test(deps): name a talos/machinery version skew instead of failing inside talos

[devantler]

Why

The Talos SDK and its companion config module ship together and have to stay on the same version. Other dependencies can quietly move one of them forward without the other. When that happens, the build fails deep inside Talos's own code with an error that never says the two versions drifted apart, so every run has to work out the cause again from scratch.

What

Adds a check that fails as soon as the two versions differ. Its message names both versions and the command that fixes the drift. It already catches the drift on the open Talos group update.

Upgrading Talos itself and adapting to its new config layout remain blocked by the Kubernetes 0.37 wall (#7167 / #6728). This change delivers only the issue's anti-recurrence guard.

Part of #6734

🤖 Generated with Claude Code

https://claude.ai/code/session_011Aut24ni8XbKPYyY5mYrbb

---

Generated by Claude Code

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence at head 7d34b6f2854bc030600c28e5b2ed4689fa89fad6

RED. The table tests were first written against a stub checker that returned nil. Six cases failed: machinery raised alone, talos raised alone, a replace that introduces a skew, local and fork replaces, and a missing module. After the tests were restructured, I re-ran RED with a go test -overlay mutant that disables only the version comparison. It fails exactly the four skew cases, including machinery_pseudo-version_past_the_talos_tag and versioned_replace_introduces_skew.

GREEN. go test ./internal/depcontract/ -count=1 passes: 15 PASS lines across the real go.mod check and 13 table cases. main's go.mod pins both modules at v1.14.0-alpha.2, so the real check passes today.

Real behaviour. I checked out the open talos group PR #6826 at a4971d2 in a throwaway worktree, copied this package in, and ran the real-go.mod test. It fails with the intended message: github.com/siderolabs/talos is v1.15.0-alpha.0 but github.com/siderolabs/talos/pkg/machinery is v1.15.0-alpha.0.0.20260908133727-5c5fd29e95f7 … go get …@<version> …@<version> (ksail#6734). That skew is real: omni/client 1.12.0 pulled machinery past the talos tag even though Dependabot grouped the three modules. Controls: the heads of #6845 (a8228c6, both at the same pseudo-version) and #7127 (4bb2661, both alpha.2) have equal versions, so the check leaves them alone.

Validation. go vet ./internal/depcontract/ passes. golangci-lint run ./internal/depcontract/... reports 0 issues. The binary was v2.13.2 built with go1.26.8, because the preinstalled one refuses this repository's Go 1.26 target. Prettier --check passes on .github/dependabot.yaml, whose only change is a comment pointing at the new check. I did not run the full go test ./...: the change is a new, isolated, test-only package and nothing imports it.

Why a test rather than a replace. A replace pinning machinery to talos's version would stop Dependabot moving machinery at all. It would also hide an upstream requirement for a newer machinery rather than surface it. A check keeps both modules updatable and makes the failure name its cause.

---

Generated by Claude Code

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence at head a60bc9acca6cab878f541b0301ed6a85468f7fd6

Independent re-run by the reviewer (not the author), go1.26.6, at the current head:

• GREEN: go test ./internal/depcontract/ -count=1 passes, including the real-go.mod check TestTalosAndMachineryMoveInLockstep (both modules at v1.14.0-alpha.2 on this head and on main at 18329f78).
• RED on a real skew: the check run against the go.mod of the open talos group PR chore(deps): bump the talos group across 1 directory with 3 updates #6826 (a4971d2) fails with the intended message: github.com/siderolabs/talos is v1.15.0-alpha.0 but github.com/siderolabs/talos/pkg/machinery is v1.15.0-alpha.0.0.20260908133727-5c5fd29e95f7 … move both to one version, e.g. go get …@<version> …@<version> (ksail#6734). The same harness against main's go.mod passes (control).
• Mutation: a go test -overlay mutant that disables only the version comparison fails exactly four cases (machinery_raised_alone, talos_raised_alone, machinery_pseudo-version_past_the_talos_tag, versioned_replace_introduces_skew); every other case still passes, so the table tests pin the comparison itself.
• CI: all 54 check runs at this head are success or skipped; the 🧪 Test job (run 35821218994) ran the package.

The change is test-only: its observable behaviour is the failure message, which the RED run above exercises against a real skewed go.mod.

---

Generated by Claude Code

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

---

Generated by Claude Code

[coderabbitai]

@devantler I’ll review the current changes in #7199, including the version-skew check and its tests.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ce8e7437-4964-410f-9cf2-4dbf40714b60

📥 Commits

Reviewing files that changed from the base of the PR and between 9715938 and a60bc9a.

📒 Files selected for processing (3)

• .github/dependabot.yaml
• internal/depcontract/contract.go
• internal/depcontract/talos_lockstep_test.go

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (3)

Use Go 1.26.1 or newer, matching the version declared in `go.mod`.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• internal/depcontract/contract.go
• internal/depcontract/talos_lockstep_test.go

Generated files must not be hand-edited; run `make generate` as the canonical regeneration command.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• internal/depcontract/contract.go
• internal/depcontract/talos_lockstep_test.go

Add regression tests for confident bug fixes and run flaky-test candidates repeatedly with `go test -run -count=10 ./...`.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• internal/depcontract/talos_lockstep_test.go

🔇 Additional comments (3)

internal/depcontract/contract.go (1)

1-3: LGTM!

internal/depcontract/talos_lockstep_test.go (1)

1-284: LGTM!

.github/dependabot.yaml (1)

57-58: LGTM!

---

📝 Walkthrough

Walkthrough

The change adds tests that compare the effective versions of the Talos and Talos machinery modules in go.mod. The tests cover missing requirements, version mismatches, and replacement directives. A package comment and two Dependabot comments describe the check. The Dependabot configuration has no functional changes.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to a60bc

This change adds a test that fails with a clear message when the Talos SDK and Talos machinery module versions drift apart. It also adds explanatory comments. Runtime behavior and shipped code are unchanged, so there is no user or production impact, and the change is ready to merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly describes the main change: adding a dependency test that identifies Talos and machinery version skew instead of exposing a deeper Talos build failure.
Description check	✅ Passed	The description explains the dependency version mismatch, the new check, its error message, and the scope of the change. It is directly related to the changeset.

Full details: Docstring Coverage

Explanation

Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (1 skipped: 1 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}