perf(ci): disable buildvcs for builds and tests by davdhacs · Pull Request #19201 · stackrox/stackrox

davdhacs · 2026-02-25T19:07:56Z

Go 1.18+ silently enabled -buildvcs=auto, which stamps every binary with VCS
metadata (commit, modified status) via debug.ReadBuildInfo(). No code in this
repo reads this metadata — version info is injected via -X ldflags instead.

The VCS stamping adds unnecessary overhead: Go must query git state for every
build/test invocation, and changes to git state (e.g. untracked files) can
invalidate build cache entries.

Fix: explicitly set -buildvcs=false in go-tool.sh.

Changes

scripts/go-tool.sh: add -buildvcs=false to invoke_go_build() and go_test().

Testing and quality

CI results are inspected

How I validated my change

CI-only change (build flags). No functional difference — VCS metadata was never consumed.
Verified locally: builds and tests pass with -buildvcs=false.

openshift-ci · 2026-02-25T19:08:00Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

rhacs-bot · 2026-02-25T19:42:26Z

Images are ready for the commit at 0e04bb8.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-432-g0e04bb8f6f.

codecov · 2026-02-25T20:49:36Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.62%. Comparing base (fe658b3) to head (417ca94).
⚠️ Report is 174 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #19201   +/-   ##
=======================================
  Coverage   49.61%   49.62%           
=======================================
  Files        2680     2680           
  Lines      202195   202214   +19     
=======================================
+ Hits       100316   100340   +24     
+ Misses      94399    94396    -3     
+ Partials     7480     7478    -2

Flag	Coverage Δ
go-unit-tests	`49.62% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

sourcery-ai

Hey - I've found 1 issue, and left some high level feedback:

Using go-mod-with-buildvcs / go-build-with-buildvcs as cache key prefixes while the intent is to disable buildvcs is confusing; consider renaming these prefixes to reflect the post-change behavior so it’s easier to compare and reason about cache behavior over time.
The change to always run the cache save step with PR-specific keys will increase cache writes and storage churn; if this is intended to be temporary, consider centralizing the feature flag (e.g., a single workflow-level input or environment toggle) so it’s easy to turn off or scope down (e.g., to a subset of workflows or branches) after the experiment.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Using `go-mod-with-buildvcs` / `go-build-with-buildvcs` as cache key prefixes while the intent is to *disable* `buildvcs` is confusing; consider renaming these prefixes to reflect the post-change behavior so it’s easier to compare and reason about cache behavior over time.
- The change to always run the cache save step with PR-specific keys will increase cache writes and storage churn; if this is intended to be temporary, consider centralizing the feature flag (e.g., a single workflow-level input or environment toggle) so it’s easy to turn off or scope down (e.g., to a subset of workflows or branches) after the experiment.

## Individual Comments

### Comment 1
<location path=".github/actions/cache-go-dependencies/action.yaml" line_range="20-29" />
<code_context>
+    # TEMPORARY: always save with PR-specific keys for cache testing.
</code_context>
<issue_to_address>
**suggestion:** Cache comment mentions PR-specific keys, but the keys themselves are not PR-scoped.

These cache keys:
- `go-mod-with-buildvcs-${{ hashFiles('**/go.sum') }}`
- `go-build-with-buildvcs-${{ github.job }}-${{ steps.cache-paths.outputs.GOARCH }}-${{ steps.cache-paths.outputs.TAG }}`

are not PR-scoped (they lack something like `github.ref_name` or `github.event.pull_request.number`), so caches will be shared across branches/PRs with the same hash/job/arch/TAG. Either update the keys to include a PR identifier if the intent is truly PR-specific caches, or adjust the comment to describe the broader sharing behavior accurately.

Suggested implementation:

```
    # TEMPORARY: always save with broader cache keys (shared across branches/PRs) for cache testing.

```

If the intention is to truly scope caches per PR instead of sharing them across branches/PRs, you should also modify the `key:` (and optionally `restore-keys:`) fields for:
- `go-mod-with-buildvcs-${{ hashFiles('**/go.sum') }}`  
- `go-build-with-buildvcs-${{ github.job }}-${{ steps.cache-paths.outputs.GOARCH }}-${{ steps.cache-paths.outputs.TAG }}`  

to include a PR identifier such as `${{ github.ref_name }}` or `${{ github.event.pull_request.number }}` where those keys are defined elsewhere in this file.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

.github/actions/cache-go-dependencies/action.yaml

Go's test cache validates inputs by (path, size, mtime) — not content. git checkout sets all file mtimes to the current time, which differs between CI runs, causing test results to never be cached. Fix: set all tracked file mtimes to a fixed date (2001-01-01) after checkout and cache restore. This makes the test cache hit across runs when file content hasn't changed. Measured impact (from PR #19201): - go unit tests: 35m → 8m (4.5x) - go-postgres: 31m → 36s (52x) - sensor-integration: 26m → 2.5m (11x) - Test cache hit rate: 97.6% (681/698 packages) Risk: if a non-.go testdata file changes content but not size between commits, the test cache could return a stale result. This is the same limitation Go's test cache has by design (it explicitly avoids hashing file content for performance). Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Go's test cache validates inputs by (path, size, mtime) — not content. git checkout sets all file mtimes to the current time, which differs between CI runs, causing test results to never be cached. Fix: set all tracked file mtimes to a fixed date (2001-01-01) after checkout and cache restore. This makes the test cache hit across runs when file content hasn't changed. Measured impact (from PR #19201): - go unit tests: 35m → 8m (4.5x) - go-postgres: 31m → 36s (52x) - sensor-integration: 26m → 2.5m (11x) - Test cache hit rate: 97.6% (681/698 packages) Note: the full test cache benefit requires stable Go build cache ActionIDs across commits (see companion PR for zversion.go change). Without that, tests still recompile on every commit, negating the mtime fix. This PR provides the mtime stabilization infrastructure; full speedup requires both changes. Risk: if a non-.go testdata file changes content but not size between commits, the test cache could return a stale result. This is Go's own inherent test cache limitation — it explicitly avoids hashing file content (test.go:hashOpen()). Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Go's test cache validates inputs by (path, size, mtime) — not content. git checkout sets all file mtimes to the current time, which differs between CI runs, causing test results to never be cached. Fix: set all tracked file mtimes to a fixed date (2001-01-01) after checkout and cache restore. This makes the test cache hit across runs when file content hasn't changed. Measured impact (from PR #19201): - go unit tests: 35m → 8m (4.5x) - go-postgres: 31m → 36s (52x) - sensor-integration: 26m → 2.5m (11x) - Test cache hit rate: 97.6% (681/698 packages) Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Go 1.18+ silently enabled -buildvcs=auto, which stamps every binary with VCS metadata (commit, modified status) via debug.ReadBuildInfo(). No code in this repo reads this metadata — version info is injected via -X ldflags instead. The VCS stamping adds unnecessary overhead: Go must query git state for every build/test invocation, and changes to git state (e.g. untracked files) can invalidate build cache entries. Explicitly set -buildvcs=false for both build and test invocations. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

davdhacs · 2026-03-24T22:30:27Z

Superseded by a cleaner PR with just the buildvcs change.

Go's test cache validates inputs by (path, size, mtime) — not content. git checkout sets all file mtimes to the current time, which differs between CI runs, causing test results to never be cached. Fix: set all tracked file mtimes to a fixed date (2001-01-01) after checkout and cache restore. This makes the test cache hit across runs when file content hasn't changed. Measured impact (from PR #19201): - go unit tests: 35m → 8m (4.5x) - go-postgres: 31m → 36s (52x) - sensor-integration: 26m → 2.5m (11x) - Test cache hit rate: 97.6% (681/698 packages) Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openshift-ci bot added the do-not-merge/work-in-progress label Feb 25, 2026

github-actions bot added area/ci ai-review labels Feb 25, 2026

sourcery-ai bot reviewed Feb 25, 2026

View reviewed changes

.github/actions/cache-go-dependencies/action.yaml Outdated Show resolved Hide resolved

davdhacs force-pushed the davdhacs/disable-buildvcs-tests branch 10 times, most recently from 3757653 to 2e2661f Compare March 3, 2026 19:49

davdhacs closed this Mar 3, 2026

davdhacs reopened this Mar 3, 2026

github-actions bot added the area/operator label Mar 3, 2026

davdhacs force-pushed the davdhacs/disable-buildvcs-tests branch 4 times, most recently from 2deb733 to 417ca94 Compare March 4, 2026 17:47

davdhacs mentioned this pull request Mar 12, 2026

perf(ci): stabilize file mtimes for Go test cache #19395

Merged

5 tasks

davdhacs mentioned this pull request Mar 12, 2026

perf(ci): use stable test ldflags for Go test cache #19394

Closed

davdhacs mentioned this pull request Mar 13, 2026

perf(ci): test cache — combined stable ldflags + mtime fix #19404

Closed

openshift-ci bot added the needs-rebase label Mar 22, 2026

davdhacs mentioned this pull request Mar 24, 2026

perf(ci): version refactor (remove Xref/status.sh) #19424

Closed

6 tasks

davdhacs force-pushed the davdhacs/disable-buildvcs-tests branch from 417ca94 to c348542 Compare March 24, 2026 22:10

openshift-ci bot removed the needs-rebase label Mar 24, 2026

davdhacs changed the title ~~chore(ci): disable buildvcs for builds and tests~~ perf(ci): disable buildvcs for builds and tests Mar 24, 2026

davdhacs force-pushed the davdhacs/disable-buildvcs-tests branch from c348542 to 78cf1b6 Compare March 24, 2026 22:13

davdhacs force-pushed the davdhacs/disable-buildvcs-tests branch from 78cf1b6 to 0e04bb8 Compare March 24, 2026 22:20

davdhacs closed this Mar 24, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

perf(ci): disable buildvcs for builds and tests#19201

perf(ci): disable buildvcs for builds and tests#19201
davdhacs wants to merge 1 commit intomasterfrom
davdhacs/disable-buildvcs-tests

davdhacs commented Feb 25, 2026 •

edited

Loading

Uh oh!

openshift-ci bot commented Feb 25, 2026

Uh oh!

rhacs-bot commented Feb 25, 2026 •

edited

Loading

Uh oh!

codecov bot commented Feb 25, 2026 •

edited

Loading

Uh oh!

sourcery-ai bot left a comment

Uh oh!

Uh oh!

davdhacs commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

davdhacs commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Testing and quality

How I validated my change

Uh oh!

openshift-ci bot commented Feb 25, 2026

Uh oh!

rhacs-bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

davdhacs commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

davdhacs commented Feb 25, 2026 •

edited

Loading

rhacs-bot commented Feb 25, 2026 •

edited

Loading

codecov bot commented Feb 25, 2026 •

edited

Loading