From c7c2b3c7caa15c8239de343257e200728731b011 Mon Sep 17 00:00:00 2001 From: Josh Allmann Date: Fri, 23 Oct 2026 08:30:35 -0700 Subject: [PATCH 1/3] Enable Dependabot dependency updates --- .github/dependabot.yml | 50 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..695a058 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,50 @@ +version: 2 + +# Version updates use GitHub's default three-day cooldown; security fixes do not. +updates: + - package-ecosystem: gomod + directory: / + schedule: + interval: weekly + groups: + minor-and-patch: + applies-to: version-updates + update-types: + - minor + - patch + security-updates: + applies-to: security-updates + patterns: + - "*" + open-pull-requests-limit: 5 + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + actions: + patterns: + - "*" + + - package-ecosystem: docker + directory: /docker + schedule: + interval: weekly + # Keep digest updates. Go tags must move with go.mod, CI, and release checks; + # Ubuntu releases are deliberate platform choices. + ignore: + - dependency-name: golang + update-types: + - version-update:semver-major + - version-update:semver-minor + - version-update:semver-patch + - dependency-name: ubuntu + update-types: + - version-update:semver-major + - version-update:semver-minor + - version-update:semver-patch + groups: + docker: + patterns: + - "*" From 5ea9652e459e475b505e160b5be03cb67e1cbb92 Mon Sep 17 00:00:00 2001 From: Josh Allmann Date: Fri, 23 Oct 2026 08:38:01 -0700 Subject: [PATCH 2/3] Allow automated Go compiler updates --- .github/dependabot.yml | 8 +------- .github/scripts/go-version.sh | 10 ++++++++++ .github/workflows/ci.yml | 9 ++++++++- .github/workflows/release.yml | 7 +++++-- docker/Dockerfile | 2 +- 5 files changed, 25 insertions(+), 11 deletions(-) create mode 100644 .github/scripts/go-version.sh diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 695a058..c2b519d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -31,14 +31,8 @@ updates: directory: /docker schedule: interval: weekly - # Keep digest updates. Go tags must move with go.mod, CI, and release checks; - # Ubuntu releases are deliberate platform choices. + # Keep Ubuntu digest updates; release changes are deliberate platform choices. ignore: - - dependency-name: golang - update-types: - - version-update:semver-major - - version-update:semver-minor - - version-update:semver-patch - dependency-name: ubuntu update-types: - version-update:semver-major diff --git a/.github/scripts/go-version.sh b/.github/scripts/go-version.sh new file mode 100644 index 0000000..4aa0fa6 --- /dev/null +++ b/.github/scripts/go-version.sh @@ -0,0 +1,10 @@ +#!/bin/sh +set -eu + +# The digest-pinned Docker builder is the compiler version source for CI/releases. +version=$(sed -nE 's/^FROM .*golang:([0-9]+\.[0-9]+\.[0-9]+)@sha256:[0-9a-f]{64} AS build$/\1/p' docker/Dockerfile) +if [ -z "$version" ] || [ "$(printf '%s\n' "$version" | wc -l)" -ne 1 ]; then + echo 'Expected one digest-pinned golang builder in docker/Dockerfile' >&2 + exit 1 +fi +printf '%s\n' "$version" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a463c2c..21dee06 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,13 +10,20 @@ permissions: jobs: test: runs-on: ubuntu-26.04 + env: + GOTOOLCHAIN: local steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false + - name: Go compiler version + id: go + run: | + version=$(sh .github/scripts/go-version.sh) + echo "version=$version" >> "$GITHUB_OUTPUT" - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 with: - go-version: '1.27.3' + go-version: ${{ steps.go.outputs.version }} cache: true - name: SDK fixture paths run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 39b6e97..7bb4a9e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,6 +57,7 @@ jobs: REF_NAME: ${{ github.ref_name }} run: | commit=$(git rev-parse HEAD) + go_version=$(sh .github/scripts/go-version.sh) release=$(< VERSION) [[ "$release" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || { echo 'VERSION must be MAJOR.MINOR.PATCH, without a v prefix, leading zeroes, prerelease suffixes, or build metadata.' >&2 @@ -72,6 +73,7 @@ jobs: fi { echo "version=$version" + echo "go=$go_version" echo "commit=$commit" echo "epoch=$(git show -s --format=%ct HEAD)" echo "bundle=livepeer-${version}-linux-${ARCH}" @@ -105,14 +107,15 @@ jobs: env: RELEASE_VERSION: ${{ steps.metadata.outputs.version }} RELEASE_COMMIT: ${{ steps.metadata.outputs.commit }} + RELEASE_GO_VERSION: ${{ steps.metadata.outputs.go }} SOURCE_DATE_EPOCH: ${{ steps.metadata.outputs.epoch }} BUNDLE: ${{ steps.metadata.outputs.bundle }} run: | mkdir -p dist "$RUNNER_TEMP/package/$BUNDLE/bin" cp "$RUNNER_TEMP/bin/"* "$RUNNER_TEMP/package/$BUNDLE/bin/" cp LICENSE "$RUNNER_TEMP/package/$BUNDLE/" - printf 'version=%s\ncommit=%s\ngo=go1.27.3\nos=linux\narch=%s\n' \ - "$RELEASE_VERSION" "$RELEASE_COMMIT" "$ARCH" > "$RUNNER_TEMP/package/$BUNDLE/VERSION" + printf 'version=%s\ncommit=%s\ngo=go%s\nos=linux\narch=%s\n' \ + "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_GO_VERSION" "$ARCH" > "$RUNNER_TEMP/package/$BUNDLE/VERSION" ( cd "$RUNNER_TEMP/package/$BUNDLE" sha256sum bin/* > SHA256SUMS diff --git a/docker/Dockerfile b/docker/Dockerfile index 4c1da92..bae3ede 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -4,7 +4,7 @@ ENV CGO_ENABLED=0 GOTOOLCHAIN=local GOENV=off GOWORK=off \ WORKDIR /src COPY go.mod go.sum ./ RUN sha256sum go.mod go.sum > /tmp/modules.sha256 && \ - test "$(go env GOVERSION)" = go1.27.3 && go mod download && go mod verify && \ + go mod download && go mod verify && \ sha256sum -c /tmp/modules.sha256 COPY . . ARG TARGETOS From d66862f803c7d2c17f2dd7fcf3fca9601b45714f Mon Sep 17 00:00:00 2001 From: Josh Allmann Date: Fri, 23 Oct 2026 09:00:56 -0700 Subject: [PATCH 3/3] Read the Go version from go.mod --- .github/scripts/go-version.sh | 10 ---------- .github/workflows/ci.yml | 7 +------ .github/workflows/release.yml | 2 +- README.md | 2 +- cmd/livepeer/integration_test.go | 6 +++++- docker/Dockerfile | 1 + docs/development.md | 4 +++- 7 files changed, 12 insertions(+), 20 deletions(-) delete mode 100644 .github/scripts/go-version.sh diff --git a/.github/scripts/go-version.sh b/.github/scripts/go-version.sh deleted file mode 100644 index 4aa0fa6..0000000 --- a/.github/scripts/go-version.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/sh -set -eu - -# The digest-pinned Docker builder is the compiler version source for CI/releases. -version=$(sed -nE 's/^FROM .*golang:([0-9]+\.[0-9]+\.[0-9]+)@sha256:[0-9a-f]{64} AS build$/\1/p' docker/Dockerfile) -if [ -z "$version" ] || [ "$(printf '%s\n' "$version" | wc -l)" -ne 1 ]; then - echo 'Expected one digest-pinned golang builder in docker/Dockerfile' >&2 - exit 1 -fi -printf '%s\n' "$version" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 21dee06..f41d6dd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,14 +16,9 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - - name: Go compiler version - id: go - run: | - version=$(sh .github/scripts/go-version.sh) - echo "version=$version" >> "$GITHUB_OUTPUT" - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 with: - go-version: ${{ steps.go.outputs.version }} + go-version-file: go.mod cache: true - name: SDK fixture paths run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7bb4a9e..c0dafab 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,7 +57,7 @@ jobs: REF_NAME: ${{ github.ref_name }} run: | commit=$(git rev-parse HEAD) - go_version=$(sh .github/scripts/go-version.sh) + go_version=$(awk '$1 == "go" {print $2}' go.mod) release=$(< VERSION) [[ "$release" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || { echo 'VERSION must be MAJOR.MINOR.PATCH, without a v prefix, leading zeroes, prerelease suffixes, or build metadata.' >&2 diff --git a/README.md b/README.md index a69649e..97f14e3 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ configuration. ## Build -Install Go 1.27.3 or newer, then run from the repository root: +Install the Go version declared in [go.mod](go.mod) or newer, then run from the repository root: ```sh make build diff --git a/cmd/livepeer/integration_test.go b/cmd/livepeer/integration_test.go index 6e75162..ef65bf9 100644 --- a/cmd/livepeer/integration_test.go +++ b/cmd/livepeer/integration_test.go @@ -253,8 +253,12 @@ func checkGoSDK(t *testing.T, root, serviceURL, runnerURL string) { if sdkDir == "" { return } + module := exec.Command("go", "list", "-m", "-f", "{{.GoVersion}}") + module.Dir = root + goVersion, err := module.Output() + require.NoError(t, err) dir := t.TempDir() - goMod := "module sdkcompat\n\ngo 1.27.3\n\nrequire github.com/livepeer/golang-runner v0.0.0\n\nreplace github.com/livepeer/golang-runner => " + sdkDir + "\n" + goMod := fmt.Sprintf("module sdkcompat\n\ngo %s\n\nrequire github.com/livepeer/golang-runner v0.0.0\n\nreplace github.com/livepeer/golang-runner => %s\n", strings.TrimSpace(string(goVersion)), sdkDir) require.NoError(t, os.WriteFile(filepath.Join(dir, "go.mod"), []byte(goMod), 0600)) source, err := os.ReadFile(filepath.Join(root, "cmd", "livepeer", "testdata", "go_sdk_compat.go")) require.NoError(t, err) diff --git a/docker/Dockerfile b/docker/Dockerfile index bae3ede..3e9cfc8 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -4,6 +4,7 @@ ENV CGO_ENABLED=0 GOTOOLCHAIN=local GOENV=off GOWORK=off \ WORKDIR /src COPY go.mod go.sum ./ RUN sha256sum go.mod go.sum > /tmp/modules.sha256 && \ + test "$(go env GOVERSION)" = "go$(awk '$1 == "go" {print $2}' go.mod)" && \ go mod download && go mod verify && \ sha256sum -c /tmp/modules.sha256 COPY . . diff --git a/docs/development.md b/docs/development.md index 9cf0e9f..99b2216 100644 --- a/docs/development.md +++ b/docs/development.md @@ -1,6 +1,8 @@ # Development -The module requires Go 1.27.3 or newer. Build all executables with: +The minimum Go version is declared in [go.mod](../go.mod). CI and release metadata +use that version; keep the digest-pinned Go builder in `docker/Dockerfile` aligned +with it. Build all executables with: ```sh make build