build: run pinned tools with go tool

.github/dependabot.yml

@@ -15,4 +15,16 @@ updates:
           - "sigs.k8s.io/*"
       golang-x-deps:
         patterns:
-          - "golang.org/x/*"
+          - "golang.org/x/*"
+  - package-ecosystem: "gomod"
+    directory: "/tools/openapi"
+    schedule:
+      interval: "weekly"
+    groups:
+      k8s-dependencies:
+        patterns:
+          - "k8s.io/*"
+          - "sigs.k8s.io/*"
+      golang-x-deps:
+        patterns:
+          - "golang.org/x/*"

AGENTS.md

@@ -283,7 +283,7 @@ make format tidy         # Format and tidy code
 ```
 
 ### Tool Management
-Tools are managed via Makefile and installed to `./bin/`:
+Tools are pinned in `go.mod` and run via `go tool` from the Makefile:
 - `controller-gen` - Kubernetes code generator
 - `yq` - YAML processor for CRD patching
 - `kind` - Local Kubernetes clusters

Makefile

@@ -17,11 +17,12 @@ SPECIFIC_SKIP_UNIT_TEST := $(if $(SKIP),-skip $(SKIP),)
 
 .DEFAULT_GOAL := help
 
-# Bingo manages the remaining binary dependencies independently of the main module.
-include .bingo/Variables.mk
-
-# Build controller-gen from the version pinned by go.mod for the host platform.
-CONTROLLER_GEN := GOOS=$(GOHOSTOS) GOARCH=$(GOHOSTARCH) GOARM=$(GOHOSTARM) go tool controller-gen
+# Build tools for the host even when GOOS or GOARCH is set for a cross-build.
+HOST_GO_TOOL := GOOS=$(shell go env GOHOSTOS) GOARCH=$(shell go env GOHOSTARCH) GOARM=$(shell go env GOHOSTARM) go tool
+CONTROLLER_GEN := $(HOST_GO_TOOL) controller-gen
+OPENAPI_GEN := $(HOST_GO_TOOL) -modfile=tools/openapi/go.mod openapi-gen
+YQ := $(HOST_GO_TOOL) yq
+KIND := $(HOST_GO_TOOL) kind
 
 .PHONY: help
 help: ## Show this help screen
@@ -60,7 +61,7 @@ clean: ## Clean up the build artifacts
 generate: generate-openapi ## Generate code
 	$(CONTROLLER_GEN) object:headerFile=./hack/boilerplate.go.txt paths=./...
 
-generate-openapi: $(OPENAPI_GEN) ## Generate OpenAPIModelName() functions and OpenAPI definitions
+generate-openapi: ## Generate OpenAPIModelName() functions and OpenAPI definitions
 	@# Generate OpenAPIModelName() functions (zz_generated.model_name.go) in each input package.
 	@# Also produces a consolidated OpenAPI definitions file in pkg/generated/openapi/ (required by openapi-gen).
 	@# API rule violations are written to api_violations.report instead of failing the build.
@@ -75,7 +76,7 @@ generate-openapi: $(OPENAPI_GEN) ## Generate OpenAPIModelName() functions and Op
 		./pkg/operators/v1alpha1 \
 		./pkg/lib/version
 
-manifests: $(YQ) ## Generate manifests e.g. CRD, RBAC etc
+manifests: ## Generate manifests e.g. CRD, RBAC etc
 	@# Create CRDs for new APIs
 	$(CONTROLLER_GEN) crd:crdVersions=v1 output:crd:dir=./crds paths=./pkg/operators/...
 
@@ -126,6 +127,6 @@ KIND_NODE_VERSION := $(shell ./hack/get-kind-node-version.sh)
 KIND_CLUSTER_IMAGE := kindest/node:v$(KIND_NODE_VERSION)
 
 .PHONY: kind-cluster
-kind-cluster: $(KIND) ## Create a kind cluster
+kind-cluster: ## Create a kind cluster
 	$(KIND) create cluster --name olmv0 --image $(KIND_CLUSTER_IMAGE)
 	$(KIND) export kubeconfig --name olmv0

go.mod

@@ -21,13 +21,20 @@ require (
 )
 
 require (
+	al.essio.dev/pkg/shellescape v1.5.1 // indirect
 	cel.dev/expr v0.25.2 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/a8m/envsubst v1.4.2 // indirect
+	github.com/alecthomas/participle/v2 v2.1.1 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dimchansky/utfbom v1.1.1 // indirect
+	github.com/elliotchance/orderedmap v1.7.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
@@ -48,24 +55,33 @@ require (
 	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
 	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
 	github.com/gobuffalo/flect v1.0.3 // indirect
+	github.com/goccy/go-json v0.10.4 // indirect
+	github.com/goccy/go-yaml v1.13.3 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jinzhu/copier v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kisielk/errcheck v1.8.0 // indirect
+	github.com/magiconair/properties v1.8.9 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mikefarah/yq/v4 v4.45.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/client_golang v1.24.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.70.0 // indirect
 	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
+	github.com/yuin/gopher-lua v1.1.1 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
 	go.opentelemetry.io/otel v1.46.0 // indirect
@@ -93,6 +109,8 @@ require (
 	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/apiserver v0.37.2 // indirect
 	k8s.io/code-generator v0.37.2 // indirect
 	k8s.io/component-base v0.37.2 // indirect
@@ -102,8 +120,13 @@ require (
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0 // indirect
 	sigs.k8s.io/controller-tools v0.22.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/kind v0.33.0 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 )
 
-tool sigs.k8s.io/controller-tools/cmd/controller-gen
+tool (
+	github.com/mikefarah/yq/v4
+	sigs.k8s.io/controller-tools/cmd/controller-gen
+	sigs.k8s.io/kind
+)