Prevent openshift/api | client-go contagious tag use

ci-operator/config/openshift/origin/openshift-origin-main.yaml

@@ -105,6 +105,10 @@ tests:
   container:
     from: src
   skip_if_only_changed: ^(?:docs|\.github)/|\.md$|^(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+- as: go-verify-deps
+  steps:
+    test:
+    - ref: go-verify-deps
 - as: e2e-gcp-ovn
   skip_if_only_changed: ^(?:docs|\.github)/|\.md$|^(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
   steps:

ci-operator/jobs/openshift/origin/openshift-origin-main-presubmits.yaml

@@ -5788,6 +5788,66 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )e2e-vsphere-ovn-upi,?($|\s.*)
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build09
+    context: ci/prow/go-verify-deps
+    decorate: true
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-origin-main-go-verify-deps
+    rerun_command: /test go-verify-deps
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=go-verify-deps
+        command:
+        - ci-operator
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )go-verify-deps,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:

ci-operator/step-registry/go/verify-deps/go-verify-deps-commands.sh

@@ -70,6 +70,31 @@ else
     echo "Detected go.mod in ${PWD}; verifying vendored dependencies."
 fi
 
+if cat go.mod | grep -E "github.com/openshift/(api|client-go) v3\.9\.0\+incompatible"; then
+  echo "ERROR: Detected github.com/openshift/api or client-go v3.9.0+incompatible in go.mod"
+  echo "Do not use this 'version' of openshift/api or client-go . For complex"
+  echo "reasons, this invalid version is a contagion which causes modules"
+  echo "which import your code to also import the invalid version."
+  echo "Fix:"
+  echo "Use an explicit commit in your 'require' statement. You can do"
+  echo "this with 'go get github.com/openshift/api@latest' or just specify"
+  echo "the import directly. For example, for openshift/api require:"
+  echo "        github.com/openshift/api@v0.0.0-20250710004639-926605d3338b"
+  echo "In addition, remove any 'replace' statement that may have been in"
+  echo "use for the module."
+  echo ""
+  echo "Unfortunately, this will be necessary until modules you require"
+  echo "eliminate their own use of v3.9.0+incompatible import."
+  echo ""
+  echo "Detail: v3.9.0+incompatible used to be a valid version/tag. However"
+  echo "managing @latest via tags was not desired, so the version was deleted."
+  echo "Before that deletion, many modules had incorporated the now invalid"
+  echo "version. Since the version is greater than v0.0.0 pseudo-versions,"
+  echo "go 'upgrades' importing go.mods to use v3.9.0+incompatible and the"
+  echo "contagion spreads."
+  exit 1
+fi
+
 # For debugging
 go version