makefile, Bazel, and dependency updates.
• pingcap/tidb#69842: Covers the same removal of legacy mirror/upload and DEPS.bzl parsing behavior.
• pingcap/tidb#69843: Applies the same coordinated mirror command and Makefile changes.

Suggested labels: type/cherry-pick-for-release-8.5

Suggested reviewers: ti-chi-bot, cfzjywxk, winoros

Sequence Diagram(s)

sequenceDiagram
  participant Makefile
  participant mirror
  participant GOPROXY
  participant DEPSbzl
  Makefile->>mirror: Run mirror generation
  mirror->>GOPROXY: List and download modules
  GOPROXY-->>mirror: Return module metadata
  mirror->>DEPSbzl: Generate repository rules from sum and version
  DEPSbzl-->>Makefile: Write redirected output

Loading

Poem

I’m a rabbit with a freshly dug burrow,
GOPROXY brings the modules in a flurry.
Old mirrors sleep, uploads fade,
New DEPS rules are neatly made.
Hop, hop—clean builds are ready!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description includes issue, summary, validation, and release note, but misses most required template sections and checklist items.	Add the template headings for problem summary, changes, checklist, side effects, and documentation, and include at least one test item.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the main change: resolving Bazel Go deps through GOPROXY.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[wuhuizuo]

/ok-to-test

[ti-chi-bot]

@wuhuizuo: adding LGTM is restricted to approvers and reviewers in OWNERS files.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-8.5@202b7f4). Learn more about missing BASE report.

Additional details and impacted files

@@               Coverage Diff                @@
##             release-8.5     #69844   +/-   ##
================================================
  Coverage               ?   55.1436%           
================================================
  Files                  ?       1849           
  Lines                  ?     666253           
  Branches               ?          0           
================================================
  Hits                   ?     367396           
  Misses                 ?     271449           
  Partials               ?      27408           

Flag	Coverage Δ
integration	38.2156% <ø> (?)
unit	65.1691% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
dumpling	55.3108% <0.0000%> (?)
parser	∅ <0.0000%> (?)
br	54.8040% <0.0000%> (?)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: D3Hunter, wuhuizuo, YangKeao

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [D3Hunter,YangKeao]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-07-15 01:57:57.434107512 +0000 UTC m=+765263.470202568: ☑️ agreed by D3Hunter.
• 2026-07-15 01:58:05.131752224 +0000 UTC m=+765271.167847280: ☑️ agreed by YangKeao.