[briankane]

Stack 22/23 · next #978

Description of your changes

KubeVela's workflow forEach (and its item keys) landed in kubevela/pkg (#142, #154) and kubevela/workflow (#261, #273) after both moved to Go 1.27.1 and k8s 0.37 (controller-runtime 0.25), so VelaUX has to follow before it can use it.

• Pins: pkg a754071 and workflow 53204a3, which carry forEach keys (Feat: name forEach items by a key pkg#154, Feat: name forEach items by a key, and read the name as each.key workflow#273), prism dba7491 (its own 1.27 bump, Chore: bump Go to 1.27.1 and k8s to v0.37.1 prism#72, which no longer needs the apiserver-runtime replace). The replace block is the union of ours and KubeVela master's.

• Apply on the client. controller-runtime 0.25 adds Apply to client.Client and the sub-resource clients. Two of our wrappers embed the client, so Apply went straight through them:

  • the project query guard, which is meant to be read-only, could write with it;
  • the impersonating auth client sent it as VelaUX instead of the user.

  Both now override Apply, with tests (query_test.go, auth_client_test.go). Nothing calls Apply today; this keeps it that way safely.

• CI and images: Go 1.27.1 in the workflows and Dockerfiles, envtest on k8s 1.37.0, staticcheck v0.8.2, golangci-lint v2.14.0 (.golangci.yml was already in the v2 format; 1.60.1 could not read it), installed with go install.

• Lint. golangci-lint v2 reads the v2 .golangci.yml VelaUX already had, so it reports what 1.60.1 never could: 43 findings, about half already on main. Repeated strings become constants named for what they are (datastore sort and filter keys; the permission templates' scopes, effect, actions and View permission names; the definition type and data-flow kind source), or the existing ones where they mean the same (the expression type kinds). Three WriteString(fmt.Sprintf(...)) become fmt.Fprintf, and DefinitionBase.WorkloadType's deprecation notice gets its own paragraph; VelaUX still fills that field for clients that read it, marked.

• ReverseProxy.Director is deprecated from Go 1.26. Its four uses stay, marked: Rewrite changes which headers reach the upstream, which wants its own change with e2e behind it.

Fixes #

I have:

• Read and followed KubeVela's contribution process.
• Related Docs updated properly. In a new feature or configuration option, an update to the documentation is necessary.
• Run yarn lint to ensure the frontend changes are ready for review.
• Run make reviewableto ensure the server changes are ready for review.
• Added backport release-x.y labels to auto-backport this PR if necessary.

How has this code been tested

• Every Go package's unit tests on the bump; go vet, staticcheck and golangci-lint v2.14 clean.
• The Apply tests fail without the overrides (the guard's top-level Apply wrote; the auth client's ran as velaux).

Special notes for your reviewer

• KubeVela stays at the version Feat(rbac): view and manage permissions for every feature (21/21) #973 pins.

[briankane]

Closing: everything here landed on main via #978 (eca7137), which carried this PR's commit. Main's tree matches #978's head, and this PR's full diff is present on main as-is.