chore(hack): avoid updating some unversioned modules

hack/lib/modules.sh

@@ -85,57 +85,63 @@ modules::get_indirect_deps() {
 
 # Update modules in batch
 # Set GOPROXY=direct to avoid https://github.com/golang/go/issues/49111
-# Args: dry_run patch_only modules...
+# Args: dry_run version_query modules...
+#   - version_query: "latest" or "patch"
 modules::update_modules_batch() {
     local dry_run=$1
-    local patch_only=$2
+    local version_query=$2
     shift 2
     local modules=("$@")
 
     if [[ ${#modules[@]} -eq 0 ]]; then
         return 0
     fi
 
-    local flag="-u"
-    local mode="latest"
-    if [[ "$patch_only" == "true" ]]; then
-        flag="-u=patch"
-        mode="patch only"
-    fi
+    # Build module specs with version query (e.g., module@latest or module@patch)
+    local module_specs=()
+    for module in "${modules[@]}"; do
+        module_specs+=("${module}@${version_query}")
+    done
 
-    modules::info "  Updating ${#modules[@]} modules ($mode): ${modules[*]}"
+    modules::info "  Updating ${#modules[@]} modules (@${version_query}): ${modules[*]}"
 
     if [[ "$dry_run" == "true" ]]; then
-        echo "    [DRY-RUN] GOPROXY=direct go get $flag ${modules[*]}"
+        echo "    [DRY-RUN] GOPROXY=direct go get ${module_specs[*]}"
     else
-        if ! GOPROXY=direct go get "$flag" "${modules[@]}" 2>&1; then
+        if ! GOPROXY=direct go get "${module_specs[@]}" 2>&1; then
             modules::error "    Some modules failed to update"
             return 1
         fi
     fi
 }
 
 # Update all modules in a directory
-# Args: dir dry_run patch_prefixes_str allowed_prefixes_str
+# Args: dir dry_run patch_prefixes_str allowed_prefixes_str denied_prefixes_str
 #   - dir: directory containing go.mod
 #   - dry_run: "true" or "false"
 #   - patch_prefixes_str: space-separated prefixes for patch-only updates
 #   - allowed_prefixes_str: space-separated prefixes to filter modules (only update matching modules, empty means all direct deps)
+#   - denied_prefixes_str: space-separated prefixes to exclude modules (if a module matches both allowed and denied, it will NOT be updated)
 modules::update_dir() {
     local dir=$1
     local dry_run=$2
     local patch_prefixes_str=$3
     local allowed_prefixes_str=$4
+    local denied_prefixes_str=${5:-}
 
     # Convert prefix strings to arrays
     local patch_prefixes=()
     local allowed_prefixes=()
+    local denied_prefixes=()
     if [[ -n "$patch_prefixes_str" ]]; then
         read -ra patch_prefixes <<< "$patch_prefixes_str"
     fi
     if [[ -n "$allowed_prefixes_str" ]]; then
         read -ra allowed_prefixes <<< "$allowed_prefixes_str"
     fi
+    if [[ -n "$denied_prefixes_str" ]]; then
+        read -ra denied_prefixes <<< "$denied_prefixes_str"
+    fi
 
     if [[ ! -f "$dir/go.mod" ]]; then
         modules::error "No go.mod found in $dir"
@@ -163,13 +169,22 @@ modules::update_dir() {
     # Helper function to categorize a module
     categorize_module() {
         local dep=$1
+        # Skip if module matches any denied prefix
+        if [[ ${#denied_prefixes[@]} -gt 0 ]] && modules::match_prefix "$dep" "${denied_prefixes[@]}"; then
+            modules::info "    Skipping denied module: $dep"
+            return 0
+        fi
         if [[ ${#patch_prefixes[@]} -gt 0 ]] && modules::match_prefix "$dep" "${patch_prefixes[@]}"; then
             patch_modules+=("$dep")
         else
             latest_modules+=("$dep")
         fi
     }
 
+    if [[ ${#denied_prefixes[@]} -gt 0 ]]; then
+        modules::info "  Excluding modules by denied prefixes: ${denied_prefixes[*]}"
+    fi
+
     if [[ ${#allowed_prefixes[@]} -gt 0 ]]; then
         # Filter mode: only update modules matching allowed prefixes (both direct and indirect)
         modules::info "  Filtering modules by allowed prefixes: ${allowed_prefixes[*]}"
@@ -206,15 +221,15 @@ modules::update_dir() {
         fi
     fi
 
-    # Batch update modules
+    # Update modules
     if [[ ${#latest_modules[@]} -gt 0 ]]; then
-        if ! modules::update_modules_batch "$dry_run" "false" "${latest_modules[@]}"; then
+        if ! modules::update_modules_batch "$dry_run" "latest" "${latest_modules[@]}"; then
             popd > /dev/null
             return 1
         fi
     fi
     if [[ ${#patch_modules[@]} -gt 0 ]]; then
-        if ! modules::update_modules_batch "$dry_run" "true" "${patch_modules[@]}"; then
+        if ! modules::update_modules_batch "$dry_run" "patch" "${patch_modules[@]}"; then
             popd > /dev/null
             return 1
         fi

hack/update-modules.sh

@@ -21,6 +21,7 @@
 # Options:
 #   -p, --patch-only PREFIX    Only update patch version for modules matching PREFIX (can be specified multiple times)
 #   -a, --allowed PREFIX       Only update modules matching PREFIX (can be specified multiple times, includes both direct and indirect)
+#   -x, --denied PREFIX        Exclude modules matching PREFIX (can be specified multiple times, takes precedence over allowed)
 #   -d, --dir DIR              Directory containing go.mod to update (can be specified multiple times, default: all go.mod files)
 #   -n, --dry-run              Show what would be done without making changes
 #   -h, --help                 Show this help message
@@ -38,8 +39,11 @@
 #   # Only update modules matching specific prefixes (both direct and indirect)
 #   ./hack/update-modules.sh -a golang.org -a github.com/aws
 #
+#   # Exclude specific modules from updates
+#   ./hack/update-modules.sh -a golang.org -x golang.org/x/net
+#
 #   # Combine options
-#   ./hack/update-modules.sh -p k8s.io -p sigs.k8s.io -a golang.org -d .
+#   ./hack/update-modules.sh -p k8s.io -p sigs.k8s.io -a golang.org -x golang.org/x/net -d .
 
 set -o errexit
 set -o nounset
@@ -73,6 +77,12 @@ ALLOWED_PREFIXES=(
     "github.com/golangci/golangci-lint/v2"
     "github.com/apache/skywalking-eyes"
 )
+# DENIED_PREFIXES: Modules matching these prefixes will NOT be updated, even if they match ALLOWED_PREFIXES.
+DENIED_PREFIXES=(
+    "k8s.io/gengo/v2"
+    "k8s.io/kube-openapi"
+    "k8s.io/utils"
+)
 DIRS=()
 DRY_RUN=false
 
@@ -102,6 +112,14 @@ parse_args() {
                 ALLOWED_PREFIXES+=("$2")
                 shift 2
                 ;;
+            -x|--denied)
+                if [[ -z "${2:-}" ]]; then
+                    modules::error "Option -x/--denied requires a PREFIX argument"
+                    usage
+                fi
+                DENIED_PREFIXES+=("$2")
+                shift 2
+                ;;
             -d|--dir)
                 if [[ -z "${2:-}" ]]; then
                     modules::error "Option -d/--dir requires a directory argument"
@@ -158,6 +176,13 @@ main() {
         modules::info "No allowed prefixes specified, updating all direct dependencies"
     fi
 
+    if [[ ${#DENIED_PREFIXES[@]} -gt 0 ]]; then
+        modules::info "Denied module prefixes (excluded):"
+        for prefix in "${DENIED_PREFIXES[@]}"; do
+            echo "    - $prefix"
+        done
+    fi
+
     # Determine directories to update
     local dirs_to_update=()
     if [[ ${#DIRS[@]} -eq 0 ]]; then
@@ -184,11 +209,12 @@ main() {
     # Convert arrays to space-separated strings for passing to function
     local patch_prefixes_str="${PATCH_ONLY_PREFIXES[*]}"
     local allowed_prefixes_str="${ALLOWED_PREFIXES[*]}"
+    local denied_prefixes_str="${DENIED_PREFIXES[*]:-}"
 
     # Update each directory
     local failed_dirs=()
     for dir in "${dirs_to_update[@]}"; do
-        if ! modules::update_dir "$dir" "$DRY_RUN" "$patch_prefixes_str" "$allowed_prefixes_str"; then
+        if ! modules::update_dir "$dir" "$DRY_RUN" "$patch_prefixes_str" "$allowed_prefixes_str" "$denied_prefixes_str"; then
             failed_dirs+=("$dir")
         fi
         echo