chore(deps): bring dependencies on par with dependency-controller

[BergCyrill]

Brings quota-controller's dependencies on par with dependency-controller (or newer for some of the packages).

• k8s.io/* 0.35.4 → 0.36.3
• controller-runtime / multicluster-runtime 0.23.3 → 0.24.1
• kcp-dev/sdk 0.31.2 → 0.32.3, multicluster-provider 0.7.1 → 0.8.0
• golang.org/x/net 0.60.0, x/text 0.42.0 (fixes GO-2026-6603, -6610, -6611, -6612, -6617, GO-2026-5970)
• ginkgo 2.33.1, gomega 1.44.0
• Go 1.27.2 (go.mod, flake, Dockerfile)
• golangci-lint 2.14.0 (embedlit disabled, deprecated Requeue replaced)
• controller-gen 0.21.0, setup-envtest release-0.24, envtest 1.36.2
• dev-kit common.mk v2.2.0
• GitHub Actions pins and distroless digest bumped
• Renovate: cap k8s < 0.37 and controller-runtime / multicluster-runtime < 0.25 (no multicluster-runtime / kcp support yet)

Supersedes #21, #34, #35, #36, #37, #43, #44, #45, #46, #47. Close #39, #41 (exceed the cap).

Summary by CodeRabbit

• Bug Fixes

  • Reconciliation now waits briefly before retrying when an API export’s identity is not yet available, rather than retrying immediately.

• Chores

  • Updated Go and Kubernetes-related components and refreshed development and build tooling.
  • Updated the container images used for builds and runtime.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: fc3694df-f3f1-4226-b54f-768a5191e590

📥 Commits

Reviewing files that changed from the base of the PR and between d4d932d and de672a3.

⛔ Files ignored due to path filters: 3

• flake.lock is excluded by !**/*.lock
• go.sum is excluded by !**/*.sum
• tools.lock is excluded by !**/*.lock

📒 Files selected for processing: 15

• .github/workflows/docker.yaml
• .github/workflows/fuzz.yaml
• .github/workflows/golang.yaml
• .github/workflows/helm-lint.yaml
• .github/workflows/helm-publish.yaml
• .github/workflows/ossf-scorecard.yml
• .golangci.yaml
• Dockerfile
• Makefile
• config/crds/quota.opendefense.cloud_consumptionquotas.yaml
• config/crds/quota.opendefense.cloud_quotausages.yaml
• flake.nix
• go.mod
• internal/controller/consumptionquota_controller.go
• renovate.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The pull request adds a five-second requeue when an APIExport has no identity hash. It also updates workflow actions, Go and container toolchains, dependencies, development settings, CRD version annotations, linter settings, and Renovate version limits.

Changes: APIExport identity hash requeue

Layer / File(s)	Summary
Timed requeue for missing identity hash internal/controller/consumptionquota_controller.go	When the APIExport identity hash is empty, reconciliation now requests a requeue after five seconds instead of immediately.

Project version updates

Layer / File(s)	Summary
Workflow action versions .github/workflows/*	The Docker, fuzz, Go, Helm, and Scorecard workflows use updated pinned actions. The configured workflow behavior remains unchanged as described in the summaries.
Toolchain and dependency versions Dockerfile, Makefile, .golangci.yaml, flake.nix, go.mod, config/crds/*	The Go toolchain, container images, development tools, Go dependencies, and CRD generator annotations are updated. The modernize configuration disables embedlit.
Renovate version limits renovate.json	New rules limit Kubernetes, controller-runtime, multicluster-runtime, and controller-gen versions. A git-refs rule limits allowed controller-runtime release branches.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Suggested reviewers: ducke

Merge Risk: ⚪ Minimal · up to de672

The timed requeue and dependency limits align with the stated project behavior and compatibility range. No concrete merge-blocking issue is established; normal build and test checks remain appropriate.

Pre-merge checks: 3 · 2

Failed checks: 2 warnings

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #39 requires sigs.k8s.io/controller-tools/cmd/controller-gen v0.22.0. The reviewed changes update controller-gen and the CRD annotations only to v0.21.0. renovate.json also caps `controlle…	Update controller-gen to v0.22.0 and regenerate the affected CRDs. Verify compatibility with the required Kubernetes and Go versions. Preserve support for the long-form Required and Optional markers.
Out of Scope Changes check		Issue #39 covers the controller-gen v0.22.0 upgrade and its compatibility changes. The pull request also changes reconciliation retry behavior in internal/controller/consumptionquota_controller.go…	Remove changes unrelated to the controller-gen upgrade, or link each change to an active issue that requires it.

Passed checks: 3 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the primary change: updating dependencies to align with dependency-controller. It is concise and specific.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

Full details: Linked Issues check

Explanation

Issue #39 requires sigs.k8s.io/controller-tools/cmd/controller-gen v0.22.0. The reviewed changes update controller-gen and the CRD annotations only to v0.21.0. renovate.json also caps controller-gen below v0.22.0. The required v0.22.0 upgrade is not present.

Full details: Out of Scope Changes check

Explanation

Issue #39 covers the controller-gen v0.22.0 upgrade and its compatibility changes. The pull request also changes reconciliation retry behavior in internal/controller/consumptionquota_controller.go, GitHub Actions pins, the distroless image digest, lint configuration, unrelated dependency versions, and Renovate caps. These changes have no demonstrated connection to issue #39.

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}