[dependabot]

Bumps the azure-github-dependencies group with 1 update in the / directory: github.com/Azure/azure-sdk-for-go/sdk/azcore.

Updates github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.21.1 to 1.22.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azcore's releases.

sdk/azcore/v1.22.0

1.22.0 (2026-06-04)

Features Added

• Added type datetime.RFC7231 for date/time values in RFC 1123 format with a fixed GMT timezone.

Other Changes

• Upgraded dependencies.

Commits

• a19f613 Prep azcore@v1.22.0 for release (#26926)
• 5803c0e Increment package version after release of storage/azblob (#26935) (#26943)
• 9a979ff [Automation] Regenerate SDK based on typespec-go branch main 【batch 6】 (#26939)
• 711094d eng/tools/generator: release v0.4.14 (#26934)
• 20bd677 Deprecate Change Analysis SDK (#26913)
• 92a31ec [Automation] Regenerate SDK based on typespec-go branch main 【batch 5】 (#26932)
• 768459d azcertificates: live recording for PlatformManaged + review fixes (follow-up ...
• e845f72 Update codeowners (#26918)
• 118bb35 eng/tools/internal/exports: handle untyped const with selector expr value (#2...
• 2b3767b Configurations: 'specification/containerservice/resource-manager/Microsoft.C...
• Additional commits viewable in compare view

Summary by CodeRabbit

• Chores
  • Updated internal dependencies to their latest versions for improved stability and security.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR updates three Go module dependencies in go.mod: github.com/Azure/azure-sdk-for-go/sdk/azcore from v1.21.1 to v1.22.0, golang.org/x/net from v0.54.0 to v0.55.0, and the indirect golang.org/x/sys from v0.44.0 to v0.45.0. No other module directives, code changes, or exported API modifications are present.

Suggested reviewers

• enxebre
• sjenning
• bryan-cox

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
No-Weak-Crypto	❌ Error	Weak crypto detected: md5.Sum (support/util/hash.go, support/certs/tls.go), sha1.Sum (cmd/fix/dr_oidc_iam.go), plus secret bytes.Equal comparisons.	Replace md5/sha1 with SHA-256/SHA-512 and use constant-time comparisons (subtle.ConstantTimeCompare or hmac.Equal) instead of bytes.Equal for secret/token data.
Title check	⚠️ Warning	Title focuses on azure-sdk bump but actual PR updates three dependencies including golang.org/x/net and golang.org/x/sys.	Update title to reflect all three dependency updates: 'build(deps): bump Azure SDK and golang.org/x dependencies' or list all three packages.

✅ Passed checks (9 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR #8676 changes only go.mod/go.sum and vendored dependency files; no Ginkgo test files/titles (It/Describe/Context) are in the diff, so none to flag.
Test Structure And Quality	✅ Passed	git diff origin/main..HEAD shows only go.mod/go.sum and vendored dependency files changed; no *_test.go (including Ginkgo) files were modified.
Topology-Aware Scheduling Compatibility	✅ Passed	PR #8676 changes only go.mod/go.sum and vendored dependencies (no manifests/operator/controller code), so it introduces no topology-dependent scheduling constraints.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR #8676 changes only go.mod, go.sum, and vendored dependency files (no Ginkgo e2e test code), so no new IPv4/disconnected-network assumptions were introduced.
Container-Privileges	✅ Passed	Repo working tree has no diff (git diff --name-only empty) and go.mod already contains azcore v1.22.0; no container/K8s manifest changes introducing privileged/hostNetwork flags were found.
No-Sensitive-Data-In-Logs	✅ Passed	PR only updates root go.mod/go.sum and vendored dependencies (no app code/log changes). Checked vendored azcore bearer-token policy: it sets Authorization header but has no log/Printf calls.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/azure-github-dependencies-4ae746bd53

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[muraee]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], muraee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [muraee]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@dependabot[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	8bb7701	link	true	/test images
ci/prow/verify-deps	8bb7701	link	true	/test verify-deps
ci/prow/security	8bb7701	link	true	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[hypershift-jira-solve-ci]

I now have the complete root cause analysis. Here's the final report:

Test Failure Analysis Complete

Job Information

• Prow Jobs: pull-ci-openshift-hypershift-main-verify-deps, pull-ci-openshift-hypershift-main-security, pull-ci-openshift-hypershift-main-images
• Build IDs: 2065240233774944256 (verify-deps), 2065240233741389824 (security), 2065240233657503744 (images)
• PR: build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.21.1 to 1.22.0 in the azure-github-dependencies group across 1 directory #8676 (verify-deps); build(deps): bump the misc-dependencies group across 1 directory with 3 updates #8463 (security, images — batch/mis-linked, same root cause)
• Failure Reason: resolving_inputs:resolving_release

Test Failure Analysis

Error

verify-deps: could not resolve inputs: could not determine inputs for step [release:n1minor]:
  failed to resolve release n1minor: failed to request latest release:
  server responded with 404: no tags exist within the release that satisfy the request

security: could not resolve inputs: could not determine inputs for step [release:n4minor]:
  failed to resolve release n4minor: ...same 404 error...

images: could not resolve inputs: could not determine inputs for step [release:latest-419]:
  failed to resolve release latest-419: ...same 404 error...

Summary

All three jobs failed before any test code executed — during the ci-operator input resolution phase. The hypershift CI configuration defines release references (n1minor → 4.22, n2minor → 4.21, n3minor → 4.20, n4minor → 4.19, latest-419 → 4.19) that require "Accepted" payload tags from the release controller. At the time these jobs ran (~01:10 UTC on 2026-06-12), the release streams 4.19.0-0.ci, 4.20.0-0.ci, 4.21.0-0.ci, and 4.22.0-0.ci had zero Accepted tags — only Pending/Ready tags from a batch created at ~01:01 UTC. This is a CI infrastructure issue unrelated to PR #8676's code changes (the Azure SDK dependency bump). The PR's code was never compiled or tested.

Root Cause

The OCP release controller CI release streams for versions 4.19 through 4.22 had no Accepted payload tags when these jobs ran. Each stream contained only a single tag created at ~01:01 UTC on 2026-06-12, still in Pending or Ready phase (not yet promoted to Accepted).

The ci-operator's /latest API endpoint requires at least one tag in Accepted phase. When no Accepted tag exists, it returns HTTP 404 with "no tags exist within the release that satisfy the request."

This appears to be a transient infrastructure condition — likely caused by a release stream reset, version bump, or payload pipeline delay. The 4.18 and 5.0 streams had Accepted tags and were working normally. The affected streams (4.19–4.22) each had only 1 tag total (vs. 5.0 which had 11), suggesting they were recently recreated or pruned and hadn't yet had a payload pass acceptance testing.

Key mapping of releases to streams:

Release Reference	OCP Version	Stream	Status at Failure Time
n1minor	4.22	4.22.0-0.ci	1 Pending tag, 0 Accepted
n2minor	4.21	4.21.0-0.ci	1 Pending tag, 0 Accepted
n3minor	4.20	4.20.0-0.ci	1 Ready tag, 0 Accepted
n4minor	4.19	4.19.0-0.ci	1 Pending tag, 0 Accepted
latest-419	4.19	4.19.0-0.ci	1 Pending tag, 0 Accepted

Note: The security and images jobs were actually testing PR #8463 (not #8676), but failed with the identical infrastructure issue.

Recommendations

1. Retry the jobs — This is a transient CI infrastructure issue. Once the release controller promotes payload tags to Accepted status for the 4.19–4.22 streams, the jobs will pass the input resolution phase. Use /retest to re-trigger.

2. No code changes needed — PR build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.21.1 to 1.22.0 in the azure-github-dependencies group across 1 directory #8676's dependency bump (azure-sdk-for-go/sdk/azcore 1.21.1 → 1.22.0) was never compiled or tested. The failure is entirely in CI infrastructure, before any build or test step ran.

3. Monitor release controller — Check https://amd64.ocp.releases.ci.openshift.org/ to verify when 4.19–4.22 CI streams have Accepted payloads before retesting.

4. If the issue persists — Escalate to the TRT/CI infrastructure team, as having zero Accepted tags across 4 consecutive release streams (4.19–4.22) is unusual and may indicate a systemic payload pipeline problem.

Evidence

Evidence	Detail
Failure phase	resolving_inputs:resolving_release — before any build/test step
verify-deps error	release:n1minor → 4.22.0-0.ci/latest → HTTP 404
security error	release:n4minor → 4.19.0-0.ci/latest → HTTP 404
images error	release:latest-419 → 4.19.0-0.ci/latest → HTTP 404
4.19.0-0.ci tags	1 tag (Pending), 0 Accepted
4.20.0-0.ci tags	1 tag (Ready), 0 Accepted
4.21.0-0.ci tags	1 tag (Pending), 0 Accepted
4.22.0-0.ci tags	1 tag (Pending), 0 Accepted
4.18.0-0.ci (working)	1 tag (Accepted) — confirms the /latest endpoint works when Accepted tags exist
5.0.0-0.ci (working)	11 tags (5 Accepted) — confirms main development stream is healthy
PR code tested	verify-deps: #8676; security/images: #8463 (batch-linked, not #8676)
Job ran at	~01:10 UTC, tags created at ~01:01 UTC — only ~9 minutes for acceptance pipeline

---

[dependabot]

Looks like github.com/Azure/azure-sdk-for-go/sdk/azcore is updatable in another way, so this is no longer needed.