dependabot: fails to handle creation of PRs with incompatible go module version updates

[brianmcarey]

dependabot should add +incompatible to go module versions that do not start with v0 or v1

Without this errors occur when parsing go.mod leading to dependabot failing to create the update PR.

{"level":"panic","msg":"go.mod:39:2: require github.com/docker/docker: version "v24.0.7" invalid: should be v0 or v1, not v24","robot":"dependabot","time":"2024-01-30T13:23:52Z"}

https://prow.ci.kubevirt.io/view/gs/kubevirt-prow/logs/periodic-project-infra-dependabot-update/1752320530951704576

[dhiller]

While trying to fix this we noticed that there's a go get ./... step missing before the make gazelle-update-repos, so gazelle can add the new dependencies that are introduced after the bumps.

(since the docker/docker cve was removed manually the latest build didn't stumble over this any more)

Now we are having problems with the new external dependency @com_cloudflare_circl which misses external header files. We found this bazel gazelle issue where folks reported they patched some files to make up for missing stuff.

[brianmcarey]

/good-first-issue

Recent failure: https://prow.ci.kubevirt.io/view/gs/kubevirt-prow/logs/periodic-project-infra-dependabot-update/1770787529876836352

[kubevirt-bot]

@brianmcarey:
This request has been marked as suitable for new contributors.

Guidelines

• No Barrier to Entry
• Clear Task
• Solution Explained
• Provides Context
• Identifies Relevant Code
• Gives Examples
• Ready to Test
• Goldilocks priority
• Up-To-Date

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-good-first-issue command.

In response to this:

/good-first-issue

Recent failure: https://prow.ci.kubevirt.io/view/gs/kubevirt-prow/logs/periodic-project-infra-dependabot-update/1770787529876836352

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kubevirt-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[brianmcarey]

/remove-lifecycle stale

[kubevirt-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[kubevirt-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

/lifecycle rotten