Chore: bump pkg, workflow and prism to Go 1.27 and k8s 0.37 (22/23)

Closed
BR
15d ago
+1106-691

Stack 22/23 · next #978

Description of your changes

KubeVela's workflow forEach (and its item keys) landed in kubevela/pkg (#142, #154) and kubevela/workflow (#261, #273) after both moved to Go 1.27.1 and k8s 0.37 (controller-runtime 0.25), so VelaUX has to follow before it can use it.

  • Pins: pkg a754071 and workflow 53204a3, which carry forEach keys (kubevela/pkg#154, kubevela/workflow#273), prism dba7491 (its own 1.27 bump, kubevela/prism#72, which no longer needs the apiserver-runtime replace). The replace block is the union of ours and KubeVela master's.

  • Apply on the client. controller-runtime 0.25 adds Apply to client.Client and the sub-resource clients. Two of our wrappers embed the client, so Apply went straight through them:

    • the project query guard, which is meant to be read-only, could write with it;
    • the impersonating auth client sent it as VelaUX instead of the user.

    Both now override Apply, with tests (query_test.go, auth_client_test.go). Nothing calls Apply today; this keeps it that way safely.

  • CI and images: Go 1.27.1 in the workflows and Dockerfiles, envtest on k8s 1.37.0, staticcheck v0.8.2, golangci-lint v2.14.0 (.golangci.yml was already in the v2 format; 1.60.1 could not read it), installed with go install.

  • Lint. golangci-lint v2 reads the v2 .golangci.yml VelaUX already had, so it reports what 1.60.1 never could: 43 findings, about half already on main. Repeated strings become constants named for what they are (datastore sort and filter keys; the permission templates' scopes, effect, actions and View permission names; the definition type and data-flow kind source), or the existing ones where they mean the same (the expression type kinds). Three WriteString(fmt.Sprintf(...)) become fmt.Fprintf, and DefinitionBase.WorkloadType's deprecation notice gets its own paragraph; VelaUX still fills that field for clients that read it, marked.

  • ReverseProxy.Director is deprecated from Go 1.26. Its four uses stay, marked: Rewrite changes which headers reach the upstream, which wants its own change with e2e behind it.

Fixes #

I have:

  • Read and followed KubeVela's contribution process.
  • Related Docs updated properly. In a new feature or configuration option, an update to the documentation is necessary.
  • Run yarn lint to ensure the frontend changes are ready for review.
  • Run make reviewableto ensure the server changes are ready for review.
  • Added backport release-x.y labels to auto-backport this PR if necessary.

How has this code been tested

  • Every Go package's unit tests on the bump; go vet, staticcheck and golangci-lint v2.14 clean.
  • The Apply tests fail without the overrides (the guard's top-level Apply wrote; the auth client's ran as velaux).

Special notes for your reviewer

  • KubeVela stays at the version #973 pins.