build: align tool versions and chart CRDs with the release baseline - #366
Merged
Merged
Conversation
Two version gaps against the org baseline: - golangci-lint was on v2.5.0, seven minor versions behind the version the other operators use. More importantly, golangci-lint-action was invoked without a `version:` input, so CI always installed the newest release. That makes the pipeline fail on an upstream release with no change here, and it silently diverges from what `make lint` runs locally. Pin both to v2.12.1. - chainsaw was on v0.2.13; v0.2.14 is the baseline. `make lint` reports 0 issues after the upgrade - the seven-version jump introduced no new findings. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
publish.yml could only be triggered by a push to main, so the credentials it needs could not be verified on demand. An expired HELM_CHARTS_REPO_TOKEN went unnoticed for weeks because nothing happened to land on main during that window, and it only surfaced when an unrelated change did. workflow_dispatch makes the publish path exercisable before a release rather than discovering a dead credential at tag time, when the tag cannot be recut. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The chart's crds.yaml was still generated by controller-gen v0.17.1 while config/crd/bases had already moved to v0.19.0. Only config/ is covered by the check-crds-sync job, so this copy could drift indefinitely without CI noticing - `make helm-crd-sync` is the only thing that catches it. Regenerating updates the controller-gen version annotation and refreshes descriptions inherited from the upstream Kubernetes API types. No schema or validation change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Part of the 0.4.0 release baseline alignment.
golangci-lint was floating.
golangci-lint-actionwas invoked with noversion:input, so CI always installed the newest release. That makes thepipeline break on an upstream release with no change here, and it silently
diverges from what
make lintruns locally. The Makefile was also on v2.5.0,seven minor versions behind the version the other operators use.
chainsaw was on v0.2.13, while the baseline is v0.2.14.
The chart CRDs had drifted.
deploy/helm/*/crds/crds.yamlwas stillgenerated by controller-gen v0.17.1 while
config/crd/baseshad already movedto v0.19.0. The
check-crds-syncjob only coversconfig/, so this copy candrift indefinitely without CI noticing —
make helm-crd-syncis the only thingthat catches it. This is not specific to this repo: 11 of the 15 operators are
in the same state.
Separately,
publish.ymlcould only be triggered by a push to main. That is howan expired
HELM_CHARTS_REPO_TOKENwent unnoticed for weeks: nothing landed onmain during that window, so nothing exercised the credential, and it only
surfaced when an unrelated change finally did. Adding
workflow_dispatchmakesthe publish path verifiable on demand — the alternative is discovering a dead
credential at tag time, when the tag cannot be recut.
Verification
Run locally against these changes:
make lint(v2.12.1)make testcheck-crds-sync(simulated per the CI logic, clean tree)make helm-crd-syncworkflow_dispatchparses as expected🤖 Generated with Claude Code