Skip to content

perf(ci): version refactor (remove Xref/status.sh) #19424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
davdhacs wants to merge 1 commit into from
+67 −64
Closed

perf(ci): version refactor (remove Xref/status.sh) #19424

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,3 +80,4 @@ shellcheck-reports
# These files need to be ignored in order for `make tag` return a clean version string.
repository-to-cpe.json
container-name-repos-map.json
pkg/version/internal/zversion.go
10 changes: 7 additions & 3 deletions operator/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,14 @@ COPY generated/ generated/

# Copy scripts/go-build.sh and dependencies.
COPY scripts/ scripts/
COPY operator/build/status.sh status.sh

# This creates a git repo in workdir so that `git grep` command in build.sh can succeed and actually find //XDef-s.
RUN git init && git add .
# Copy version data files needed by go-tool.sh.
COPY *VERSION ./

# go-tool.sh needs BUILD_TAG to generate version info when there's no .git
# directory. The Makefile sets this via --build-arg from `make tag`.
ARG BUILD_TAG
ENV BUILD_TAG=${BUILD_TAG}
Comment on lines +53 to +54
Copy link
Copy Markdown

@SourceryAI SourceryAI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question (bug_risk): Clarify behavior when BUILD_TAG is not provided to the Docker build

With the current setup, a plain docker build without --build-arg BUILD_TAG=... will leave BUILD_TAG empty. In images without .git, go-tool.sh will then fail when it tries git describe. Consider either enforcing that BUILD_TAG is set (e.g., RUN test -n "$BUILD_TAG") or adding a non-.git-based fallback for version generation.


# We've been historically building operator without CGO both upstream and downstream.
ENV CGO_ENABLED=0
Expand Down
27 changes: 7 additions & 20 deletions operator/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,23 +336,9 @@ chart: kubebuilder manifests ## Generate a helm chart with all necessary resourc
build: manifests generate fmt vet ## Build operator local binary.
../scripts/go-build-file.sh ./cmd/main.go bin/manager

.PHONY: smuggled-status-sh
smuggled-status-sh:
$(SILENT)( \
`# status.sh file is used by scripts/go-build.sh which we try to run in the docker container.` \
`# status.sh needs git repo, make and Makefile and who knows what else but its actual output is simple.` \
`# Here we grab the output and create a new build/status.sh from it. That file will be copied into the` \
`# container and used there without having to bring all dependencies.` \
set -euxo pipefail ;\
smuggled_status_sh="$(PROJECT_DIR)/build/status.sh" ;\
mkdir -p "$(PROJECT_DIR)/build" ;\
cd "$(PROJECT_DIR)/.." ;\
echo "#!/bin/sh" > "$${smuggled_status_sh}" ;\
./status.sh | awk '{print "echo \"" $$0 "\""}' >> "$${smuggled_status_sh}" ;\
chmod +x "$${smuggled_status_sh}" ;\
`# Verify that the resulting status.sh is actually runnable` \
"$${smuggled_status_sh}" ;\
)

# Version tag passed to Docker builds for go-tool.sh version generation.
OPERATOR_BUILD_TAG ?= $(shell cd .. && make --quiet --no-print-directory tag)

# Force re-building the file to make sure the current environment is correctly reflected.
.PHONY: build/Dockerfile.gen
Expand All @@ -361,10 +347,11 @@ build/Dockerfile.gen: Dockerfile
sed -e 's,$${ROX_IMAGE_FLAVOR},$(ROX_IMAGE_FLAVOR),g; s,$${BUILD_IMAGE_VERSION},$(shell sed 's/\s*\#.*//' ../BUILD_IMAGE_VERSION),' < $< > $@

.PHONY: docker-build
docker-build: build/Dockerfile.gen smuggled-status-sh ## Build docker image with the operator.
docker-build: build/Dockerfile.gen ## Build docker image with the operator.
BUILDKIT_PROGRESS=plain ../scripts/docker-build.sh \
-t ${IMG} \
$(if $(GOARCH),--build-arg TARGET_ARCH=$(GOARCH)) \
--build-arg BUILD_TAG=$(OPERATOR_BUILD_TAG) \
-f $< \
..

Expand Down Expand Up @@ -567,11 +554,11 @@ docker-push-index: ## Push docker image with the index.
# To properly provided solutions that supports more than one platform you should use this option.
PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
.PHONY: docker-buildx
docker-buildx: smuggled-status-sh test build/Dockerfile.gen ## Build and push docker image for the manager for cross-platform support
docker-buildx: test build/Dockerfile.gen ## Build and push docker image for the manager for cross-platform support
# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' build/Dockerfile.gen > build/Dockerfile.cross
- docker buildx create --name project-v3-builder
docker buildx use project-v3-builder
- docker buildx build --platform=$(PLATFORMS) --push --tag ${IMG} -f build/Dockerfile.cross ..
- docker buildx build --platform=$(PLATFORMS) --push --tag ${IMG} --build-arg BUILD_TAG=$(OPERATOR_BUILD_TAG) -f build/Dockerfile.cross ..
- docker buildx rm project-v3-builder
rm build/Dockerfile.cross
12 changes: 7 additions & 5 deletions pkg/version/internal/version_data.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,16 @@
package internal

// Version variables are populated at init time by the generated zversion.go
// file (created by go-tool.sh). Without go-tool.sh, all values remain empty.
var (
// MainVersion is the Rox version.
MainVersion string //XDef:STABLE_MAIN_VERSION
MainVersion string
// CollectorVersion is the collector version to be used by default.
CollectorVersion string //XDef:STABLE_COLLECTOR_VERSION
CollectorVersion string
// FactVersion is the fact version to be used by default.
FactVersion string //XDef:STABLE_FACT_VERSION
FactVersion string
// ScannerVersion is the scanner version to be used with this Rox version.
ScannerVersion string //XDef:STABLE_SCANNER_VERSION
ScannerVersion string
// GitShortSha is the (short) Git SHA that was built.
GitShortSha string //XDef:STABLE_GIT_SHORT_SHA
GitShortSha string
)
81 changes: 45 additions & 36 deletions scripts/go-tool.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,46 +12,55 @@ die() {
}
Copy link
Copy Markdown

@SourceryAI SourceryAI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question: Consider guarding git invocations when TOOL=test to avoid failures in build contexts without a .git directory

In the TOOL == "test" path, generate_version_file always runs git describe from ${REPO_ROOT}. In Docker or other environments without a .git directory, this will hit die "git describe failed", causing tests to hard-fail even when version info isn’t essential.

To avoid that, you could either (a) skip version generation in test mode when .git is absent, or (b) let BUILD_TAG override the TOOL == "test" behavior so tests still run in non‑git environments.


RACE="${RACE:-false}"

x_defs=()
x_def_errors=()

while read -r line || [[ -n "$line" ]]; do
if [[ "$line" =~ ^[[:space:]]*$ ]]; then
continue
elif [[ "$line" =~ ^([^[:space:]]+)[[:space:]]+(.*)[[:space:]]*$ ]]; then
var="${BASH_REMATCH[1]}"
def="${BASH_REMATCH[2]}"
eval "status_${var}=$(printf '%q' "$def")"
REPO_ROOT="${SCRIPT_DIR}/.."

# Read version data from committed files.
COLLECTOR_VERSION="$(cat "${REPO_ROOT}/COLLECTOR_VERSION")" || die "Missing COLLECTOR_VERSION"
SCANNER_VERSION="$(cat "${REPO_ROOT}/SCANNER_VERSION")" || die "Missing SCANNER_VERSION"
FACT_VERSION="$(cat "${REPO_ROOT}/FACT_VERSION")" || die "Missing FACT_VERSION"

# Generate version data file. Tests use only the base tag (stable across
# commits) to keep ActionIDs stable for test result caching. Builds get
# the full git-describe version with commit count and SHA.
generate_version_file() {
local target="${REPO_ROOT}/pkg/version/internal/zversion.go"
local main_version git_short_sha

if [[ "$TOOL" == "test" ]]; then
# Base tag only (e.g. "4.11.x") — stable across commits.
main_version="$(cd "${REPO_ROOT}"; git describe --tags --abbrev=0 --exclude '*-nightly-*' 2>/dev/null)" || die "git describe failed"
git_short_sha=""
elif [[ -n "${BUILD_TAG:-}" ]]; then
# Konflux/release builds set BUILD_TAG to the full version string.
# Use it directly (the Docker build context has no .git directory).
main_version="${BUILD_TAG}"
git_short_sha="$(echo "$BUILD_TAG" | sed -n 's/.*g\([0-9a-f]\{1,\}\)$/\1/p')"
else
die "Malformed status.sh output line ${line}"
# Full version from git describe (e.g. "4.11.x-193-g7257553280").
main_version="$(cd "${REPO_ROOT}"; git describe --tags --abbrev=10 --long --exclude '*-nightly-*' 2>/dev/null)" || die "git describe failed"
git_short_sha="$(cd "${REPO_ROOT}"; git rev-parse --short HEAD 2>/dev/null || echo "")"
fi
done < <(cd "${SCRIPT_DIR}/.."; ./status.sh)

while read -r line || [[ -n "$line" ]]; do
if [[ "$line" =~ ^[[:space:]]*$ ]]; then
continue
elif [[ "$line" =~ ^([^:]+):([[:digit:]]+):[[:space:]]*(var[[:space:]]+)?([^[:space:]]+)[[:space:]].*//XDef:([^[:space:]]+)[[:space:]]*$ ]]; then
go_file="${BASH_REMATCH[1]}"
go_line="${BASH_REMATCH[2]}"
go_var="${BASH_REMATCH[4]}"
status_var="${BASH_REMATCH[5]}"

varname="status_${status_var}"
[[ -n "${!varname}" ]] || x_def_errors+=(
"Variable ${go_var} defined in ${go_file}:${go_line} references status var ${status_var} that is not part of the status.sh output"
)
go_package="$(cd "${SCRIPT_DIR}/.."; go list -e "./$(dirname "$go_file")")"

x_defs+=(-X "\"${go_package}.${go_var}=${!varname}\"")

local new_content
new_content="// Code generated by go-tool.sh; DO NOT EDIT.

package internal

func init() {
MainVersion = \"${main_version}\"
CollectorVersion = \"${COLLECTOR_VERSION}\"
FactVersion = \"${FACT_VERSION}\"
ScannerVersion = \"${SCANNER_VERSION}\"
GitShortSha = \"${git_short_sha}\"
}"
if [[ -f "$target" ]] && [[ "$(cat "$target")" == "$new_content" ]]; then
return
fi
done < <(git -C "${SCRIPT_DIR}/.." grep -n '//XDef:' -- '*.go')
if [[ "${#x_def_errors[@]}" -gt 0 ]]; then
printf >&2 "%s\n" "${x_def_errors[@]}"
exit 1
fi
echo "$new_content" > "$target"
}
generate_version_file

ldflags=("${x_defs[@]}")
ldflags=()
if [[ "$DEBUG_BUILD" != "yes" ]]; then
ldflags+=(-s -w)
fi
Expand Down
Loading