build: track Makefile Go tool pins in a nested tools module - #294
build: track Makefile Go tool pins in a nested tools module#294asivanadi0 wants to merge 2 commits into
Conversation
| volcano.sh/apis v1.15.1 // indirect | ||
| ) | ||
|
|
||
| tool ( |
There was a problem hiding this comment.
MAJOR: Putting the tool chain in the root module raises the require count from 103 to 305 — golangci-lint's tree, almost all // indirect. This module is importable: consumers use api/v1alpha1 for the CRD types, so every consumer's module graph inherits those 200 entries and MVS considers their versions when resolving shared dependencies.
That cost is not needed to get the automation. A nested tools/go.mod keeps tool dependencies out of the root graph entirely, and Dependabot reaches it with a second gomod entry using directory: /tools. The Makefile's gomodver call changes only which file it reads.
Worth deciding before merge rather than after: once a consumer pins a version of this module, the published graph is what they resolved against.
Minimum correction: either move the tool requires to a nested tools/go.mod with a matching Dependabot directory entry, or state in the PR why the root-module graph is the accepted trade-off.
There was a problem hiding this comment.
Moved the tool dependencies into a nested tools/go.mod and added a Dependabot gomod entry at directory: /tools. Root module is back to 103 requires, so the tool graph stays out of consumers importing api/v1alpha1.
| // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| //go:build tools |
There was a problem hiding this comment.
MINOR: With the tool ( block present in go.mod, this build-tagged blank-import file looks redundant. tool directives are the Go 1.24+ mechanism and go mod tidy retains the requires they name; the //go:build tools pattern is what they replaced. This file's own comment says the tool lines are what keep tidy from dropping the requires, which argues the same thing.
Minimum correction: delete the file, run go mod tidy, and confirm the six requires survive. If they do, this also reverts the tools addition to the addlicense path list in the Makefile.
There was a problem hiding this comment.
Deleted tools/tools.go, ran go mod tidy in the tools module, and confirmed all six tool requires survive as indirect requirements. Also removed tools from the addlicense path list.
The Makefile pinned six Go CLIs as hard-coded *_VERSION variables that no Dependabot ecosystem parses, so they were bumped by hand and only noticed during release prep. Put the pins in a nested tools/go.mod as `tool` directives and have the Makefile read them with gomodver, which now takes an optional module directory. A second `gomod` entry with `directory: /tools` brings them under Dependabot on the same weekly schedule and cooldown as the root module. The tool chain lives in its own module rather than the root one on purpose. This module is importable -- consumers use api/v1alpha1 for the CRD types -- and golangci-lint's tree alone would take the root module from 103 requires to ~305, nearly all indirect. Every consumer would inherit that graph and MVS would weigh those versions when resolving shared dependencies. A nested module keeps them out entirely; the root go.mod and go.sum are untouched. No tools.go blank-import file: the `tool` directives are the Go 1.24+ mechanism for this, and `go mod tidy` retains the requires they name without one. verify-mod now tidies both modules so the new one cannot drift. The non-Go pins (cosign and crane workflow input defaults, syft plus its digest, yq, kind, tilt, kwok) stay manual and are documented as such: they sit outside any module graph, and several need a companion digest or a release-format review that a blind bump would skip. Signed-off-by: asivanadi0 <asivanadi0@users.noreply.github.com>
`go install pkg@version` resolves the Go toolchain from the tool module's own go directive, which can be older than this repo's. golangci-lint built that way on go1.26 refuses a go.mod asking for 1.27.0, so the install succeeds and the tool then fails on the tree it is meant to check. Pin GOTOOLCHAIN to this module's Go version for the install, and fail loudly when a version resolves empty rather than silently installing @latest, which is what an unlisted tool would otherwise get. Signed-off-by: asivanadi0 <asivanadi0@users.noreply.github.com>
e62cc58 to
d554386
Compare
asivanadi0
changed the title
2 participants
Closes #279
Draft of the tools.go / Dependabot work. Issue-first: waiting on maintainer ack (especially the go.mod expansion). See asivanadi0#1 for the full test plan.