Backport PR #2837 to release/v1.7 for bug fix build option for test command #2841
Conversation
* fix test build option * fix * fix * fix
Deploying vald with
|
| Latest commit: |
f869c2b
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://393dcb1a.vald.pages.dev |
| Branch Preview URL: | https://backport-release-v1-7-bugfix-15pm.vald.pages.dev |
📝 WalkthroughWalkthroughThis pull request updates the continuous integration and module dependency setup. The CI workflow now triggers unit tests when changes occur in Changes
Sequence Diagram(s)sequenceDiagram
actor Developer
Developer->>GitHub Actions: Push commit with changes in Makefile.d/test.mk
GitHub Actions->>Workflow: Trigger unit test workflow (push/pull_request)
Workflow->>Makefile: Execute test targets with added -ldflags option
Makefile-->>Workflow: Return test results
Workflow-->>GitHub Actions: Report job status
Possibly related PRs
Suggested labels
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
example/client/go.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sum
📒 Files selected for processing (7)
.github/workflows/unit-test.yaml(2 hunks)Makefile.d/test.mk(5 hunks)example/client/go.mod(2 hunks)example/client/go.mod.default(1 hunks)go.mod(17 hunks)hack/go.mod.default(1 hunks)versions/GO_VERSION(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- versions/GO_VERSION
- example/client/go.mod.default
🔇 Additional comments (11)
Makefile.d/test.mk (1)
166-166: Verify the necessity of external linking mode.The addition of
-ldflags="-linkmode=external"to gotestfmt targets forces the linker to use external linking mode. This change might be necessary if the tests involve CGO or have specific build constraints, but it's only applied to gotestfmt targets and not to tparse targets.Let's verify if this change is necessary and consistent:
Also applies to: 180-180, 194-194, 210-210, 229-229
✅ Verification successful
🏁 Script executed:
#!/bin/bash # Description: Check for CGO usage and build constraints in test files # Check for CGO usage in test files echo "Checking for CGO usage in test files..." rg -l 'import "C"' --type go --glob '*_test.go' # Check for build constraints in test files echo "Checking for build constraints in test files..." rg -l '^// \+build' --type go --glob '*_test.go'Length of output: 294
External Linking Flag Likely Unnecessary
Based on the searches:
- No CGO imports (
import "C") were found in any *_test.go files.- No build constraints (e.g.,
// +build …) were detected in test files.This suggests that the tests do not rely on CGO or alternate build constraints that would necessitate external linking mode. Moreover, the flag is applied only to gotestfmt targets and omitted for tparse targets, introducing an inconsistency without a clear requirement.
It appears that the
-ldflags="-linkmode=external"flag can be removed from gotestfmt targets unless there’s an undocumented dependency that specifically requires external linking.hack/go.mod.default (2)
3-3: Verify Go version compatibility.The Go version has been updated from 1.23.5 to 1.23.6. This appears to be a future version of Go, as the current latest stable version is 1.22.x.
❌ Incorrect review comment
🌐 Web query:
What is the latest stable version of Go?💡 Result:
The latest stable version of Go as of February 2025 is Go 1.23, with its most recent patch being Go 1.23.6 (released February 4, 2025)[5][7]. This follows the Go team's release cadence of major versions every six months and minor patches for security/bug fixes[3][5].
Key Details:
- Latest Major Version: Go 1.23 (released August 13, 2024)[5][6]
- Latest Patch: Go 1.23.6 (February 4, 2025) includes security fixes for
crypto/ellipticand compiler improvements[5]- Support Policy: Major versions receive support until two newer releases exist[5]. Since Go 1.24 is still in unstable RC status[4], Go 1.23 remains fully supported.
Recent Changes:
- Toolchain: Automatic upgrades for dependencies via
go getin Go ≥1.21[2]- Compatibility: Projects using Go ≥1.21 can seamlessly adopt new versions via
go install[2][3]- Security: All supported versions (Go ≥1.22) receive backported fixes like those in Go 1.23.x[5]
For new projects, use
go install golang.org/dl/go1.23@latestto get the latest stable toolchain[4].Citations:
- 1: https://www.easiio.com/latest-golang-version/
- 2: https://github.com/golang/tools/releases
- 3: https://tip.golang.org/doc/go1.21
- 4: https://go.dev/dl/
- 5: https://go.dev/doc/devel/release
- 6: https://tip.golang.org/doc/go1.23
- 7: https://groups.google.com/g/golang-nuts/c/_ROx_UGCCCg
The Go version in
hack/go.mod.defaultis correct.
The web query confirms that as of February 2025, the latest stable version of Go is 1.23, with 1.23.6 being the most recent patch release. Therefore, the usage ofgo 1.23.6is valid and the review comment's note about it being a future version is incorrect.Likely an incorrect or invalid review comment.
16-16: Verify specific version constraints.Some dependencies have specific version constraints:
cloud.google.com/go/storage v1.47.0due to issue #11283github.com/goccy/go-json v0.10.3due to issue ⬆️ Bump contrib.go.opencensus.io/exporter/stackdriver from 0.13.1 to 0.13.2 #529- Kubernetes-related packages are pinned to v0.32.0
Let's verify these version constraints:
Also applies to: 134-134, 332-341
✅ Verification successful
🌐 Web query:
What is the latest version of cloud.google.com/go/storage?💡 Result:
The latest version of
cloud.google.com/go/storageas of February 12, 2025, is v1.50.0. This version includes new features like gRPC bi-directional multi-range reads (in private preview), support for appendable writes, and improvements to retry logic for uploads and metadata updates[1][2][5].Key changes in recent releases include:
- Go v1.50.0 (2025-01-09):
- Added preview APIs for bidirectional reads/writes and accelerated stream resumption[1][2]
- Refactored gRPC writer flow[1]
- Bug fixes for concurrency and error handling[1]
For Java and Python clients:
- Java v2.48.0 (2025-01-27): Added
Storage#moveBlobmethod and OpenTelemetry tracing support[1]- Python v3.0.0 (2025-01-28): Major update with checksum strategy changes and removal of deprecated APIs[1]
Always verify compatibility with your project's requirements before upgrading, as major versions (like Python's 3.x) may introduce breaking changes[1][5].
Citations:
- 1: https://cloud.google.com/storage/docs/release-notes
- 2: https://pkg.go.dev/cloud.google.com/go/storage/internal/apiv2
- 3: https://cloud.google.com/go/docs/reference/cloud.google.com/go/storage/latest
- 4: https://status.cloud.google.com
- 5: https://pkg.go.dev/cloud.google.com/go/storage
- 6: https://pkg.go.dev/cloud.google.com/go
- 7: googleapis/google-cloud-go@storage/v1.46.0...storage/v1.47.0
- 8: https://github.com/googleapis/google-cloud-go/blob/main/storage/storage.go
- 9: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fconsole.cloud.google.com%2F&followup=https%3A%2F%2Fconsole.cloud.google.com%2F&ifkv=AVdkyDkKZbiCxibSnc8-BfZNRLJxQyxU-5r8R5zbY4HmBshl5uRVP14ngqBzFwZkc8XE4eAGNwUltg&osid=1&passive=1209600&service=cloudconsole&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S369200542%3A1738360267745210
I'll now verify that the version constraints match the review comments for the remaining dependencies. First, I'll search the codebase for references to
"github.com/goccy/go-json"and for Kubernetes packages pinned to"v0.32.0"to ensure that the code indeed enforces:
github.com/goccy/go-json v0.10.3due to issue ⬆️ Bump contrib.go.opencensus.io/exporter/stackdriver from 0.13.1 to 0.13.2 #529.- Kubernetes dependencies pinned to v0.32.0.
Let's run a shell script to search for both occurrences in the repository.
🏁 Script executed:
#!/bin/bash # Search for the github.com/goccy/go-json version constraint in all files: rg "github.com/goccy/go-json" -n . # Search for Kubernetes-related packages pinned to v0.32.0 rg "v0\.32\.0" -n .Length of output: 3313
Dependency Version Constraints Verification
cloud.google.com/go/storage:
The review comment specifies a constraint atv1.47.0due to issue #11283. The code snippet inhack/go.mod.defaultconfirms this pinning, while the latest version (v1.50.0) is available externally. This indicates an intentional, documented dependency pin.github.com/goccy/go-json:
Inhack/go.mod.default,github.com/goccy/go-jsonis pinned tov0.10.3with a comment referencing issue #529. Although other parts of the repository (e.g., inexample/client/go.mod) reference different versions (v0.10.5), the primary dependency inhack/go.mod.defaultfollows the constraint.Kubernetes Packages:
All Kubernetes-related dependencies inhack/go.mod.default(lines 332–341) are consistently pinned tov0.32.0.This verification confirms that the specific version constraints mentioned in the review comment are correctly enforced in
hack/go.mod.default.go.mod (4)
3-3: Verify Go version compatibility with the project.The Go version has been updated from 1.23.5 to 1.23.6. This version appears to be invalid as the latest Go version is 1.22.x.
❌ Incorrect review comment
🌐 Web query:
What is the latest version of Go?💡 Result:
The latest version of Go as of February 12, 2025 is Go 1.23.6, released on February 4, 2025[4]. This is a minor revision in the Go 1.23 series that includes security fixes to the
crypto/ellipticpackage and bug fixes to the compiler andgocommand[4].Key details about recent Go releases:
Release timeline
- Go 1.23 (major release): First released August 13, 2024[4]
- Go 1.22: Released February 6, 2024[4]
- Go 1.21: Released August 8, 2023[4]
Current support status
- The Go team maintains support for the 2 most recent major releases (currently 1.22 and 1.23)[1][4]
- Go follows a release cycle with:
- Major releases every 6 months
- Minor revisions containing security/bug fixes approximately monthly
To install the latest version:
go install golang.org/dl/go1.23@latestDevelopers using older versions (particularly pre-1.21) should upgrade to maintain compatibility with tooling like
gopls, which now requires at least Go 1.21 for building[1].Citations:
- 1: https://github.com/golang/tools/releases
- 2: https://forum.exercism.org/t/update-go-version-to-the-latest-one/9326
- 3: https://tip.golang.org/doc/go1.23
- 4: https://go.dev/doc/devel/release
- 5: https://tip.golang.org/doc/go1.22
- 6: https://go.dev/dl/
Go version update is correct, and the review comment is mistaken.
- The web query confirms that Go 1.23.6 is the latest release as of February 2025.
- The update from 1.23.5 to 1.23.6 is valid and aligns with current Go releases.
Likely an incorrect or invalid review comment.
6-15: Verify compatibility of Google Cloud dependencies.Multiple Google Cloud dependencies have been updated:
cloud.google.com/goto v0.118.2cloud.google.com/go/bigqueryto v1.66.2cloud.google.com/go/computeto v1.33.0cloud.google.com/go/monitoringto v1.24.0cloud.google.com/go/pubsubto v1.47.0cloud.google.com/go/secretmanagerto v1.14.4Please ensure these versions are compatible with each other and with the project's requirements.
✅ Verification successful
🏁 Script executed:
#!/bin/bash # Check for any version constraints or compatibility issues in Google Cloud dependencies rg -A 5 "cloud\.google\.com/go" | grep -v "^replace"Length of output: 23501
Google Cloud Dependency Versions Verified
After reviewing the
go.modupdates and the related output, there’s no indication of any version conflicts or constraints violations between the updated dependencies. All updated Google Cloud modules (includingcloud.google.com/go,bigquery,compute,monitoring,pubsub, andsecretmanager) are referenced consistently without conflicting replacements. Note that a past runtime panic was addressed by downgradingcloud.google.com/go(as mentioned in the CHANGLOG), and the current version (v0.118.2) reflects that deliberate choice.It appears the updates meet the project’s requirements without introducing incompatibility issues. As always, integration and runtime tests should be run to ensure full compatibility in practice.
48-68: Verify compatibility of AWS SDK dependencies.Multiple AWS SDK dependencies have been updated to newer versions. Please ensure these versions are compatible with each other:
aws-sdk-go-v2to v1.36.1- Various AWS service clients (s3, kms, sns, sqs, etc.) have been updated
✅ Verification successful
🏁 Script executed:
#!/bin/bash # Check for any version constraints or compatibility issues in AWS SDK dependencies rg -A 5 "github\.com/aws/aws-sdk-go-v2" | grep -v "^replace"Length of output: 10398
AWS SDK dependency versions appear to be consistent and compatible.
The go.mod file shows that all AWS SDK modules (main package and service-specific modules) have been updated deliberately and no conflicting replacements or overrides are present. The shell script output confirms that the dependencies are specified correctly without any apparent issues.
297-311: Review security implications of crypto-related updates.Several security-sensitive packages have been updated:
golang.org/x/cryptoto v0.33.0golang.org/x/oauth2to v0.26.0golang.org/x/systo v0.30.0Please verify these versions for any known security vulnerabilities.
✅ Verification successful
🏁 Script executed:
#!/bin/bash # Check for any security advisories for the updated packages gh api graphql -f query=' { securityVulnerabilities(first: 5, ecosystem: GO, package: "golang.org/x/crypto") { nodes { advisory { summary severity publishedAt } vulnerableVersionRange firstPatchedVersion { identifier } } } }'Length of output: 1705
I'll now gather additional data for the other two packages,
golang.org/x/oauth2andgolang.org/x/sys, using similar queries.
🏁 Script executed:
#!/bin/bash # Query for golang.org/x/oauth2 vulnerabilities gh api graphql -f query=' { securityVulnerabilities(first: 5, ecosystem: GO, package: "golang.org/x/oauth2") { nodes { advisory { summary severity publishedAt } vulnerableVersionRange firstPatchedVersion { identifier } } } }' && \ # Query for golang.org/x/sys vulnerabilities gh api graphql -f query=' { securityVulnerabilities(first: 5, ecosystem: GO, package: "golang.org/x/sys") { nodes { advisory { summary severity publishedAt } vulnerableVersionRange firstPatchedVersion { identifier } } } }'Length of output: 987
Security Review: Updated Packages Confirmed Safe
- golang.org/x/crypto (v0.33.0): The advisory for a critical vulnerability affects versions below 0.31.0. Since the update is to v0.33.0, it includes the necessary fix.
- golang.org/x/oauth2 (v0.26.0): No security issues were found.
- golang.org/x/sys (v0.30.0): The reported vulnerability is fixed in versions newer than the vulnerable pseudo-version. v0.30.0 is safe.
example/client/go.mod (3)
6-18: LGTM! Dependencies updated to newer versions.All dependency version updates appear to be consistent and moving to newer versions, which is good for security and bug fixes.
✅ Verification successful
🏁 Script executed:
#!/bin/bash # Description: Verify dependency versions are valid and check for any security advisories # Check for security advisories for key dependencies gh api graphql -f query=' { securityVulnerabilities(first: 5, ecosystem: GO, package: "google.golang.org/protobuf") { nodes { advisory { summary severity publishedAt } vulnerableVersionRange firstPatchedVersion { identifier } } } }'Length of output: 874
Dependency versions in go.mod verified as updated and secure.
- The dependency
google.golang.org/protobufis at v1.36.5, which is above the patched versions (v1.33.0 and v1.29.1) addressing the reported vulnerabilities.
3-3: Verify Go version compatibility.The Go version has been updated to 1.23.6. Please ensure this version is compatible with all dependencies and the target environment.
✅ Verification successful
🌐 Web query:
What is the latest stable version of Go?💡 Result:
The latest stable version of Go (Golang) as of February 12, 2025 is Go 1.23.6, part of the Go 1.23 release family[6][7]. This follows the release timeline where major versions arrive every six months (e.g., Go 1.22 in February 2024 and Go 1.23 in August 2024)[6][7].
Key Details:
- Go 1.23 introduced toolchain improvements and runtime optimizations while maintaining backward compatibility[7].
- Patch updates like Go 1.23.x address security issues and bugs (e.g., fixes for
crypto/ellipticand compiler improvements in Go 1.23.6)[6].- The current minor release (Go 1.23) will be supported until two newer major versions exist per Go’s support policy[6].
For developers using older versions:
- Go 1.22 received updates until January 2025[6].
- Go 1.21 reached end-of-life after the release of Go 1.23[6].
To verify your installed version:
go version # Example output: go1.23.6Always check the official download page for updates[5][6].
Citations:
- 1: https://www.easiio.com/golang-latest-version/
- 2: https://www.easiio.com/latest-golang-version/
- 3: https://github.com/golang/tools/releases
- 4: https://tip.golang.org/doc/go1.21
- 5: https://go.dev/dl/
- 6: https://go.dev/doc/devel/release
- 7: https://tip.golang.org/doc/go1.23
- 8: https://groups.google.com/g/golang-nuts/c/_ROx_UGCCCg
Go version update verified.
The update to "go 1.23.6" in
example/client/go.modis confirmed as correct since it matches the latest stable version as of February 2025. No changes are required.
39-41: Verify indirect dependency versions are compatible.The indirect dependencies have been updated to specific versions. Please ensure these versions are compatible with the direct dependencies.
✅ Verification successful
🏁 Script executed:
#!/bin/bash # Description: Check for any version conflicts in dependencies # Run go mod verify to check module consistency go mod verify # Check for any dependency conflicts go mod graph | awk '{if($1!=last){print ""; last=$1}; print}' | grep -v "^$"Length of output: 82075
Indirect dependency versions are compatible.
The output from the verification steps indicates:
- The
go mod verifycommand succeeded ("all modules verified").- The dependency graph shows that the updated indirect modules (including the separate versions for
google.golang.org/genproto/googleapis/apiand…/rpc) are resolved by distinct direct dependencies without conflicts.Based on this evidence, the indirect dependency versions in
example/client/go.modare compatible with the direct dependencies..github/workflows/unit-test.yaml (1)
30-30: LGTM! CI trigger added for test.mk changes.Adding
Makefile.d/test.mkto the workflow triggers ensures that CI runs when test-related build options are modified, which aligns with the PR objectives for fixing the test command build option.Also applies to: 39-39
|
[CHATOPS:HELP] ChatOps commands.
|
vankichi
deleted the
backport/release/v1.7/bugfix/test/add-build-option
branch
Description
SSIA
Related Issue
Versions
Checklist
Special notes for your reviewer
Summary by CodeRabbit
Tests
Chores