From 029e8df21eb6d744bc5c430e294fbad5ce659b1b Mon Sep 17 00:00:00 2001 From: Reynier Ortiz Vega Date: Fri, 11 Sep 2026 12:04:35 -0400 Subject: [PATCH 1/3] Detect stale nested-module pins before release validate-release.sh only checked that a required redisconn/* tag existed, not that the pinned version still matches the current tree. #287 changed redisconn's Config without bumping its tag, so root releases v0.0.44-v0.0.46 shipped referencing a stale, incompatible redisconn v0.0.1 via the module proxy. Also wire test-validate-release.sh into CI; it previously ran only through the local Taskfile. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/test.yml | 3 +++ scripts/test-validate-release.sh | 8 ++++++++ scripts/testdata/release-stale-pin/go.mod | 10 ++++++++++ scripts/validate-release.sh | 9 ++++++++- 4 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 scripts/testdata/release-stale-pin/go.mod diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 6c7b7aa..e46f5d5 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -15,6 +15,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 @@ -46,6 +48,7 @@ jobs: - name: Check standalone Redis modules run: | + ./scripts/test-validate-release.sh ./scripts/check-redisconn-modules.sh for module in redisconn redisconn/aws redisconn/azure redisconn/gcp; do (cd "$module" && GOWORK=off go mod tidy && GOWORK=off go mod verify && GOWORK=off go test -race ./... && GOWORK=off go vet ./...) diff --git a/scripts/test-validate-release.sh b/scripts/test-validate-release.sh index 94d2b82..9a60382 100755 --- a/scripts/test-validate-release.sh +++ b/scripts/test-validate-release.sh @@ -35,6 +35,14 @@ if ( echo "provider release unexpectedly accepted development core version" >&2 exit 1 fi +if ( + cd scripts/testdata/release-stale-pin + ../../../scripts/validate-release.sh v1.2.3 >/dev/null 2>&1 +); then + echo "root release unexpectedly accepted a real but stale (drifted) redisconn pin" >&2 + exit 1 +fi + if ./scripts/validate-release.sh redisconn/not-a-version >/dev/null 2>&1; then echo "malformed release tag unexpectedly accepted" >&2 exit 1 diff --git a/scripts/testdata/release-stale-pin/go.mod b/scripts/testdata/release-stale-pin/go.mod new file mode 100644 index 0000000..c0ac769 --- /dev/null +++ b/scripts/testdata/release-stale-pin/go.mod @@ -0,0 +1,10 @@ +module github.com/stacklok/toolhive-core + +go 1.27 + +require ( + github.com/stacklok/toolhive-core/redisconn v0.0.1 + github.com/stacklok/toolhive-core/redisconn/aws v0.0.1 + github.com/stacklok/toolhive-core/redisconn/azure v0.0.1 + github.com/stacklok/toolhive-core/redisconn/gcp v0.0.1 +) diff --git a/scripts/validate-release.sh b/scripts/validate-release.sh index 80a6225..6bd36c7 100755 --- a/scripts/validate-release.sh +++ b/scripts/validate-release.sh @@ -40,13 +40,20 @@ requirements=$(awk ' $1 == "require" && $2 ~ /^github\.com\/stacklok\/toolhive-core\/redisconn(\/(aws|azure|gcp))?$/ { print $2, $3 } ' "$manifest") +repo_root=$(git rev-parse --show-toplevel) + printf '%s\n' "$requirements" | while read -r module required_version; do [ -n "$module" ] || continue - required_tag=${module#github.com/stacklok/toolhive-core/}/$required_version + child_dir=${module#github.com/stacklok/toolhive-core/} + required_tag=$child_dir/$required_version if ! git rev-parse --verify --quiet "refs/tags/$required_tag^{commit}" >/dev/null; then echo "$manifest requires $module $required_version, but released tag $required_tag is not available locally; fetch required previous tags before tagging $tag" >&2 exit 1 fi + if ! git -C "$repo_root" diff --quiet "$required_tag" -- "$child_dir"; then + echo "$manifest requires $module $required_version, but $child_dir has changed since $required_tag was tagged; publish a new $child_dir tag and update this manifest's requirement before tagging $tag" >&2 + exit 1 + fi done echo "release manifest validation passed for $tag ($manifest)" From de2b2a0eb8a1fa0f0945b0d32b89cfb978e4c73f Mon Sep 17 00:00:00 2001 From: Reynier Ortiz Vega Date: Fri, 11 Sep 2026 12:10:30 -0400 Subject: [PATCH 2/3] Drop dev-only replace directives in redisconn providers Renovate already bumped the redisconn requirement in these manifests to the released v0.0.2 (#293), which was the only part of #292 not already applied; folding in the remaining replace-directive removal here supersedes that PR. Co-Authored-By: Claude Sonnet 5 --- redisconn/aws/go.mod | 4 ---- redisconn/aws/go.sum | 2 ++ redisconn/azure/go.mod | 4 ---- redisconn/azure/go.sum | 2 ++ redisconn/gcp/go.mod | 4 ---- redisconn/gcp/go.sum | 2 ++ 6 files changed, 6 insertions(+), 12 deletions(-) diff --git a/redisconn/aws/go.mod b/redisconn/aws/go.mod index 8ad7355..b25e694 100644 --- a/redisconn/aws/go.mod +++ b/redisconn/aws/go.mod @@ -2,10 +2,6 @@ module github.com/stacklok/toolhive-core/redisconn/aws go 1.27 -// Development-only replacement for the untagged sibling module. Dependency -// module replacements are ignored by downstream consumers. -replace github.com/stacklok/toolhive-core/redisconn => .. - require ( github.com/aws/aws-sdk-go-v2 v1.47.0 github.com/aws/aws-sdk-go-v2/config v1.33.4 diff --git a/redisconn/aws/go.sum b/redisconn/aws/go.sum index 750f270..2447696 100644 --- a/redisconn/aws/go.sum +++ b/redisconn/aws/go.sum @@ -42,6 +42,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0= github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4= +github.com/stacklok/toolhive-core/redisconn v0.0.2 h1:Ju7+LrajHdpCpBe5xmGdle1z0F/F2qByUdzZi6YSgJ4= +github.com/stacklok/toolhive-core/redisconn v0.0.2/go.mod h1:YaR5xDqbFc+eoP7sDPi6rHyh6Vh90HQciGpCQtD5VeY= github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= diff --git a/redisconn/azure/go.mod b/redisconn/azure/go.mod index ce435c3..3b59336 100644 --- a/redisconn/azure/go.mod +++ b/redisconn/azure/go.mod @@ -2,10 +2,6 @@ module github.com/stacklok/toolhive-core/redisconn/azure go 1.27 -// Development-only replacement for the untagged sibling module. Dependency -// module replacements are ignored by downstream consumers. -replace github.com/stacklok/toolhive-core/redisconn => .. - require ( github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 diff --git a/redisconn/azure/go.sum b/redisconn/azure/go.sum index 2bc84b9..e193c57 100644 --- a/redisconn/azure/go.sum +++ b/redisconn/azure/go.sum @@ -32,6 +32,8 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmd github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU= github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0= github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4= +github.com/stacklok/toolhive-core/redisconn v0.0.2 h1:Ju7+LrajHdpCpBe5xmGdle1z0F/F2qByUdzZi6YSgJ4= +github.com/stacklok/toolhive-core/redisconn v0.0.2/go.mod h1:YaR5xDqbFc+eoP7sDPi6rHyh6Vh90HQciGpCQtD5VeY= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= diff --git a/redisconn/gcp/go.mod b/redisconn/gcp/go.mod index 5b2c96a..2f5f7d7 100644 --- a/redisconn/gcp/go.mod +++ b/redisconn/gcp/go.mod @@ -2,10 +2,6 @@ module github.com/stacklok/toolhive-core/redisconn/gcp go 1.27 -// Development-only replacement for the untagged sibling module. Dependency -// module replacements are ignored by downstream consumers. -replace github.com/stacklok/toolhive-core/redisconn => .. - require ( github.com/stacklok/toolhive-core/redisconn v0.0.2 golang.org/x/oauth2 v0.37.0 diff --git a/redisconn/gcp/go.sum b/redisconn/gcp/go.sum index c4171ee..eff43ae 100644 --- a/redisconn/gcp/go.sum +++ b/redisconn/gcp/go.sum @@ -18,6 +18,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0= github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4= +github.com/stacklok/toolhive-core/redisconn v0.0.2 h1:Ju7+LrajHdpCpBe5xmGdle1z0F/F2qByUdzZi6YSgJ4= +github.com/stacklok/toolhive-core/redisconn v0.0.2/go.mod h1:YaR5xDqbFc+eoP7sDPi6rHyh6Vh90HQciGpCQtD5VeY= github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= From 184b6ace3ef282f716539a542a9f7a2f76686090 Mon Sep 17 00:00:00 2001 From: Reynier Ortiz Vega Date: Fri, 11 Sep 2026 12:13:55 -0400 Subject: [PATCH 3/3] Revert "Drop dev-only replace directives in redisconn providers" This reverts commit de2b2a0eb8a1fa0f0945b0d32b89cfb978e4c73f. --- redisconn/aws/go.mod | 4 ++++ redisconn/aws/go.sum | 2 -- redisconn/azure/go.mod | 4 ++++ redisconn/azure/go.sum | 2 -- redisconn/gcp/go.mod | 4 ++++ redisconn/gcp/go.sum | 2 -- 6 files changed, 12 insertions(+), 6 deletions(-) diff --git a/redisconn/aws/go.mod b/redisconn/aws/go.mod index b25e694..8ad7355 100644 --- a/redisconn/aws/go.mod +++ b/redisconn/aws/go.mod @@ -2,6 +2,10 @@ module github.com/stacklok/toolhive-core/redisconn/aws go 1.27 +// Development-only replacement for the untagged sibling module. Dependency +// module replacements are ignored by downstream consumers. +replace github.com/stacklok/toolhive-core/redisconn => .. + require ( github.com/aws/aws-sdk-go-v2 v1.47.0 github.com/aws/aws-sdk-go-v2/config v1.33.4 diff --git a/redisconn/aws/go.sum b/redisconn/aws/go.sum index 2447696..750f270 100644 --- a/redisconn/aws/go.sum +++ b/redisconn/aws/go.sum @@ -42,8 +42,6 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0= github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4= -github.com/stacklok/toolhive-core/redisconn v0.0.2 h1:Ju7+LrajHdpCpBe5xmGdle1z0F/F2qByUdzZi6YSgJ4= -github.com/stacklok/toolhive-core/redisconn v0.0.2/go.mod h1:YaR5xDqbFc+eoP7sDPi6rHyh6Vh90HQciGpCQtD5VeY= github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= diff --git a/redisconn/azure/go.mod b/redisconn/azure/go.mod index 3b59336..ce435c3 100644 --- a/redisconn/azure/go.mod +++ b/redisconn/azure/go.mod @@ -2,6 +2,10 @@ module github.com/stacklok/toolhive-core/redisconn/azure go 1.27 +// Development-only replacement for the untagged sibling module. Dependency +// module replacements are ignored by downstream consumers. +replace github.com/stacklok/toolhive-core/redisconn => .. + require ( github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 diff --git a/redisconn/azure/go.sum b/redisconn/azure/go.sum index e193c57..2bc84b9 100644 --- a/redisconn/azure/go.sum +++ b/redisconn/azure/go.sum @@ -32,8 +32,6 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmd github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU= github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0= github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4= -github.com/stacklok/toolhive-core/redisconn v0.0.2 h1:Ju7+LrajHdpCpBe5xmGdle1z0F/F2qByUdzZi6YSgJ4= -github.com/stacklok/toolhive-core/redisconn v0.0.2/go.mod h1:YaR5xDqbFc+eoP7sDPi6rHyh6Vh90HQciGpCQtD5VeY= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= diff --git a/redisconn/gcp/go.mod b/redisconn/gcp/go.mod index 2f5f7d7..5b2c96a 100644 --- a/redisconn/gcp/go.mod +++ b/redisconn/gcp/go.mod @@ -2,6 +2,10 @@ module github.com/stacklok/toolhive-core/redisconn/gcp go 1.27 +// Development-only replacement for the untagged sibling module. Dependency +// module replacements are ignored by downstream consumers. +replace github.com/stacklok/toolhive-core/redisconn => .. + require ( github.com/stacklok/toolhive-core/redisconn v0.0.2 golang.org/x/oauth2 v0.37.0 diff --git a/redisconn/gcp/go.sum b/redisconn/gcp/go.sum index eff43ae..c4171ee 100644 --- a/redisconn/gcp/go.sum +++ b/redisconn/gcp/go.sum @@ -18,8 +18,6 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0= github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4= -github.com/stacklok/toolhive-core/redisconn v0.0.2 h1:Ju7+LrajHdpCpBe5xmGdle1z0F/F2qByUdzZi6YSgJ4= -github.com/stacklok/toolhive-core/redisconn v0.0.2/go.mod h1:YaR5xDqbFc+eoP7sDPi6rHyh6Vh90HQciGpCQtD5VeY= github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=