chore(azldev): move azldev to a proper go module tool#18052
Draft
dmcilvaney wants to merge 4 commits into
Draft
Conversation
The rendered-specs check built azldev from the PR head's .azldev-version and gated the full re-render on a two-dot `base..head` diff of .azldev-version. Both are wrong for a branch merely behind base on the pin: the head value is stale (not what runs on 4.0 after merge), and the two-dot diff fires a spurious full re-render that can only ever find no drift. Resolve the version that will actually be in effect on 4.0 after the PR merges: read .azldev-version from GitHub's test-merge commit via the Contents API -- no merge tree is checked out, only a single regex-validated string crosses to the host. GitHub computes mergeability asynchronously and the event's merge_commit_sha can be empty or stale, so poll the PR endpoint for the authoritative value and fail closed on a genuinely non-mergeable PR. Resolve once in update_locks (which polls mergeability, hence pull-requests:read) and expose azldev-version + render-all as job outputs that the render job consumes, so both jobs check drift against the same binary. A full re-render runs only when that post-merge version differs from the base pin -- i.e. the PR changes the azldev binary on 4.0 -- otherwise the normal PR-scoped render runs.
Contributor
There was a problem hiding this comment.
Pull request overview
Moves azldev version management into Go modules and updates CI to resolve and validate immutable tool hashes.
Changes:
- Adds the azldev Go tool dependency and supporting documentation.
- Refactors GitHub and ADO workflows to resolve the post-merge azldev hash.
- Adds resolver tests and dependency-smoke coverage.
Reviewed changes
Copilot reviewed 14 out of 15 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
go.mod |
Declares the azldev tool and dependencies. |
go.sum |
Locks Go dependency checksums. |
DEVELOPING.md |
Documents Go-based installation and usage. |
.github/workflows/lint.yaml |
Runs azldev through go tool. |
.github/workflows/dependency-smoke.yml |
Adds resolver test execution. |
.github/workflows/azldev-smoke.yml |
Builds the runner from a resolved hash. |
.github/workflows/check-rendered-specs.yml |
Resolves the post-merge tool and render scope. |
.github/workflows/containers/azldev-runner.Dockerfile |
Installs azldev using an immutable hash. |
.github/workflows/ado/templates/steps/install-deps.yml |
Resolves azldev from go.mod. |
.github/workflows/ado/templates/steps/get-changes-info.yml |
Validates PR commit state before installation. |
.github/instructions/pr-check-workflows.instructions.md |
Updates runner-build guidance. |
scripts/ci/render-specs-check/resolve_azldev_version.py |
Implements secure version/hash resolution. |
scripts/ci/render-specs-check/tests/conftest.py |
Configures resolver test imports. |
scripts/ci/render-specs-check/tests/requirements.txt |
Pins pytest. |
scripts/ci/render-specs-check/tests/test_resolve_azldev_version.py |
Tests resolver behavior and validation. |
Comment on lines
+97
to
+105
| version = _run_go( | ||
| "list", | ||
| "-mod=readonly", | ||
| f"-modfile={path.resolve()}", | ||
| "-m", | ||
| "-f", | ||
| "{{.Version}}", | ||
| AZLDEV_MODULE, | ||
| ) |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 14 out of 15 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
go.mod:5
- The stated Dependabot migration is incomplete:
.github/dependabot.ymlcurrently configures onlypipandgithub-actions, so Dependabot will not scan this root Go module or propose azldev updates. Add a rootgomodupdate entry (preferably scoped togithub.com/microsoft/azure-linux-dev-tools) so this tool declaration is actually managed as intended.
tool github.com/microsoft/azure-linux-dev-tools/cmd/azldev
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 15 out of 16 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
scripts/ci/render-specs-check/resolve_azldev_version.py:125
- Resolving only the azldev module to a commit hash does not reproduce the tool selected by this repository's module graph.
go tool azldevand the documented unversionedgo installhonor rootgo.modtransitive versions/replacements, while every Docker/ADO install usesgo install ...@<hash>, which ignores rootgo.mod. Consequently, a Dependabot transitive update (explicitly enabled here) can change the developer/lint binary without changing this hash or settingrender-all, so the render gates test a different binary. Build CI from a validated post-merge module graph, or restrict and validate the graph so only the top-level azldev pin can vary.
module = json.loads(_run_go("mod", "download", "-json", f"{AZLDEV_MODULE}@{version}"))
|
|
||
| go 1.25.6 | ||
|
|
||
| tool github.com/microsoft/azure-linux-dev-tools/cmd/azldev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Golang supports
go tool <toolname>which allows you to version control go tools via ago.modfile.Move away from the
.azldev-versionso we can rely ondependabotto manage the azldev version.