Update Go dependencies and actions/checkout

[Starttoaster]

Note

Medium Risk
Patch-level Kubernetes and controller-runtime bumps can affect reconciliation behavior in CI and production; smoke workflow lifecycle changes could affect PR gate reliability if background/cancel semantics differ from the old shell background.

Overview
Bumps Go module dependencies for the Kubernetes operator stack: k8s.io/api, apimachinery, and client-go from 0.36.0 → 0.36.2, sigs.k8s.io/controller-runtime from 0.24.0 → 0.24.1, and refreshed k8s.io/utils, kube-openapi, and related indirects (go-openapi/swag, golang.org/x/*, etc.), with matching go.sum updates.

Across build, release, test, and smoke workflows, actions/checkout is upgraded from v6 to v7.

The smoke workflow no longer shells out with make run &; it runs the operator as a background step (id: operator, background: true) and adds a final Stop operator step that cancels that background job for cleaner teardown.

^{Reviewed by Cursor Bugbot for commit 9f52a1d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	sigs.k8s.io/​controller-runtime@​v0.24.0 ⏵ v0.24.1	+1
	k8s.io/​apimachinery@​v0.36.0 ⏵ v0.36.2
	k8s.io/​client-go@​v0.36.0 ⏵ v0.36.2
	k8s.io/​api@​v0.36.0 ⏵ v0.36.2
	k8s.io/​utils@​v0.0.0-20260507154919-ff6756f316d2 ⏵ v0.0.0-20260626114624-be93311217bd	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang golang.org/x/tools is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → golang/github.com/onsi/gomega@v1.39.0 → golang/github.com/onsi/ginkgo/v2@v2.28.2 → golang/sigs.k8s.io/controller-runtime@v0.24.1 → golang/k8s.io/client-go@v0.36.2 → golang/k8s.io/apimachinery@v0.36.2 → golang/github.com/prometheus/client_golang@v1.23.2 → golang/golang.org/x/tools@v0.45.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/tools@v0.45.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang k8s.io/client-go is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → golang/k8s.io/client-go@v0.36.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/k8s.io/client-go@v0.36.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report