// Synchronize all tracked Go modules with the go-mod-consistency CI and refresh the root vendor tree. Use when go-mod-consistency fails, dependency bumps leave go.mod or go.sum stale, or the user asks to unblock module consistency, tidy all modules, or update vendor for the main module.
| name | sync-go-modules |
| description | Synchronize all tracked Go modules with the go-mod-consistency CI and refresh the root vendor tree. Use when go-mod-consistency fails, dependency bumps leave go.mod or go.sum stale, or the user asks to unblock module consistency, tidy all modules, or update vendor for the main module. |
Use this skill when the go-mod-consistency workflow fails or when a dependency
change needs repo-wide go.mod / go.sum reconciliation. The workflow mirrors
.github/workflows/go-mod-consistency.yaml and
.github/actions/discover-go-modules/action.yml, then also refreshes the main
module's vendor/ tree.
Replace <SKILL_DIR> with the path to this skill directory.
git status --short
If there are unrelated uncommitted changes, stop and report the conflict. If the
existing changes are the module/dependency edits you are intentionally syncing,
pass --allow-dirty to the helper.
python3 <SKILL_DIR>/scripts/sync_go_modules.py --repo .
For an intentionally dirty dependency branch:
python3 <SKILL_DIR>/scripts/sync_go_modules.py --repo . --allow-dirty
The helper discovers modules with the same tracked-file pathspec as CI:
git ls-files 'go.mod' '**/go.mod'
It then runs go mod tidy and go mod verify in every discovered module, with
GOTOOLCHAIN=local so local behavior does not drift through automatic toolchain
downloads.
(cd . && go mod vendor)
Use --skip-vendor only when the user explicitly asks to sync nested modules
without touching root vendored dependencies.
git diff --stat
Expected changes are scoped to tracked module files (go.mod / go.sum) and,
when the root module changed, vendor/ plus vendor/modules.txt. If the vendor
dependency set changed and the PR also needs license snapshots refreshed, rerun
the helper with --update-vendor-licenses or run make update-vendor-licenses.
That license update is adjacent to vendoring, but it is not part of the
go-mod-consistency workflow itself.
python3 <SKILL_DIR>/scripts/sync_go_modules.py --repo . --check-clean
--check-clean fails if the sync produces any repository diff, matching the CI
"Fail on uncommitted changes" step.
If the helper cannot be used, run the CI-equivalent loop manually:
mapfile -t go_mods < <(git ls-files 'go.mod' '**/go.mod')
mapfile -t modules < <(for mod in "${go_mods[@]}"; do dirname "$mod"; done | sort -u)
for m in "${modules[@]}"; do
echo ">> go mod tidy (${m})"
(cd "${m}" && GOTOOLCHAIN=local go mod tidy)
echo ">> go mod verify (${m})"
(cd "${m}" && GOTOOLCHAIN=local go mod verify)
done
GOTOOLCHAIN=local go mod vendor
git diff --stat
Do not use find . -name go.mod for this repo. Hidden local worktrees and other
untracked directories can contain extra modules that CI does not discover.
Diagnose and unblock failed Dependabot pull requests in cloud-provider-azure by classifying CI failures, syncing Go modules, retesting quota-flaked e2e jobs, and updating PR status. Use when a Dependabot PR fails go-mod-consistency, pull-cloud-provider-azure-e2e jobs, or dependency/toolchain CI.
Generate or update the documentation-site release note for a given tag, commit it on a branch, push it to a writable remote, and open a GitHub PR to the docs branch. Use when the user wants to create or update release notes, generate a changelog for a tag, or mentions release notes, docs PR, or documentation for a release.
Prepare and publish a stable release in two phases by reusing the shared release-tag and release-note-doc-pr skills, building artifacts in GitHub, generating release notes and draft releases locally, validating release assets, and controlling latest-release status explicitly. Use when the user wants to perform a full release, publish a new version, or mentions releasing, shipping a version, or the end-to-end release process.
Scan a built container image with Trivy, classify fixable Go-module and base-image CVEs, apply dependency and Dockerfile fixes, and verify the result with file checks and an optional image rescan. Use when the user wants to fix CVEs in a container image, scan for vulnerabilities, or mentions Trivy, CVE remediation, image security, or dependency vulnerabilities.
Cherry-pick a merged pull request onto a release branch with Prow-style branch naming, manual conflict resolution, targeted validation, and GitHub PR creation. Use when the user wants to backport a PR, cherry-pick a commit to a release branch, or mentions cherry-pick, backport, or porting a fix to an older release.
Create and optionally push the next Kubernetes-style release tag (vX.Y.Z) from a release-X.Y branch by resolving the remote branch tip, computing the next patch tag, and tagging the commit directly without checking out the branch. Use when the user wants to tag a release, create a version tag, or mentions release tagging, cutting a release, or bumping a patch version.