Boilerplate: Update to 8fb7c801f68dc7e06e8d2ae138c2a98f0b234b56

.ci-operator.yaml

@@ -2,8 +2,3 @@ build_root_image:
   name: boilerplate
   namespace: openshift
   tag: image-v8.3.6
-tests:
-- as: precommit-check
-  commands: echo "pre-commit is for local developer use only. CI is the authoritative gate."
-  container:
-    from: src

.pre-commit-config.yaml

@@ -1,11 +1,3 @@
-exclude: |
-  (?x)(
-    (^vendor/)|
-    (.deepcopy.go$)|
-    (mage_output_file.go$)|
-    (.claude/settings.json$)
-  )
-
 # =============================================================================
 # Tier 1 — Common Pre-Commit Hooks for OSD Operators
 # SREP-4485 | Golden rules: SREP-4450
@@ -67,8 +59,6 @@ repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0                          # pinned immutable tag
     hooks:
-      - id: check-added-large-files
-        args: [--maxkb=500]
       - id: check-merge-conflict
       - id: trailing-whitespace
         args: [--markdown-linebreak-ext=md]
@@ -93,12 +83,13 @@ repos:
   #    Mirrors ci/prow/lint: go-check exactly (same version + config as CI).
   #    Linter config: boilerplate/openshift/golang-osd-operator/golangci.yml
   # ---------------------------------------------------------------------------
-  # ---------------------------------------------------------------------------
-  # NOTE: golangci-lint runs as a local system hook (language: system) to
-  # use the pre-installed binary from the boilerplate image in CI. This
-  # avoids building golangci-lint from source (slow, cold-cache timeout).
-  # Locally, ensure golangci-lint is installed: https://golangci-lint.run
-  # ---------------------------------------------------------------------------
+  - repo: https://github.com/golangci/golangci-lint
+    rev: v2.0.2                          # pinned immutable tag — must match CI (golden rule 15)
+    hooks:
+      - id: golangci-lint
+        args:
+          - --config=boilerplate/openshift/golang-osd-operator/golangci.yml
+          - --timeout=120s                 # graceful timeout (golden rule 3)
 
   # ---------------------------------------------------------------------------
   # Local hooks — compile, dependency, security
@@ -110,19 +101,6 @@ repos:
   # ---------------------------------------------------------------------------
   - repo: local
     hooks:
-      - id: golangci-lint
-        name: golangci-lint
-        language: system
-        entry: bash -c 'test -n "${PRE_COMMIT_CI:-}" && exit 0; golangci-lint run --new-from-rev HEAD --fix --config=boilerplate/openshift/golang-osd-operator/golangci.yml --timeout=120s'
-        types: [go]
-        require_serial: true
-        pass_filenames: false
-
-      - id: go-fmt
-        name: go fmt
-        language: system
-        entry: bash -c "T=$(command -v timeout || command -v gtimeout || echo); ${T:+$T 30s} gofmt -s -w "$@"" --
-        types: [go]
 
       # -----------------------------------------------------------------------
       # 4. COMPILE CHECK  |  target < 10s cached  |  error
@@ -138,18 +116,15 @@ repos:
         pass_filenames: false
 
       # -----------------------------------------------------------------------
-      # 5. DEPENDENCY DRIFT  |  target < 120s cold cache  |  error
-      #    Detects uncommitted go.mod changes after go mod tidy.
-      #    go.sum is intentionally excluded from the diff check: checksums
-      #    are environment-specific (Go version, platform) and go.sum drift
-      #    does not indicate a missing 'go mod tidy' run.
-      #    Fix: run 'go mod tidy' and stage go.mod.
+      # 5. DEPENDENCY DRIFT  |  target < 10s  |  error
+      #    Detects uncommitted go.mod/go.sum changes after go mod tidy.
+      #    Fix: run 'go mod tidy' and stage go.mod and go.sum.
       # -----------------------------------------------------------------------
       - id: go-mod-tidy
         name: go mod tidy
         language: system
-        entry: bash -c 'T=$(command -v timeout || command -v gtimeout || echo); ${T:+$T 300s} go mod tidy && git diff --exit-code go.mod'
-        files: '(\.go$|go\.mod$)'
+        entry: bash -c 'T=$(command -v timeout || command -v gtimeout || echo); ${T:+$T 60s} go mod tidy && git diff --exit-code go.mod go.sum'
+        files: '(\.go$|go\.(mod|sum)$)'
         exclude: '^vendor/'
         pass_filenames: false
 

OWNERS_ALIASES

@@ -81,7 +81,6 @@ aliases:
     - ravitri
   srep-team-leads:
     - rafael-azevedo
-    - iamkirkbater
     - dustman9000
     - bmeng
     - typeid

boilerplate/_data/last-boilerplate-commit

@@ -1 +1 @@
-dd0c8513538cbc8e2c9df5ce3c2053740d733f34
+8fb7c801f68dc7e06e8d2ae138c2a98f0b234b56

boilerplate/_lib/container-make

@@ -29,12 +29,14 @@ if [[ "${CONTAINER_ENGINE##*/}" == "podman" ]] && [[ $OSTYPE == *"linux"* ]]; th
 else
     CE_OPTS="${CE_OPTS} -v $REPO_ROOT:$CONTAINER_MOUNT"
 fi
-container_id=$($CONTAINER_ENGINE run -d ${CE_OPTS} $IMAGE_PULL_PATH sleep infinity)
+container_id=$($CONTAINER_ENGINE run --rm -d ${CE_OPTS} $IMAGE_PULL_PATH sleep infinity)
 
 if [[ $? -ne 0 ]] || [[ -z "$container_id" ]]; then
   err "Couldn't start detached container"
 fi
 
+trap "$CONTAINER_ENGINE stop $container_id >/dev/null 2>&1" EXIT
+
 # Now run our `make` command in it with the right UID and working directory
 args="exec -it -u $(id -u):0 -w $CONTAINER_MOUNT $container_id"
 banner "Running: make $@"
@@ -52,6 +54,9 @@ if [[ $rc -ne 0 ]]; then
   fi
 fi
 
+# Disarm the interrupt trap -- normal cleanup handles it from here
+trap - EXIT
+
 # Finally, remove the container
 banner "Cleaning up the container"
 $CONTAINER_ENGINE rm -f $container_id >/dev/null

boilerplate/openshift/golang-osd-operator/OWNERS_ALIASES

@@ -81,7 +81,6 @@ aliases:
     - ravitri
   srep-team-leads:
     - rafael-azevedo
-    - iamkirkbater
     - dustman9000
     - bmeng
     - typeid

boilerplate/openshift/golang-osd-operator/README.md

@@ -157,7 +157,7 @@ With `FIPS_ENABLED=true`, `ensure-fips` is always run before `make go-build`
 - If an additional deployment image has to be built and appended to the CSV as part of the build process, then the consumer needs to:
   - Specify `SupplementaryImage` which is the deployment name in the consuming repository's `config/config.go`.
   - Define the image to be built as `ADDITIONAL_IMAGE_SPECS` in the consuming repository's Makefile, Boilerplate later parses this image as part of the build process; [ref](https://github.com/openshift/boilerplate/blob/master/boilerplate/openshift/golang-osd-operator/standard.mk#L56).
-
+  
   e.g.
 
     ```.mk

boilerplate/openshift/golang-osd-operator/TEST_README.md

@@ -156,10 +156,10 @@ class TestManifestProcessing(unittest.TestCase):
         """Test description."""
         # Arrange
         manifest_str = "..."
-
+        
         # Act
         result = migration.some_function(manifest_str)
-
+        
         # Assert
         self.assertEqual(result, expected_value)
 ```

boilerplate/openshift/golang-osd-operator/app-sre.md

@@ -28,8 +28,8 @@ An example of how to do this for the `staging` branch is below (`production` ste
 ```
 git checkout staging
 git pull upstream staging
-git reset --hard upstream/staging  
-git push origin staging --force  
+git reset --hard upstream/staging                
+git push origin staging --force                                                                            
 ```
 
 ## Set environment variables

boilerplate/openshift/golang-osd-operator/csv-generate/csv-generate.sh

@@ -169,11 +169,11 @@ if [[ -z "$SKIP_SAAS_FILE_CHECKS" ]]; then
 
             if [[ "$delete" == false ]]; then
                 short_hash=$(echo "$version" | cut -d- -f2)
-
+                
                 # before comparing the short_hash to the deployment hash, remove the leading g added in https://issues.redhat.com/browse/OSD-13681
-                # short_hash should be 7 char long without the leading g.
+                # short_hash should be 7 char long without the leading g. 
                 [ ${#short_hash} -gt 7 ] && short_hash=${short_hash:1:7}
-
+                
                 if [[ "$DEPLOYED_HASH" == "${short_hash}"* ]]; then
                     delete=true
                 fi

boilerplate/openshift/golang-osd-operator/dependabot.yml

@@ -9,6 +9,9 @@ updates:
       - "approved"
     schedule:
       interval: "weekly"
+      day: "monday"
+      time: "03:00"
+      timezone: "UTC"
     ignore:
       - dependency-name: "redhat-services-prod/openshift/boilerplate"
         # don't upgrade boilerplate via these means