[oadp-1.4] Make controller-gen/kustomize/golangci-lint/envtest tool-binary caching reliable

[kaovilai]

Cherry-pick of #2367 to oadp-1.4 — same fix, plus this branch's own pre-existing envtest arch-check bug (see below).

Summary

go-install-tool-branch only installs a build tool when its binary is missing, never verifying the pinned version against what's already on disk. Once a binary lands at bin/<branch>/<tool>, it's reused forever — even after CONTROLLER_TOOLS_VERSION/KUSTOMIZE_VERSION/GOLANGCI_LINT_VERSION change — because bin/ is gitignored. kustomize/controller-gen targets also weren't fully .PHONY, so Make's own mtime-based staleness check could skip the recipe before any check ran.

None of the four tools (controller-gen/kustomize/golangci-lint/setup-envtest, the last folded in from #2152) were checked for architecture compatibility either. This repo's own Makefile documents a docker run --platform linux/amd64 -v $PWD:$PWD ... workflow to reproduce Prow's CI environment — that bind-mounts the host directory into a forced-arch container, so any go install in there writes a foreign-arch binary straight onto the host's bin/ tree (same path, not a copy).

This branch already had a bespoke check-envtest-arch target (from #2100) attempting to guard against exactly this for setup-envtest, but it checked $(ENVTEST) --help's exit code and treated any nonzero result as "wrong architecture" — setup-envtest's own --help exits 2 by its own convention even on a perfectly healthy binary, so it was unconditionally reinstalling setup-envtest on every single invocation.

Design

go-install-tool-versioned reads a binary's embedded build info via go version -m — the module version and GOOS/GOARCH it was built with — instead of executing the binary or trusting a sidecar marker file:

• A binary's own --version/--help output isn't a reliable version or health signal: it can depend on ldflags a tool's own release process sets (which go install doesn't set — e.g. kustomize can report (devel) or an unexpanded $Format:%H$ placeholder instead of its real version), and some tools exit nonzero on --version even when perfectly healthy (kustomize exits 1, setup-envtest's --help exits 2). A bare probe command that exits nonzero is also dangerous under this Makefile's .SHELLFLAGS = -ec (enables set -e, honored by GNU Make 3.82+): it aborts the whole recipe unless wrapped in an if/|| guard.
• Executing the binary to test compatibility can't detect a wrong-arch binary at all inside a container with qemu-user-static/binfmt_misc registered (standard for multi-arch CI/build images) — the foreign-arch binary just runs under emulation and returns its own exit code, not an exec-format-error.

Reading embedded build info sidesteps both: no execution means no exit-code heuristic to get wrong and no qemu blind spot. setup-envtest's arch check is folded into this same shared macro rather than kept as a separate mechanism.

Known limitations

• ENVTESTPATH's arch selection has a separate, pre-existing bug — tracked as ENVTESTPATH arch-selection is decided at Makefile parse time, picks amd64 on any cold bin/ regardless of host arch #2377, not fixed here. Its ifeq-based amd64 fallback is decided at Makefile-parse time and picks the amd64-forced variant on any cold bin/, regardless of actual host arch — confirmed via direct repro (see ENVTESTPATH arch-selection is decided at Makefile parse time, picks amd64 on any cold bin/ regardless of host arch #2377). It's invisible on amd64 CI (no CI/release-branch risk) and only affects arm64 local dev with a cold checkout, so it's out of scope here rather than a reason to expand this PR's diff a third time.
• golangci-lint@v1.54.2 (this branch's pin) doesn't build against a modern Go 1.26 toolchain — a pre-existing, unrelated x/tools incompatibility; CI pins its own Go version and isn't affected. Bumping to the latest v1.x (v1.64.8, avoiding v2's config/default-linter overhaul) does fix the build, but its updated staticcheck/ineffassign/gosimple linters immediately surface ~20 pre-existing findings across unrelated files. Left the pin as-is — real scope growth this PR shouldn't absorb.
• Unversioned tool symlinks (bin/<tool> → last-branch-wins, pre-existing behavior), a lower-priority observation, also worth a follow-up.

Testing

Verified against GNU Make 4.4.1 specifically (installed via Homebrew), not just the macOS-default Make 3.81 — the latter silently ignores .SHELLFLAGS, so it can't exercise set -e recipe behavior at all.

• rm -rf bin/oadp-1.4 / rm -f bin/setup-envtest, then gmake controller-gen / gmake kustomize / gmake envtest individually — each installs fresh.
• Re-running each immediately after → "already installed", no reinstall, no network call.
• Simulated a wrong-arch binary (cross-compiled linux/amd64) for controller-gen, kustomize, and envtest → each correctly detected via go version -m's GOARCH/GOOS fields, removed, reinstalled with a valid native binary.
• gmake generate manifests bundle → zero diff against a clean checkout.
• gmake test → exit 0, all packages pass, Go code is formatted, api is up to date, bundle is up to date.

Note

Responses generated with Claude

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cf286123-39fe-420a-a0d7-d3f55f763a84

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 81.25000% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 38.47%. Comparing base (42938ce) to head (b4eeaa4).
⚠️ Report is 4 commits behind head on oadp-1.4.

⚠️ Current head b4eeaa4 differs from pull request most recent head d3ca37d

Please upload reports for the commit d3ca37d to get more accurate results.

Files with missing lines	Patch %	Lines
api/v1alpha1/zz_generated.deepcopy.go	0.00%	12 Missing ⚠️
pkg/common/common.go	95.16%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           oadp-1.4    #2368      +/-   ##
============================================
+ Coverage     37.79%   38.47%   +0.67%     
============================================
  Files            30       30              
  Lines          5033     5113      +80     
============================================
+ Hits           1902     1967      +65     
- Misses         2935     2949      +14     
- Partials        196      197       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kaovilai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [kaovilai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kaovilai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [kaovilai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@kaovilai: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/unit-test	d3ca37d	link	true	/test unit-test

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.