Skip to content

feat: resolve dependency version ranges#3572

Draft
kichristensen wants to merge 9 commits intogetporter:mainfrom
kichristensen:dependencyRanges
Draft

feat: resolve dependency version ranges#3572
kichristensen wants to merge 9 commits intogetporter:mainfrom
kichristensen:dependencyRanges

Conversation

@kichristensen
Copy link
Contributor

@kichristensen kichristensen commented Mar 21, 2026

What does this change

Adds a dependencies.version-strategy setting that controls how Porter selects a bundle version when a dependency declares a semver version range instead of a pinned tag.

Supported strategies:

  • exact (default) — error if the dependency specifies only a range and no pinned tag
  • max-patch — pick the highest patch release within the same major.minor as the default tag in the dependency reference
  • max-minor — pick the highest minor+patch release within the same major as the default tag
  • min — pick the lowest release satisfying the stated range

The setting can be configured via the config file, the PORTER_DEPENDENCIES_VERSION_STRATEGY environment variable, or the --dependencies-version-strategy flag on install and upgrade.

What issue does it fix

Partially resolves #2683 (part of epic #2678).

Not implemented: version reconciliation when two dependencies reference the same bundle with overlapping ranges (shared node selection described in #2683).

Notes for the reviewer

max-patch and max-minor derive their narrowing constraint from the semver tag encoded in the bundle's dependency reference (e.g. example.com/mysql:v1.2.3). If no version tag is present in the default reference, both strategies fall back to picking the highest tag satisfying the stated range.

Checklist

  • Did you write tests?
  • Did you write documentation?
  • Did you change porter.yaml or a storage document record? Update the corresponding schema file.
  • If this is your first pull request, please add your name to the bottom of our Contributors list. Thank you for making Porter better! 🙇‍♀️

Add DependenciesConfig struct, constants for the four strategies
(exact, max-patch, max-minor, min), and GetDependenciesVersionStrategy
accessor that defaults to "exact".

Signed-off-by: Kim Christensen <kimworking@gmail.com>
- Add versionStrategy field and WithVersionStrategy builder
- Update filterAndSelectTag to accept a version constraint and
  respect min vs max ordering
- Update determineDefaultTag(v2) to pass constraint through
- Fix ResolveVersion (v1): resolve ranges via strategy; error on
  exact + range-only
- Fix ResolveVersionv2 (v2): resolve version constraint string via
  strategy instead of returning the ref unchanged
- Update tests: replace "not implemented" case with strategy cases

Signed-off-by: Kim Christensen <kimworking@gmail.com>
- Add DependenciesVersionStrategy to BundleExecutionOptions
- Wire flag > global config fallback in identifyDependencies
- Add --dependencies-version-strategy flag to install and upgrade
  commands with viper-key binding to dependencies.version-strategy

Signed-off-by: Kim Christensen <kimworking@gmail.com>
- Config accessor: TestGetDependenciesVersionStrategy (unit)
- Config loading: file, env var, env-over-file (unit)
- Extended bundle v2: TestExtendedBundle_ResolveVersionv2 with all
  strategies and error cases (unit)
- Integration: config file, env var, multi-context config loading
  of dependencies.version-strategy (integration tag)

Signed-off-by: Kim Christensen <kimworking@gmail.com>
- Add registryListTagsAdapter to fix registry mock wiring
- Add unit tests (pkg/porter/dependencies_test.go) covering
  exact/max-patch/min/max-minor strategies and config fallback
- Add integration tests (tests/integration/) for install and
  upgrade verifying strategy selection via MockPullBundle
- Register new integration test in both CI workflows

Signed-off-by: Kim Christensen <kimworking@gmail.com>
max-patch now restricts resolution to the same major.minor
as the default version in the dependency reference.
max-minor restricts to the same major version.

Both strategies derive the narrowing constraint from the
semver tag encoded in the bundle's dependency reference
(e.g. example.com/mysql:v1.2.3).

Add unit and integration tests covering both behaviors.

Signed-off-by: Kim Christensen <kimworking@gmail.com>
Add dependencies.version-strategy to the configuration
reference and config file example. Document the semantic
difference between max-patch, max-minor, min, and exact,
including how the default tag anchors the range.

Add a Version Ranges section to the dependencies authoring
guide with examples and a strategy comparison table.

Signed-off-by: Kim Christensen <kimworking@gmail.com>
Signed-off-by: Kim Christensen <kimworking@gmail.com>
Signed-off-by: Kim Christensen <kimworking@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Resolve dependency to using version ranges

1 participant