refactor: replace hand-written test mocks with gomock-generated mocks

Introduce go.uber.org/mock (gomock) with mockgen code generation to
replace all hand-written mock structs across the test suite. This
eliminates duplicated mocks, establishes a single consistent mocking
pattern, and ensures mocks stay in sync with interface changes
automatically via make generate-mocks.

Infrastructure:
- Add mockgen via bingo with unversioned symlink for go generate
- Add generate-mocks Makefile target (go generate ./...)
- Wire into existing generate/verify targets for CI enforcement
- Centralized //go:generate directives in internal/testutil/mock/
  for exported interfaces (external and internal)
- Source-mode directives at interface definitions for unexported
  interfaces (trackingCache, sourcerer), output to _test.go files
  to keep gomock out of the production binary
- Mock helpers accept shared *gomock.Controller to avoid controller
  proliferation in nested mock scenarios

Rename MockPuller/MockCache to FakePuller/FakeCache in
image/fakes.go to clarify they are test fakes (preconfigured return
values), not mocks (interaction verification). Remove duplicated
FakeCertProvider from render/fake.go and rukpak/util/testing.go,
replaced by generated MockCertificateProvider. FakeBundleSource
(a function type, not an interface) is retained as-is.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: pedjak

.bingo/Variables.mk

@@ -77,6 +77,12 @@ $(KUBE_SCORE): $(BINGO_DIR)/kube-score.mod
 	@echo "(re)installing $(GOBIN)/kube-score-v1.20.0"
 	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=kube-score.mod -o=$(GOBIN)/kube-score-v1.20.0 "github.com/zegl/kube-score/cmd/kube-score"
 
+MOCKGEN := $(GOBIN)/mockgen-v0.6.0
+$(MOCKGEN): $(BINGO_DIR)/mockgen.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/mockgen-v0.6.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=mockgen.mod -o=$(GOBIN)/mockgen-v0.6.0 "go.uber.org/mock/mockgen"
+
 OPERATOR_SDK := $(GOBIN)/operator-sdk-v1.41.1
 $(OPERATOR_SDK): $(BINGO_DIR)/operator-sdk.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.

.bingo/mockgen.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.26.3
+
+require go.uber.org/mock v0.6.0 // mockgen

.bingo/mockgen.sum

@@ -0,0 +1,8 @@
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=

.bingo/variables.env

@@ -28,6 +28,8 @@ KIND="${GOBIN}/kind-v0.32.0"
 
 KUBE_SCORE="${GOBIN}/kube-score-v1.20.0"
 
+MOCKGEN="${GOBIN}/mockgen-v0.6.0"
+
 OPERATOR_SDK="${GOBIN}/operator-sdk-v1.41.1"
 
 OPM="${GOBIN}/opm-v1.60.0"

AGENTS.md

@@ -54,7 +54,15 @@ install and manage cluster extensions. The project follows a microservices archi
 - `containers_image_openpgp` - required for image handling
 
 **Tools (managed via .bingo/):**
-- controller-gen, golangci-lint, goreleaser, helm, kind, kustomize, setup-envtest, operator-sdk
+- controller-gen, golangci-lint, goreleaser, helm, kind, kustomize, mockgen, setup-envtest, operator-sdk
+
+**Test Mocking:**
+- **gomock** (`go.uber.org/mock`): Used for generated mock implementations. `//go:generate mockgen` directives
+  live in `internal/testutil/mock/generate.go` (external and internal exported interfaces) and at interface
+  definitions for internal unexported interfaces (source mode). Run `make generate-mocks` to regenerate.
+  All interface mocks should be gomock-generated. Test fakes that return preconfigured values without
+  interaction verification (e.g., `FakePuller`, `FakeCache` in `image/fakes.go`) are not mocks and stay
+  hand-written.
 
 ---
 
@@ -140,8 +148,11 @@ make manifests
 # Update CRDs and reference docs (when Go-based API definitions change)
 make update-crds crd-ref-docs
 
-# Generate code (DeepCopy methods)
+# Generate code (DeepCopy methods and mock implementations)
 make generate
+
+# Regenerate mock implementations only
+make generate-mocks
 ```
 
 ---

Makefile

@@ -58,6 +58,14 @@ endif
 # bingo manages consistent tooling versions for things like kind, etc.
 include .bingo/Variables.mk
 
+# mockgen is installed by bingo with a versioned name (mockgen-v0.6.0).
+# Redefine MOCKGEN to an unversioned symlink so that go generate can find it on PATH.
+_MOCKGEN_BINGO := $(MOCKGEN)
+MOCKGEN := $(ROOT_DIR)/bin/mockgen
+$(MOCKGEN): $(_MOCKGEN_BINGO)
+	@mkdir -p $(dir $@)
+	@ln -sf $< $@
+
 ifeq ($(origin KIND_CLUSTER_NAME), undefined)
 KIND_CLUSTER_NAME := operator-controller
 endif
@@ -201,8 +209,12 @@ manifests: update-crds $(MANIFESTS) $(HELM) #EXHELP Generate OLMv1 manifests
 	$(HELM) template olmv1 helm/olmv1 --values helm/tilt.yaml $(addprefix --set ,$(HELM_SETTINGS)) > /dev/null
 	$(HELM) template olmv1 helm/olmv1 --set "options.openshift.enabled=true" > /dev/null
 
+.PHONY: generate-mocks
+generate-mocks: $(MOCKGEN) #EXHELP Generate mock implementations for testing.
+	PATH="$(ROOT_DIR)/bin:$$PATH" go generate ./...
+
 .PHONY: generate
-generate: $(CONTROLLER_GEN) #EXHELP Generate code containing DeepCopy, DeepCopyInto, DeepCopyObject, and ApplyConfiguration type implementations.
+generate: $(CONTROLLER_GEN) generate-mocks #EXHELP Generate code containing DeepCopy, DeepCopyInto, DeepCopyObject, and ApplyConfiguration type implementations.
 	# Need to delete the files for them to be generated properly
 	@find api cmd hack internal -name "zz_generated.deepcopy.go" -not -path "*/vendor/*" -delete && rm -rf applyconfigurations
 	$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS) applyconfiguration:headerFile="hack/boilerplate.go.txt" paths="./api/..."

codecov.yml

@@ -7,6 +7,9 @@ codecov:
 # Configure the paths to include in coverage reports.
 # Exclude documentation, YAML configurations, and test files.
 coverage:
+  ignore:
+    - "internal/testutil/mock/**"
+    - "**/mock_*_gen*.go"
   status:
     project:
       default:

go.mod

@@ -31,6 +31,7 @@ require (
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
 	go.podman.io/image/v5 v5.40.0
+	go.uber.org/mock v0.6.0
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
 	golang.org/x/mod v0.37.0
 	golang.org/x/sync v0.21.0
@@ -205,7 +206,6 @@ require (
 	github.com/smallstep/pkcs7 v0.2.1 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
-	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/vbatts/tar-split v0.12.3 // indirect
 	github.com/vbauerster/mpb/v8 v8.12.0 // indirect

go.sum

@@ -584,6 +584,8 @@ go.podman.io/storage v1.63.0 h1:bj/pAWFhChbuBmejzno0iQLhU7FevGVXepRXm5pFGeA=
 go.podman.io/storage v1.63.0/go.mod h1:z4Z9K+7GhKjWL/Y1O17+4f8a1KGijVeC9hr3tymhSOs=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=