build: align tool versions with the release baseline - #300
Merged
Conversation
Two version gaps against the org baseline: - golangci-lint was on v2.5.0, seven minor versions behind the version the other operators use. More importantly, golangci-lint-action was invoked without a `version:` input, so CI always installed the newest release. That makes the pipeline fail on an upstream release with no change here, and it silently diverges from what `make lint` runs locally. Pin both to v2.12.1. - chainsaw was on v0.2.13; v0.2.14 is the baseline. `make lint` reports 0 issues after the upgrade - the seven-version jump introduced no new findings. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
publish.yml could only be triggered by a push to main, so the credentials it needs could not be verified on demand. An expired HELM_CHARTS_REPO_TOKEN went unnoticed for weeks because nothing happened to land on main during that window, and it only surfaced when an unrelated change did. workflow_dispatch makes the publish path exercisable before a release rather than discovering a dead credential at tag time, when the tag cannot be recut. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Part of the 0.4.0 release baseline alignment. commons-operator is wave 1 in the
release order — every other operator depends on it — so its pipeline needs to be
on the baseline before anything else is cut.
Two gaps:
golangci-lint was floating.
golangci-lint-actionwas invoked with noversion:input, so CI always installed the newest release. That makes thepipeline break on an upstream release with no change here, and it silently
diverges from what
make lintruns locally. The Makefile was also on v2.5.0,seven minor versions behind the version the other operators use.
chainsaw was on v0.2.13, while the baseline is v0.2.14.
Separately,
publish.ymlcould only be triggered by a push to main. That is howan expired
HELM_CHARTS_REPO_TOKENwent unnoticed for weeks: nothing landed onmain during that window, so nothing exercised the credential, and it only
surfaced when an unrelated change finally did. Adding
workflow_dispatchmakesthe publish path verifiable on demand — the alternative is discovering a dead
credential at tag time, when the tag cannot be recut.
Verification
Run locally against these changes:
make lint(v2.12.1)make testcheck-crds-sync(simulated per the CI logic, clean tree)make helm-crd-syncworkflow_dispatchparses as expected🤖 Generated with Claude Code