build(deps): bump internal pkg pin to a pseudo-version on main

[cristim]

Summary

Bump the internal pkg pin in every consumer module to v0.0.0-20261006002706-ea61b58e4b07 (ea61b58, the latest pkg commit on main, an ancestor of origin/main).

Module	Old pin	New pin
ci_cd_sanity_tests	43ab778 (pre-squash split-branch, NOT on main)	ea61b58
providers/aws	de46f76 (on main, behind)	ea61b58
providers/azure	b3b4cb5 (on main, behind)	ea61b58
providers/gcp	b3b4cb5 (on main, behind)	ea61b58

The issue text says providers/* still pin 43ab778; that was already partly fixed. Only ci_cd_sanity_tests still pinned the unreachable commit. The providers were on-main but stale, so they did not get later pkg fixes.

Behaviour brought in by the bump

pkg commits since the old providers/azure and providers/gcp pin (git log b3b4cb5e3d80..ea61b58 -- pkg, 15 commits), including:

• fix(provider): surface factory errors from credential detection #236 surface factory errors from credential detection
• fix(httpclient): block NAT64, 6to4 and IPv4-compatible metadata forms and unspecified addresses #234 block NAT64, 6to4, IPv4-compatible metadata forms and unspecified addresses
• fix(recfilter): count Redis against Valkey in normalized units and warn on unknown ElastiCache engines #232 Redis/Valkey normalized units in recfilter
• fix(ec2): use typed tenancy and class inputs and drop stale default text #231 typed tenancy and class inputs in ec2
• fix(config): honour explicit zero scorer values and reject non-positive idempotency window #230 honour explicit zero scorer values, reject non-positive idempotency window
• fix(httpclient): block the GCP IPv6 metadata address fd20:ce::254 #222 block the GCP IPv6 metadata address fd20:ce::254
• fix(recfilter): drop a non-positive-Count recommendation instead of scaling it #221 drop a non-positive-Count recommendation instead of scaling it
• fix(recfilter): dedupe Redis OSS and Valkey ElastiCache nodes directionally #208 directional Redis OSS/Valkey dedupe
• chore(config): remove unreachable --dry-run flag handling #206, fix(recfilter): drop RI recs with invalid target-coverage inputs #204, fix(exchange): refuse RI-exchange quotes not denominated in USD #203, fix(config): keep the dry-run default when YAML omits dry_run #202, sec(httpclient): block Azure WireServer and Alibaba metadata addresses #192 (config, recfilter, exchange USD check, Azure WireServer/Alibaba block)
• fix(recfilter): preserve exact expiry coverage during RI sizing #175, fix(aws): scope savings plan coverage to layer geography #174 (aws expiry coverage, savings plan geography scope)

providers/aws gets the 13 commits after de46f76. ci_cd_sanity_tests moves from the pre-squash commit to current main.

Verification

Per module, with GOWORK=off, GOTOOLCHAIN=go1.26.6: go build ./..., go vet ./..., go test ./..., golangci-lint run ./..., gocyclo -over 10 -ignore "_test\.go" ., go mod tidy -diff, go mod verify all exit 0 for aws, azure, gcp and ci_cd_sanity_tests. govulncheck ./... exits 0 in each (azure, gcp and ci_cd_sanity_tests report unreachable vulnerabilities in required modules only, same as before). go list -m shows the new pin in each module, and the module cache copy contains the #222 fd20:ce::254/128 entry in httpclient. No API breaks or compile fixes were needed; the diff is go.mod/go.sum only.

A pin can only reference a commit already on main, so after the next pkg change the pins lag by one commit again; this PR does not change that process.

Closes #129

Summary by CodeRabbit

• Chores
  • Updated the cloud provider components used across AWS, Azure, and GCP integrations.
  • These updates do not change any user-facing features or behavior.

[cristim]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-go/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 93d3a7a8-9a9c-4eb1-ad5e-9e9491f704b0

📥 Commits

Reviewing files that changed from the base of the PR and between 8dab581 and 0c95939.

⛔ Files ignored due to path filters (4)

• ci_cd_sanity_tests/go.sum is excluded by !**/*.sum
• providers/aws/go.sum is excluded by !**/*.sum
• providers/azure/go.sum is excluded by !**/*.sum
• providers/gcp/go.sum is excluded by !**/*.sum

📒 Files selected for processing (4)

• ci_cd_sanity_tests/go.mod
• providers/aws/go.mod
• providers/azure/go.mod
• providers/gcp/go.mod

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

Four Go modules update their github.com/LeanerCloud/cloud-commitments-go/pkg dependency to pseudo-version v0.0.0-20261006002706-ea61b58e4b07.

Changes

Internal pkg dependency pins

Layer / File(s)	Summary
Align pkg module pins providers/aws/go.mod, providers/azure/go.mod, providers/gcp/go.mod, ci_cd_sanity_tests/go.mod	All four modules now require github.com/LeanerCloud/cloud-commitments-go/pkg at v0.0.0-20261006002706-ea61b58e4b07.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 0c959

The four modules now share a pkg revision that is on main, with matching dependency checksums. No concrete merge-blocking risk is indicated.

🚥 Pre-merge checks | ✅ 4 | ❓ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	[129] The change summary reports that all four modules now pin pkg to v0.0.0-20261006002706-ea61b58e4b07, and the PR description reports successful go mod tidy -diff and GOWORK=off builds. How…	Reviewable evidence is needed to establish that go mod tidy leaves each module's dependency files consistent. The four go.sum files are excluded from this review.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The reported changes update pkg pins in ci_cd_sanity_tests and the AWS, Azure, and GCP provider modules. These changes directly implement issue #129. No unrelated changes are reported.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: updating the internal package dependency pin to a pseudo-version on main.

Full details: Linked Issues check

Explanation

[129] The change summary reports that all four modules now pin pkg to v0.0.0-20261006002706-ea61b58e4b07, and the PR description reports successful go mod tidy -diff and GOWORK=off builds. However, the required tidy state cannot be independently checked because ci_cd_sanity_tests/go.sum, providers/aws/go.sum, providers/azure/go.sum, and providers/gcp/go.sum are excluded by the !**/*.sum rule.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}