build: add /v5 major version suffix to the module path - #4491
Merged
Conversation
Rewritten with "gomajor path -version v5". Refs #4485 Assisted-by: AI
Assisted-by: AI (cherry picked from commit 35d3bcc)
The ldflags -X keys in the Dockerfile, makefile and binaries workflow now take the module path from "go list -m" instead of hardcoding it, so a major version bump only touches go.mod, the imports and the .proto go_package options. "make bump-major" does all of those. .dockerignore now excludes only untracked files. Excluding tracked files made "git status" inside the builder report deletions, which stamped the version as "+dirty". Assisted-by: AI (cherry picked from commit d87b2ba)
Assisted-by: AI (cherry picked from commit d0091ac)
- persist-credentials: false and a read-only permissions block in the images workflow (zizmor artipacked and excessive-permissions, both pre-existing but surfaced by the edited checkout step) - hadolint DL3018 ignore on the git install; alpine drops old package versions from its repositories, so pinning breaks builds - gofmt of an import line that lost its tab in the merge from V6.2 Assisted-by: AI (cherry picked from commit 4dab80b)
Assisted-by: AI (cherry picked from commit d9d1a01)
Assisted-by: AI
Review feedback: how the version reaches the binary (git stamping in the Docker build, .dockerignore, checkout depth, makefile and workflow changes) is a separate concern and moves to a follow-up PR. This commit returns the branch to the rename only: gomajor rewrite, the module path in the existing ldflags keys, and the .proto go_package options. Assisted-by: AI
reinkrul
approved these changes
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #4485 for the V5.4 branch: the module path becomes
github.com/nuts-foundation/nuts-node/v5, which makes the v5.x tags valid module versions. That is what lets security advisories name our fix versions and lets scanners match images against them. See the issue for the reasoning.This PR is the rename only:
gomajor path -version v5rewrote go.mod and every import.-Xkeys in the build files and thego_packageoptions in the two.protofiles carry the new path. gomajor does not touch those.Nothing else changes. How the version reaches the binary (git stamping in the Docker build,
.dockerignore, checkout depth, makefile and workflow adjustments) is a separate concern and follows in its own PR, per review feedback on #4490. The branch history shows those commits and their removal; the squash merge keeps only the rename.Verified locally: the repo builds,
go mod tidychanges nothing beyond the module line, and no Go file imports the un-suffixed path.Follow-ups: downstream importers must switch to the
/v5import path to receive newer versions; after the first tag on this branch, the repository advisory can name the/v5package with that tag as the patched version.