ci(release): replace dead proxy-warm with direct-mode resolution check - #2
Closed
nodeselector wants to merge 1 commit into
Closed
ci(release): replace dead proxy-warm with direct-mode resolution check#2nodeselector wants to merge 1 commit into
nodeselector wants to merge 1 commit into
Conversation
The repo is private, so proxy.golang.org can't see the module and the warm curl 404'd on every run. Replace it with a toolchain resolution smoke test: spin up a throwaway module and 'go mod download MODULE@version' in direct mode (GOPROXY=direct, GOPRIVATE=github.com/github/*) — the same path consumers use. In CI, git auth is injected from GH_TOKEN via GIT_CONFIG_* so go's child git can fetch the private tag. Best-effort and non-fatal: the tag and Release are already published. Run locally it also warms the module cache. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
⚠️ Not ready to approve
The new smoke test as written will not work reliably (invalid go mod init module path under Go 1.19+ and non-portable mktemp -d for local runs), undermining the PR’s primary objective.
Pull request overview
This PR updates the Go submodule release workflow to remove the ineffective public Go proxy “warm” step (not applicable to a private module) and replace it with a best-effort direct-mode module resolution smoke test that mirrors how consumers fetch via GOPROXY=direct + GOPRIVATE.
Changes:
- Added a
verify_module_resolveshelper to create a temporary module andgo mod downloadthe just-released version in direct mode (with optional git auth injection viaGH_TOKEN). - Replaced the old
proxy.golang.orgcurl “warm” step with the new resolution check (non-fatal). - Updated
RELEASING.mdto reflect the new release behavior and rationale for private-module direct resolution.
File summaries
| File | Description |
|---|---|
script/release |
Replaces dead proxy warm with a direct-mode go mod download resolution smoke test, including optional git auth injection. |
RELEASING.md |
Updates release documentation to describe the new best-effort direct resolution verification for a private module. |
Copilot's findings
- Files reviewed: 2/2 changed files
- Comments generated: 2
Note
Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| dir="$(mktemp -d)" | ||
| ( | ||
| cd "$dir" | ||
| go mod init release-verify >/dev/null 2>&1 || exit 1 |
| # release-blocker, since the tag and Release are already published. | ||
| verify_module_resolves() { | ||
| local module_version="$1" dir status | ||
| dir="$(mktemp -d)" |
Copilot stopped work on behalf of
nodeselector due to an error
June 8, 2026 16:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1 (merged). One commit (
ab1f88d) that landed on the branch after #1 merged, so it isn't inmainyet.What & why
The first
go/v0.0.1release surfaced two things:The proxy-warm step was dead. This repo is private, so
proxy.golang.orgcan't see the module — the warmcurl404'd on every release. There's no shared proxy serving a private module anyway; the toolchain resolves itdirectover git.Replaced it with a direct-mode resolution smoke test: spin up a throwaway module and
go mod download <module>@<version>withGOPROXY=direct+GOPRIVATE=github.com/github/*— the same path consumers use. In CI, git auth is injected fromGH_TOKENviaGIT_CONFIG_*sogo's child git can fetch the private tag. Best-effort and non-fatal: the tag and Release are already published by then. Run locally, it also warms your module cache.main'sscript/releasestill has the deadcurl(line 117); this lands the fix so the next release frommainis clean.CodeQL
Analyze (csharp)was red. That was default code-scanning setup auto-detecting C# from the old dotnet harness (since deleted). The default-setup language list is already corrected toactions, go— no repo file references C#. Merging this refreshesmain's CodeQL with a cleanactions + gorun, retiring the stale csharp failure.Verification
bash -n+ shellcheck clean.RELEASE_DRY_RUN=1 script/release {patch,minor,major}→ bumps compute correctly.go/v0.0.1tag (go list -m -versions→v0.0.1).GIT_CONFIG_*injection verified honored by git (≥ 2.31).No Go source or contract change — release tooling + docs only.