// Synchronize all tracked Go modules with the go-mod-consistency CI and refresh the root vendor tree. Use when go-mod-consistency fails, dependency bumps leave go.mod or go.sum stale, or the user asks to unblock module consistency, tidy all modules, or update vendor for the main module.
Diagnose and unblock failed Dependabot pull requests in cloud-provider-azure by classifying CI failures, syncing Go modules, retesting quota-flaked e2e jobs, and updating PR status. Use when a Dependabot PR fails go-mod-consistency, pull-cloud-provider-azure-e2e jobs, or dependency/toolchain CI.
Generate or update the documentation-site release note for a given tag, commit it on a branch, push it to a writable remote, and open a GitHub PR to the docs branch. Use when the user wants to create or update release notes, generate a changelog for a tag, or mentions release notes, docs PR, or documentation for a release.
Prepare and publish a stable release in two phases by reusing the shared release-tag and release-note-doc-pr skills, building artifacts in GitHub, generating release notes and draft releases locally, validating release assets, and controlling latest-release status explicitly. Use when the user wants to perform a full release, publish a new version, or mentions releasing, shipping a version, or the end-to-end release process.
Scan a built container image with Trivy, classify fixable Go-module and base-image CVEs, apply dependency and Dockerfile fixes, and verify the result with file checks and an optional image rescan. Use when the user wants to fix CVEs in a container image, scan for vulnerabilities, or mentions Trivy, CVE remediation, image security, or dependency vulnerabilities.
Cherry-pick a merged pull request onto a release branch with Prow-style branch naming, manual conflict resolution, targeted validation, and GitHub PR creation. Use when the user wants to backport a PR, cherry-pick a commit to a release branch, or mentions cherry-pick, backport, or porting a fix to an older release.
Create and optionally push the next Kubernetes-style release tag (vX.Y.Z) from a release-X.Y branch by resolving the remote branch tip, computing the next patch tag, and tagging the commit directly without checking out the branch. Use when the user wants to tag a release, create a version tag, or mentions release tagging, cutting a release, or bumping a patch version.
| name | sync-go-modules |
| description | Synchronize all tracked Go modules with the go-mod-consistency CI and refresh the root vendor tree. Use when go-mod-consistency fails, dependency bumps leave go.mod or go.sum stale, or the user asks to unblock module consistency, tidy all modules, or update vendor for the main module. |
Use this skill when the go-mod-consistency workflow fails or when a dependency
change needs repo-wide go.mod / go.sum reconciliation. The workflow mirrors
.github/workflows/go-mod-consistency.yaml and
.github/actions/discover-go-modules/action.yml, then also refreshes the main
module's vendor/ tree.
Replace <SKILL_DIR> with the path to this skill directory.
git status --short
If there are unrelated uncommitted changes, stop and report the conflict. If the
existing changes are the module/dependency edits you are intentionally syncing,
pass --allow-dirty to the helper.
python3 <SKILL_DIR>/scripts/sync_go_modules.py --repo .
For an intentionally dirty dependency branch:
python3 <SKILL_DIR>/scripts/sync_go_modules.py --repo . --allow-dirty
The helper discovers modules with the same tracked-file pathspec as CI:
git ls-files 'go.mod' '**/go.mod'
It then runs go mod tidy and go mod verify in every discovered module, with
GOTOOLCHAIN=local so local behavior does not drift through automatic toolchain
downloads.
(cd . && go mod vendor)
Use --skip-vendor only when the user explicitly asks to sync nested modules
without touching root vendored dependencies.
git diff --stat
Expected changes are scoped to tracked module files (go.mod / go.sum) and,
when the root module changed, vendor/ plus vendor/modules.txt. If the vendor
dependency set changed and the PR also needs license snapshots refreshed, rerun
the helper with --update-vendor-licenses or run make update-vendor-licenses.
That license update is adjacent to vendoring, but it is not part of the
go-mod-consistency workflow itself.
python3 <SKILL_DIR>/scripts/sync_go_modules.py --repo . --check-clean
--check-clean fails if the sync produces any repository diff, matching the CI
"Fail on uncommitted changes" step.
If the helper cannot be used, run the CI-equivalent loop manually:
mapfile -t go_mods < <(git ls-files 'go.mod' '**/go.mod')
mapfile -t modules < <(for mod in "${go_mods[@]}"; do dirname "$mod"; done | sort -u)
for m in "${modules[@]}"; do
echo ">> go mod tidy (${m})"
(cd "${m}" && GOTOOLCHAIN=local go mod tidy)
echo ">> go mod verify (${m})"
(cd "${m}" && GOTOOLCHAIN=local go mod verify)
done
GOTOOLCHAIN=local go mod vendor
git diff --stat
Do not use find . -name go.mod for this repo. Hidden local worktrees and other
untracked directories can contain extra modules that CI does not discover.