chore(ci): disable buildvcs stamping into binaries #19095
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,333 @@ | ||
| name: Test Go Git Index Optimization | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| push: | ||
| branches: | ||
| - 'davdhacs/gha-disable-buildvcs' | ||
|
|
||
| defaults: | ||
| run: | ||
| shell: bash | ||
|
|
||
| jobs: | ||
|
|
||
| # ================================================================== | ||
| # Build patched Go toolchain (cached by patch hash) | ||
| # ================================================================== | ||
| build-patched-go: | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.2 | ||
| volumes: | ||
| - /usr:/mnt/usr | ||
| - /opt:/mnt/opt | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Cache patched Go toolchain | ||
| id: go-cache | ||
| uses: actions/cache@v5 | ||
| with: | ||
| path: /tmp/go-patched | ||
| key: patched-go-v1-${{ hashFiles('scripts/go-gitindex.patch') }} | ||
|
|
||
| - name: Build patched Go toolchain | ||
| if: steps.go-cache.outputs.cache-hit != 'true' | ||
| run: | | ||
| set -euo pipefail | ||
| echo "::group::Clone Go 1.25.7" | ||
| git clone --depth=1 --branch go1.25.7 https://go.googlesource.com/go /tmp/go-patched 2>&1 | ||
| echo "::endgroup::" | ||
|
|
||
| echo "::group::Apply patch" | ||
| cd /tmp/go-patched | ||
| git apply "$GITHUB_WORKSPACE/scripts/go-gitindex.patch" | ||
| echo "::endgroup::" | ||
|
|
||
| echo "::group::Build Go toolchain" | ||
| cd /tmp/go-patched/src | ||
| GOROOT_BOOTSTRAP="$(go env GOROOT)" ./make.bash 2>&1 | tail -5 | ||
| echo "::endgroup::" | ||
|
|
||
| - name: Verify patched Go | ||
| continue-on-error: true | ||
| run: | | ||
| echo "Patched Go: $(/tmp/go-patched/bin/go version)" | ||
| echo "Compiler SHA256:" | ||
| sha256sum "/tmp/go-patched/pkg/tool/linux_amd64/compile" 2>/dev/null || true | ||
|
|
||
| # ================================================================== | ||
| # BASELINE: patched Go binary, all optimizations DISABLED | ||
| # Same compiler binary + fresh per-run cache = fair comparison | ||
| # ================================================================== | ||
| pre-build-go-binaries: | ||
| needs: build-patched-go | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.2 | ||
| volumes: | ||
| - /usr:/mnt/usr | ||
| - /opt:/mnt/opt | ||
| env: | ||
| GONOBITINDEX: "1" | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - uses: ./.github/actions/job-preamble | ||
| with: | ||
| gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} | ||
|
|
||
| - name: Restore patched Go toolchain | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: /tmp/go-patched | ||
| key: patched-go-v1-${{ hashFiles('scripts/go-gitindex.patch') }} | ||
|
|
||
| - name: Set patched Go as default | ||
| run: | | ||
| echo "/tmp/go-patched/bin" >> "$GITHUB_PATH" | ||
| echo "GOROOT=/tmp/go-patched" >> "$GITHUB_ENV" | ||
|
|
||
| # Restore GOCACHE with per-run key (fresh cache, not stale weekly) | ||
| - name: Restore GOCACHE | ||
| id: baseline-gocache | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: /github/home/.cache/go-build | ||
| key: baseline-gocache-v1-${{ hashFiles('scripts/go-gitindex.patch') }}-${{ github.run_id }} | ||
| restore-keys: | | ||
| baseline-gocache-v1-${{ hashFiles('scripts/go-gitindex.patch') }}- | ||
|
|
||
| - name: Restore GOMODCACHE | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: /github/home/go/pkg/mod | ||
| key: go-mod-v1-${{ hashFiles('**/go.sum') }} | ||
| restore-keys: go-mod-v1- | ||
|
|
||
| - name: Download Go modules | ||
| run: make deps --always-make | ||
|
|
||
| - name: Record environment | ||
| continue-on-error: true | ||
| run: | | ||
| echo "Go: $(go version)" | ||
| echo "GONOBITINDEX: ${GONOBITINDEX}" | ||
| echo "GOCACHE: $(go env GOCACHE)" | ||
| echo "GOCACHE restored: ${{ steps.baseline-gocache.outputs.cache-hit || 'prefix-match-or-miss' }}" | ||
| echo "GOCACHE matched key: ${{ steps.baseline-gocache.outputs.cache-matched-key || 'none' }}" | ||
| echo "GOCACHE size: $(du -sh "$(go env GOCACHE)" 2>/dev/null | cut -f1 || echo 'empty')" | ||
| echo "Compiler SHA256:" | ||
| sha256sum "$(go env GOROOT)/pkg/tool/$(go env GOOS)_$(go env GOARCH)/compile" 2>/dev/null || true | ||
|
|
||
| - name: "Build Go Binaries (baseline, optimizations DISABLED)" | ||
| continue-on-error: true | ||
| run: | | ||
| time GOOS=linux GOARCH=amd64 CGO_ENABLED=1 make build-prep main-build-nodeps GOFLAGS="-v" 2>&1 | tee /tmp/build1.log | ||
| echo "Packages compiled: $(grep -c '^[a-z]' /tmp/build1.log 2>/dev/null || echo 0)" | ||
|
|
||
| - name: "Rebuild (known-warm)" | ||
| continue-on-error: true | ||
| run: | | ||
| time GOOS=linux GOARCH=amd64 CGO_ENABLED=1 make build-prep main-build-nodeps 2>&1 | ||
|
|
||
| - name: "Warm build timing (baseline, 3 runs)" | ||
| continue-on-error: true | ||
| run: | | ||
| for i in 1 2 3; do | ||
| echo "--- run $i ---" | ||
| time GOOS=linux GOARCH=amd64 CGO_ENABLED=1 make build-prep main-build-nodeps 2>&1 | ||
| done | ||
|
|
||
| - name: Save GOCACHE | ||
| uses: actions/cache/save@v5 | ||
| continue-on-error: true | ||
| with: | ||
| path: /github/home/.cache/go-build | ||
| key: baseline-gocache-v1-${{ hashFiles('scripts/go-gitindex.patch') }}-${{ github.run_id }} | ||
|
|
||
| # ================================================================== | ||
| # PATCHED GO: cold build — populates GOCACHE, saves it | ||
| # ================================================================== | ||
| patched-go-cold-build: | ||
| needs: build-patched-go | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.2 | ||
| volumes: | ||
| - /usr:/mnt/usr | ||
| - /opt:/mnt/opt | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - uses: ./.github/actions/job-preamble | ||
| with: | ||
| gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} | ||
|
|
||
| - name: Restore patched Go toolchain | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: /tmp/go-patched | ||
| key: patched-go-v1-${{ hashFiles('scripts/go-gitindex.patch') }} | ||
|
|
||
| - name: Set patched Go as default | ||
| run: | | ||
| echo "/tmp/go-patched/bin" >> "$GITHUB_PATH" | ||
| echo "GOROOT=/tmp/go-patched" >> "$GITHUB_ENV" | ||
|
|
||
| # Restore GOCACHE: exact match for this run, or prefix match from previous run | ||
| - name: Restore GOCACHE | ||
| id: gocache-restore | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: /github/home/.cache/go-build | ||
| key: patched-gocache-v1-${{ hashFiles('scripts/go-gitindex.patch') }}-${{ github.run_id }} | ||
| restore-keys: | | ||
| patched-gocache-v1-${{ hashFiles('scripts/go-gitindex.patch') }}- | ||
|
|
||
| - name: Restore GOMODCACHE | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: /github/home/go/pkg/mod | ||
| key: go-mod-v1-${{ hashFiles('**/go.sum') }} | ||
| restore-keys: go-mod-v1- | ||
|
|
||
| - name: Download Go modules | ||
| run: make deps --always-make | ||
|
|
||
| - name: Record environment | ||
| continue-on-error: true | ||
| run: | | ||
| echo "Go: $(go version)" | ||
| echo "GOCACHE: $(go env GOCACHE)" | ||
| echo "GOCACHE restored: ${{ steps.gocache-restore.outputs.cache-hit || 'prefix-match-or-miss' }}" | ||
| echo "GOCACHE matched key: ${{ steps.gocache-restore.outputs.cache-matched-key || 'none' }}" | ||
| echo "GOCACHE size: $(du -sh "$(go env GOCACHE)" 2>/dev/null | cut -f1 || echo 'empty')" | ||
| echo "Compiler SHA256:" | ||
| sha256sum "$(go env GOROOT)/pkg/tool/$(go env GOOS)_$(go env GOARCH)/compile" 2>/dev/null || true | ||
|
|
||
| - name: "Build Go Binaries (patched Go)" | ||
| continue-on-error: true | ||
| run: | | ||
| echo "=== Build (patched Go) ===" | ||
| time GOOS=linux GOARCH=amd64 CGO_ENABLED=1 make build-prep main-build-nodeps GOFLAGS="-v" 2>&1 | tee /tmp/build1.log | ||
| echo "Packages compiled: $(grep -c '^[a-z]' /tmp/build1.log 2>/dev/null || echo 0)" | ||
|
|
||
| - name: "Rebuild (known-warm, same job)" | ||
| continue-on-error: true | ||
| run: | | ||
| echo "=== Known-warm rebuild ===" | ||
| time GOOS=linux GOARCH=amd64 CGO_ENABLED=1 make build-prep main-build-nodeps 2>&1 | ||
|
|
||
| - name: "GOCACHE after build" | ||
| continue-on-error: true | ||
| run: | | ||
| GOCACHE="$(go env GOCACHE)" | ||
| echo "GOCACHE size: $(du -sh "$GOCACHE" 2>/dev/null | cut -f1)" | ||
| echo "Total files: $(find "$GOCACHE" -type f 2>/dev/null | wc -l)" | ||
|
|
||
| # Save with run-specific key (unique, so save always works) | ||
| - name: Save GOCACHE | ||
| uses: actions/cache/save@v5 | ||
| continue-on-error: true | ||
| with: | ||
| path: /github/home/.cache/go-build | ||
| key: patched-gocache-v1-${{ hashFiles('scripts/go-gitindex.patch') }}-${{ github.run_id }} | ||
|
|
||
| # ================================================================== | ||
| # PATCHED GO: warm build — restores GOCACHE from cold build | ||
| # Same Go binary + same GOCACHE = should be a cache hit | ||
| # ================================================================== | ||
| patched-go-warm-build: | ||
| needs: patched-go-cold-build | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.2 | ||
| volumes: | ||
| - /usr:/mnt/usr | ||
| - /opt:/mnt/opt | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - uses: ./.github/actions/job-preamble | ||
| with: | ||
| gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} | ||
|
|
||
| - name: Restore patched Go toolchain | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: /tmp/go-patched | ||
| key: patched-go-v1-${{ hashFiles('scripts/go-gitindex.patch') }} | ||
|
|
||
| - name: Set patched Go as default | ||
| run: | | ||
| echo "/tmp/go-patched/bin" >> "$GITHUB_PATH" | ||
| echo "GOROOT=/tmp/go-patched" >> "$GITHUB_ENV" | ||
|
|
||
| # Restore this run's GOCACHE from the cold build job | ||
| - name: Restore GOCACHE from cold build | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: /github/home/.cache/go-build | ||
| key: patched-gocache-v1-${{ hashFiles('scripts/go-gitindex.patch') }}-${{ github.run_id }} | ||
|
|
||
| - name: Restore GOMODCACHE | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: /github/home/go/pkg/mod | ||
| key: go-mod-v1-${{ hashFiles('**/go.sum') }} | ||
| restore-keys: go-mod-v1- | ||
|
|
||
| - name: Download Go modules | ||
| run: make deps --always-make | ||
|
|
||
| - name: Record environment | ||
| continue-on-error: true | ||
| run: | | ||
| echo "Go: $(go version)" | ||
| echo "GOCACHE: $(go env GOCACHE)" | ||
| echo "GOCACHE size: $(du -sh "$(go env GOCACHE)" 2>/dev/null | cut -f1 || echo 'empty')" | ||
| echo "Compiler SHA256:" | ||
| sha256sum "$(go env GOROOT)/pkg/tool/$(go env GOOS)_$(go env GOARCH)/compile" 2>/dev/null || true | ||
|
|
||
| - name: "Build Go Binaries (patched Go, restored GOCACHE)" | ||
| continue-on-error: true | ||
| run: | | ||
| echo "=== Build with restored GOCACHE ===" | ||
| time GOOS=linux GOARCH=amd64 CGO_ENABLED=1 make build-prep main-build-nodeps GOFLAGS="-v" 2>&1 | tee /tmp/build1.log | ||
| echo "Packages compiled (cache misses): $(grep -c '^[a-z]' /tmp/build1.log 2>/dev/null || echo 0)" | ||
|
|
||
| - name: "Rebuild (known-warm)" | ||
| continue-on-error: true | ||
| run: | | ||
| echo "=== Known-warm rebuild ===" | ||
| time GOOS=linux GOARCH=amd64 CGO_ENABLED=1 make build-prep main-build-nodeps 2>&1 | ||
|
|
||
| - name: "Warm build timing (git index ENABLED, 3 runs)" | ||
| continue-on-error: true | ||
| run: | | ||
| for i in 1 2 3; do | ||
| echo "--- run $i ---" | ||
| time GOOS=linux GOARCH=amd64 CGO_ENABLED=1 make build-prep main-build-nodeps 2>&1 | ||
| done | ||
|
|
||
| - name: "Warm build timing (git index DISABLED, 3 runs)" | ||
| continue-on-error: true | ||
| env: | ||
| GONOBITINDEX: "1" | ||
| run: | | ||
| for i in 1 2 3; do | ||
| echo "--- run $i ---" | ||
| time GOOS=linux GOARCH=amd64 CGO_ENABLED=1 make build-prep main-build-nodeps 2>&1 | ||
| done |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
issue (bug_risk): Referencing
github.event.pull_requeston non-PR events can break the workflow expression.On push events,
github.event.pull_requestis undefined, and accessing its properties can cause the workflow condition to error. To avoid failures on pushes, wrap the label check in an event guard, e.g.:This preserves the intended behavior without touching
github.event.pull_requestwhen it doesn’t exist.