build: add /v6 major version suffix to the module path - #4490
Merged
Conversation
Rewritten with "gomajor path -version v6". Refs #4485 Assisted-by: AI
Assisted-by: AI (cherry picked from commit 35d3bcc)
The ldflags -X keys in the Dockerfile, makefile and binaries workflow now take the module path from "go list -m" instead of hardcoding it, so a major version bump only touches go.mod, the imports and the .proto go_package options. "make bump-major" does all of those. .dockerignore now excludes only untracked files. Excluding tracked files made "git status" inside the builder report deletions, which stamped the version as "+dirty". Assisted-by: AI (cherry picked from commit d87b2ba)
Assisted-by: AI (cherry picked from commit c5f2cdd)
Assisted-by: AI (cherry picked from commit d0091ac)
Assisted-by: AI (cherry picked from commit d9d1a01)
Assisted-by: AI
stevenvegt
requested review from
Dirklectisch,
JorisHeadease,
gerardsn,
reinkrul and
woutslakhorst
as code owners
September 9, 2026 08:12
Contributor
reinkrul
requested changes
Sep 9, 2026
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| with: | ||
| persist-credentials: false | ||
| # Full history so go build can derive the version from the nearest |
Member
There was a problem hiding this comment.
won't this be a lot slower and wasteful CPU/network traffic? Can't we just fetch what we need?
Comment on lines
+1
to
+19
| # Only untracked and local files are excluded. Tracked files must stay in the | ||
| # build context: go build runs "git status" to stamp the module version from | ||
| # the checked-out tag, and marks the version "+dirty" when tracked files are | ||
| # missing (see Dockerfile). | ||
| .claude | ||
| .idea | ||
| .run | ||
| .DS_Store | ||
| **/.DS_Store | ||
| CLAUDE-* | ||
| data | ||
| e2e-tests | ||
| **/data | ||
| docs/_build | ||
| *.pem | ||
| *.key | ||
| *.db | ||
| nuts | ||
| nuts-node | ||
| nuts.yaml |
Member
There was a problem hiding this comment.
It was so because we optimized for build speed and Docker layer cache, do you realize you're changing that trade-off?
Why is "get tag from Git instead of env params "even part of this PR? Feels like scope creep
Review feedback: how the version reaches the binary (git stamping in the Docker build, .dockerignore, checkout depth, makefile and workflow changes) is a separate concern and moves to a follow-up PR. This commit returns the branch to the rename only: gomajor rewrite, the module path in the existing ldflags keys, and the .proto go_package options. Assisted-by: AI
reinkrul
approved these changes
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #4485 for the master branch: the module path becomes
github.com/nuts-foundation/nuts-node/v6, which makes the v6.x tags valid module versions. That is what lets security advisories name our fix versions and lets scanners match images against them. See the issue for the reasoning.This PR is the rename only:
gomajor path -version v6rewrote go.mod and every import.-Xkeys in the build files and thego_packageoptions in the two.protofiles carry the new path. gomajor does not touch those.Nothing else changes. How the version reaches the binary (git stamping in the Docker build,
.dockerignore, checkout depth, makefile and workflow adjustments) is a separate concern and follows in its own PR, per review feedback on #4490. The branch history shows those commits and their removal; the squash merge keeps only the rename.Verified locally: the repo builds,
go mod tidychanges nothing beyond the module line, and no Go file imports the un-suffixed path.Follow-ups: downstream importers must switch to the
/v6import path to receive newer versions; after the first tag on this branch, the repository advisory can name the/v6package with that tag as the patched version.