build: stamp the module version from git in the Docker build - #4496
Open
stevenvegt wants to merge 14 commits into
Open
build: stamp the module version from git in the Docker build#4496stevenvegt wants to merge 14 commits into
stevenvegt wants to merge 14 commits into
Conversation
Rewritten with "gomajor path -version v6". Refs #4485 Assisted-by: AI
Assisted-by: AI (cherry picked from commit 35d3bcc)
The ldflags -X keys in the Dockerfile, makefile and binaries workflow now take the module path from "go list -m" instead of hardcoding it, so a major version bump only touches go.mod, the imports and the .proto go_package options. "make bump-major" does all of those. .dockerignore now excludes only untracked files. Excluding tracked files made "git status" inside the builder report deletions, which stamped the version as "+dirty". Assisted-by: AI (cherry picked from commit d87b2ba)
Assisted-by: AI (cherry picked from commit c5f2cdd)
Assisted-by: AI (cherry picked from commit d0091ac)
Assisted-by: AI (cherry picked from commit d9d1a01)
Assisted-by: AI
Review feedback: how the version reaches the binary (git stamping in the Docker build, .dockerignore, checkout depth, makefile and workflow changes) is a separate concern and moves to a follow-up PR. This commit returns the branch to the rename only: gomajor rewrite, the module path in the existing ldflags keys, and the .proto go_package options. Assisted-by: AI
The ldflags -X keys in the Dockerfile, makefile and binaries workflow now take the module path from "go list -m" instead of hardcoding it, so a major version bump only touches go.mod, the imports and the .proto go_package options. "make bump-major" does all of those. .dockerignore now excludes only untracked files. Excluding tracked files made "git status" inside the builder report deletions, which stamped the version as "+dirty". Assisted-by: AI (cherry picked from commit d87b2ba) (cherry picked from commit 6d36d6e)
stevenvegt
requested review from
Dirklectisch,
JorisHeadease,
gerardsn,
reinkrul and
woutslakhorst
as code owners
September 9, 2026 08:52
Contributor
1 new issue
|
master tracks .claude/commands/sync-release-notes.md. Excluding the whole .claude directory made git inside the builder report it as deleted, so the stamped version got a "+dirty" suffix. Exclude only the local parts. Assisted-by: AI
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #4490, split out per review feedback there. Stacked on the rename branch so the diff shows only these changes; to be retargeted to master once #4490 merges.
With the module path carrying its major version,
go buildcan stamp the version into the binary's build info from the checked-out tag. Build info is the first thing every image scanner reads, ahead of any ldflags heuristics, so this makes the version visible without scanner-specific tricks. This PR makes the Docker build able to do that and tidies the build files around it.Commits:
golang:alpinedoes not ship it, and without git there is nothing to stamp from.go list -minstead of hardcoding it, so the next major bump does not touch them;make bump-majorwraps gomajor plus the.protorewrite..dockerignoreexcludes only untracked files: with tracked files excluded,git statusinside the builder saw deletions and stamped the version as+dirty, which Syft and Trivy carried into the package URL.:masterimage needs the history back to the nearest tag. Without it an untagged build is stampedv6.0.0-<time>-<rev>, which sorts below every release.apk addlines..dockerignorekeeps the tracked.claude/commandsdirectory and excludes only the local parts of.claude. Rule for the future:.dockerignoremust never exclude a tracked file, otherwisegit statusinside the builder reports a deletion and the stamp gets a+dirtysuffix. This is what the first local build on master showed.Trade-offs, stated explicitly:
.gitand the tracked files in the build context means every commit invalidates theCOPY . .layer in local Docker builds, so a docs-only commit rebuilds the binary. CI is unaffected: runners start clean and the workflow configures no layer cache. Stamping from git cannot coexist with the old cache behaviour, because.gitchanges every commit.Verified locally at a throwaway tag: a plain
go build, a depth-1 clone anddocker buildall reportgithub.com/nuts-foundation/nuts-node/v6 v6.2.99in build info withvcs.modified=false, and Syft and Trivy read that version. zizmor and hadolint report nothing new.Once this merges, #4486 (interim ldflags approach) should be closed: its
-buildvcs=falsewould block the stamping. Backports of this PR to V6.2 and V5.4 follow after #4487 and #4491.