[welteki]

• I have raised an issue to propose this change.

Description

Update the container builder to Go 1.27 and refresh checkout and hub-mirror actions to released versions. Use the target platform for the runtime base image so arm64 releases contain an arm64 base.

Update Kubernetes clients to v0.37.1, go-password to v0.4.0 and transitive cloud SDK dependencies, with refreshed vendoring. Keep kube-openapi at v0.0.0-20260721132016-d427ff9ee9ad: newer revisions return structured-merge-diff/v7 schema types that do not compile with Kubernetes v0.37.1's v6 types.

How Has This Been Tested?

On Linux amd64 with Go 1.27.3:

• go test ./..., go vet ./... and go mod verify passed.
• Built the distribution Dockerfile using docker buildx build --platform linux/amd64,linux/arm64 --build-arg Version=dev --build-arg GitCommit=<commit> --output type=oci,dest=/tmp/inlets-operator-validation.oci.tar .. Both platforms passed the Dockerfile unit tests and license check, then produced release binaries and images. Arm64 unit tests executed through QEMU/binfmt emulation.
• Inspected the OCI image configurations: linux/amd64 and linux/arm64, both running as nonroot:nonroot. Extracted binaries are stripped, statically linked x86-64 and AArch64 ELF files respectively; --help smoke checks passed for both (arm64 under emulation).
• Live Kubernetes reconciliation and cloud provisioning were not exercised. Docker reported only the existing FROM/as casing warnings.

How are existing users impacted? What migration steps/scripts do we need?

No configuration migration is required. Building from source requires Go 1.27.

Checklist:

I have:

• updated the documentation and/or roadmap (if required)
• read the CONTRIBUTION guide
• signed-off my commits with git commit -s
• added unit tests

[reviewfn]

AI Pull Request Overview

Disclaimer: This review was generated by automated AI and may contain errors. Do not trust its outputs without human verification.

Summary

• Updates the build toolchain and module directive to Go 1.27.
• Upgrades Kubernetes clients to v0.37.1, go-password to v0.4.0, transitive dependencies, and vendored sources.
• Updates checkout actions in build and publish workflows.
• Contains a blocking multi-platform image regression: the runtime stage remains pinned to the build platform.
• All three new commits comply with the policy prohibiting AI authorship or attribution trailers.

Approval rating (1-10)

6/10. Dependency metadata is coherent, but the final Dockerfile defeats the stated arm64 runtime-base correction and should be fixed before merge.

Summary per file

Summary per file

File path	Summary
.github/workflows/build.yaml	Updates checkout action used by pull-request and branch builds.
.github/workflows/publish.yaml	Updates checkout action used by tagged multi-platform releases.
Dockerfile	Updates Go and lint casing, but incorrectly pins the runtime base to the build platform.
go.mod	Raises the Go requirement and refreshes direct and transitive dependencies.
go.sum	Refreshes checksums for the updated module graph.

Overall Assessment

The dependency and workflow refresh is internally consistent, and the new commit messages contain no prohibited AI attribution. However, the final Dockerfile reintroduces the exact multi-platform base-image problem the first commit intended to solve. Tagged arm64 builds will select the builder host's runtime base rather than the arm64 runtime base, so the PR should not merge until that regression is corrected.

Detailed Review

Detailed Review

Dockerfile

High: Select the target platform for the final runtime stage (Dockerfile:46)

FROM --platform=${BUILDPLATFORM:-linux/amd64} forces the final distroless stage to use the platform running BuildKit, which is normally linux/amd64. During the publish workflow's linux/amd64,linux/arm64 build, the arm64 output therefore inherits the amd64 distroless variant instead of the arm64 variant. This contradicts the PR's stated goal and can place architecture-specific base contents into an image advertised for arm64.

The first commit correctly removed the platform override so BuildKit would use TARGETPLATFORM, but the final lint-fix commit restored BUILDPLATFORM. Remove the override again, or explicitly use the target platform:

FROM gcr.io/distroless/static:nonroot

Using the default target-platform selection also avoids the constant-platform lint warning without changing the builder stages, which should remain on BUILDPLATFORM for cross-compilation.

AI agent details.

Agent processing time: 1m20.128s
Environment preparation time: 4.212s
Total time from webhook: 1m36.208s