Repository navigation
Use x-access-token to fix some git fetch errors when prompt is disabled. - #171
Conversation
Superseded — see the current review report for commit
|
Superseded — see the current review report for commit
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
…oad vendored dependencies.
Superseded — see the current review report for commit
|
General PR Review: Use x-access-token to fix some git fetch errors when prompt is disabled.Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0 Review SummaryThe PR changes both Security IssuesNone found. Correctness IssuesNone found. SuggestionsNone. Reviewed commit: |
## Incident Incident triage reported 13 failed release runs across two classes: vendored private-module resolution failures and transient toolchain download/stream errors. An explicit `GOFLAGS=-mod=readonly` disables Go's automatic vendor mode. A caller with a complete vendor tree therefore attempts module resolution instead of using its vendored private dependencies. The job's proxy-only `GOPROXY=https://proxy.golang.org` also removes Go's normal direct fallback, exposing private-module 404s. Vendor mode and readonly mode both refuse required go.mod edits; forcing a module mode job-wide is not needed for that hygiene property. ## Fix - Remove only the three job-level `GOFLAGS`, `GOPROXY`, and `GOSUMDB` assignments from `goreleaser-binaries`. The required whole-file inventory found no matching assignments in any other release job. - Keep `GOTOOLCHAIN=local`, locked tool versions/checksums, module gates, and the trusted gon build's separate step-local module/checksum settings unchanged. - Retry artifact downloads with `curl --retry 5 --retry-delay 2 --retry-all-errors`; PowerShell uses `Invoke-WebRequest -MaximumRetryCount 5 -RetryIntervalSec 2`. Hash-before-extract and the committed download origins remain unchanged. - Add four lines to the existing CI-owned no-self-reference/workflow test to reject workflow/job-level module-resolution overrides. No new CI job or checker framework is introduced. ## Related fixes and merge order [#171](#171) owns the separate Git credential-form fix and the root `.golangci.yml` readonly removal. Neither is duplicated here. That root configuration is upstream of the fleet sync and pairs with [the baton-admin template guard](ConductorOne/baton-admin#1020): **#171 merges first, then the downstream template PR**. This incident fix has no downstream-template dependency. This repository's module graph contains only public dependencies and no tracked vendor tree. This branch was created from main and rebased onto `49d2c72e6150c82c8cae8e37fdb0dc5ce42aab79` after #171 merged; its incident patch is unchanged in range-diff. It is not stacked on an open feature branch. The incident change is limited to caller module-mode defaults, bounded installer retries, and their existing CI/fixture coverage. ## Evidence - `make test-scripts`: PASS, including 28 tool-integrity tests (native Windows PowerShell fixture skipped locally). - `GOTOOLCHAIN=local go test ./...` and `GOTOOLCHAIN=local go vet ./...`: PASS. - `make workflow-validate`, Bash syntax check of `install-tool.sh`, and `git diff --check`: PASS. - Actual CI assertion smoke: 33 workflow/job environment mutations were rejected; normal and trusted step-local settings passed. - Real Go fixture smoke with network disabled: a synthetic private vendored dependency builds under default vendor mode; adding `-mod=readonly` bypasses vendoring and fails module resolution. go.mod remains unchanged. - Real curl fixture smoke: an empty-response stream failure is retried successfully with the new flags; removing `--retry-all-errors` fails immediately with exit 52 before extraction/PATH publication. Successful bytes still pass the fixture's committed checksum. - The native Windows harness now checks both retry parameters. Native Windows/PowerShell execution is unavailable locally; the existing Windows CI job exercises that harness. ### Known full-lint limitation (pre-existing) Full `golangci-lint run --timeout=5m ./...` with v2.14.0 exits 3 because gocritic/ruleguard references the absent `tools/rules.go`. The comparison using main `49d2c72e`'s configuration also exits 3 with the same `ruleguard init error: no file matching .../tools/rules.go`. Go sources are unchanged from main. This is not introduced by the module-mode fix; no unrelated lint rules are changed here. ## Scope and follow-ups - No second-source/mirror code, lock-file column, dist mirror, or hosted-toolcache fallback is added. A second source is banked only if stream errors persist after these retries. - No outer GoReleaser retry wrapper: it was considered and rejected because partially published releases can collide with immutable/versioned outputs. - A vendored-private-module canary belongs in a separate baton-github-test PR and a separately authorized live release sequence; it is not created or dispatched here. - No v4 tag change, merge, deployment, credential configuration, or live release is performed by this draft PR. Prepared fixtures and local smoke tests are not deployed-canary evidence. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Example failure: https://github.com/ConductorOne/baton-fivetran/actions/runs/39768742068/job/119790645257
Also disable modules-download-mode: readonly in the golangci yaml. It was causing us to re-fetch vendored dependencies, which when combined with the auth error, failed lint in some cases.