Build toolchain versioning #27
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
keyop-go/nfq_forwarder#27
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
When building locally, the build is sensitive to tool versions used. In particular, go v1.25.x seems to give odd issues, but the versions of goreleaser, golangcilint and others also matter.
The versions of all of these tools should be stored in a file in the repository, and checked in both the CI and local builds. A clear warning should be given if tools are wrongly versioned, but the build should not exit until all tools have been checked and warnings given to avoid having to iterate over the upgrades required.
changed the description
Plan for this ticket:
.tool-versionsfile at the repo root pinning exact versions forgo,golangci-lint,goreleaser,gitleaks, andyamllint- the tools flagged in the description plus the other two already pinned into the golang-ci CI image (golang-ci !46).scripts/check-tool-versions.sh, wired in as a newmake check-tool-versionstarget: it checks every tool in.tool-versionsagainst what's actually installed and prints aWARNING:for each mismatch or missing tool. Per the description, it checks all tools before reporting (so you see every mismatch in one pass, not one at a time) and never fails the build - a drift is a hint, not a hard gate.check-tool-versionsas a prerequisite ofbuild/test/lint/package/release/coverage/coverage-html, same pattern as the existingcheck-build-requirements- this covers CI for free (no.gitlab-ci.ymlchange needed) since those jobs already runmake lint/make test/make package.Makefile'ssetup-goreleaser/setup-gitleaksto install the exact pinned version from.tool-versionsinstead of@latest, so a fresh local install lands on the same version CI/the image use rather than drifting immediately.README.md/CLAUDE.md.Note on scope: this is warn-only, matching "the build should not exit" - I'm not raising
go.mod'sgo 1.25.0minimum-version directive, since that would hard-block anyone below it from building at all, which the ticket explicitly doesn't want.mentioned in commit
d5dfb4a2afmentioned in merge request !77
mentioned in commit
5fd8c5811cmentioned in commit
08aa545eebmentioned in commit
cb8f04b3e8Merged via !77 (merge commit
cb8f04b).For the record on the pipeline #405 confusion: it actually did run against the right commit (
5fd8c58, the MR head at the time) - it wasn't stale. The real cause was a shellcheck version difference: this MR pinsshellcheck >= 0.10.0, and the CI image installs exactly0.10.0via apt, which raisesSC2317("command appears unreachable") on the indirectly-invokedinstalled_version_<tool>functions in addition toSC2329- my local shellcheck was0.11.0, which doesn't raiseSC2317for these, so it looked clean locally. Fixed in08aa545(verified against a real downloadedv0.10.0binary before pushing, not just reasoning about it) and pipeline 406 passed cleanly.This is dev-tooling/CI-only - nothing in the shipped binary changes - so following the precedent set on #35, I'd suggest this doesn't need a version tag either. Let me know if you'd like one anyway.