[devantler]

🤖 Generated by the Agentic Engineer

Why

Automatic Go library updates keep failing the "modules are tidy" check, because the update bot leaves the old version's checksums behind. Two such updates are stuck right now (#5764, and #5775 which was just evicted from the merge queue for the same reason), and every future Go library update can hit the same wall and need a human-style repair.

What

Tells the update bot to tidy each Go module after it changes it, so its updates arrive already clean and can merge on their own.

No issue: trivial fix.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T13:23:19.529947Z	3472267	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 347226757c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 347226757c6059022109c2f65442dd5b0b5c4f31

• Evidence for the change: fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.5 #5764's merge-group-independent CI failed 🧹 Verify every tracked Go module is tidy because go.sum kept the talos/pkg/machinery v1.14.4 lines after the bump to v1.14.5 (run 41640022984); fix(deps): update module cel.dev/cel-go to v0.33.1 #5775 (cel-go) was evicted from the merge queue at 12:55Z by the same step. Both are Renovate gomod updates, and the config had no postUpdateOptions.
• Static checks: .github/renovate.json parses (jq), and the four Renovate-policy regressions that read it pass locally: test-kro-renovate-group.sh, test-velero-kopia-renovate-pin.sh, test-controller-helm-sdk-renovate-pin.sh, test-kyverno-1-20-cap.sh. CI is green at this head.
• Review: Codex reviewed this head with no findings; CodeRabbit is rate-limited (no-gate), Bugbot is maintainer-only.
• User evaluation (static trace): this file is consumed only by the hosted Renovate app, so there is nothing to execute locally. gomodTidy is Renovate's documented post-update option that runs go mod tidy after a gomod update. The observable proof comes after merge: the next Renovate update of fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.5 #5764/fix(deps): update module cel.dev/cel-go to v0.33.1 #5775 must arrive with a tidy go.sum and pass the tidiness step. That check is recorded as post-merge verification.

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 347226757c6059022109c2f65442dd5b0b5c4f31

• Tried as the update bot would: checked out the stuck update fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.5 #5764 (renovate/patch-talos, talos machinery 1.14.4 → 1.14.5) and ran go mod tidy, which is what postUpdateOptions: ["gomodTidy"] makes Renovate run after each Go update. It removed exactly the two stale machinery v1.14.4 lines from go.sum and changed nothing else — the leftovers that fail "🧪 Validate Complete Go Regressions" on fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.5 #5764. So future Go updates arrive already tidy.
• Review: Codex green at this head; no threads or findings.
• CI: all checks at this head pass; no conflict with main.
• Limit: the effect shows on Renovate's next Go update run, not in this PR's CI; fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.5 #5764 and fix(deps): update module cel.dev/cel-go to v0.33.1 #5775 still need their own rebase (Renovate rebases them once this merges).