Bundle go-search-replace next to vip-next - #3027
Draft
mokagio wants to merge 6 commits into
Draft
Conversation
Public release assets do not need `gh`. TARGETS selects arches so a job that cross-compiles can pull both slices. --- Generated with the help of Grok, https://grok.x.ai Co-Authored-By: Grok 4.6 <grok@x.ai>
Each arch is a tarball of `vip-next` plus the helper, so ResolveBinary finds a sibling. macOS notarizes both Mach-Os; Windows Authenticode-signs both PEs. --- Generated with the help of Grok, https://grok.x.ai Co-Authored-By: Grok 4.6 <grok@x.ai>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Buildkite Go release pipeline to bundle the pinned go-search-replace helper alongside vip-next in per-OS/arch tarballs, ensuring ResolveBinary can find a sibling helper without requiring it on PATH.
Changes:
- Replace the Makefile’s helper-vendoring implementation with a dedicated
.buildkite/fetch-search-replace.sh(curl + MANIFEST sha256 verification). - Package
vip-next+go-search-replaceintodist/vip-next-<os>-<arch>.tar.gzvia.buildkite/pack-release.sh, and update Buildkite artifact collection accordingly. - Update macOS/Windows/Linux Buildkite build scripts and signing steps to fetch/sign/package the helper.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| Makefile | Delegates helper fetching/verifying to .buildkite/fetch-search-replace.sh for vendoring. |
| docs/BUILD-SIGNING.md | Updates documentation to reflect new bundled tarball artifacts and CI fetch/sign/package flow. |
| .buildkite/pipeline.yml | Updates artifact paths to upload per-arch .tar.gz bundles (and checksums). |
| .buildkite/pack-release.sh | New script to stage and tar vip-next + go-search-replace into dist/. |
| .buildkite/fetch-search-replace.sh | New script to download pinned helper releases via curl and verify against MANIFEST sha256. |
| .buildkite/build-windows.ps1 | Fetches/signs helper, packages tarball, and emits tarball checksum. |
| .buildkite/build-macos.sh | Fetches helper, signs/notarizes both binaries, packages tarballs, and emits tarball checksums. |
| .buildkite/build-linux.sh | Fetches helper, builds both arches, packages tarballs, and emits tarball checksums. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
mokagio
marked this pull request as draft
September 1, 2026 06:13
Callers checksum dist/${BIN_BASE}-…; a hard-coded vip-next prefix would miss
the file if BIN_BASE is overridden.
---
Generated with the help of Grok, https://grok.x.ai
Co-Authored-By: Grok 4.6 <grok@x.ai>
The tag comes from MANIFEST; TAG= is no longer an override. --- Generated with the help of Grok, https://grok.x.ai Co-Authored-By: Grok 4.6 <grok@x.ai>
--- Generated with the help of Grok, https://grok.x.ai Co-Authored-By: Grok 4.6 <grok@x.ai>
mokagio
commented
Sep 1, 2026
Co-authored-by: Gio Lodi <giovanni.lodi42@gmail.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The agents I worked with for #3019 flagged that the
vip-nextsearch-replacecommand requires and additional Go binary,go-search-replace. I stacked this PR to handle code signing it, but I'm unsure about the design decision of shipping two binaries of one CLI. This is the first Go CLI I work with, so I must be missing something. Pinging @rinatkhaziev for more information. Thanks!AI-generated details
Description
Stacked on #3019. Each platform job fetches the pinned
go-search-replacehelper (public GitHub release + MANIFEST sha256, noghauth), signs it the same way asvip-nexton macOS and Windows, and ships a per-arch tarball ofvip-next+go-search-replacesoResolveBinaryfinds a sibling.Without this, a signed
vip-nextstill failsimport sql --search-replaceanddev-env sync sqlunless the helper is already onPATH.Changelog Description
No customer-facing change until these artifacts are published.
Pull request checklist
Steps to Test
dist/vip-next-*.tar.gzartifact.vip-nextandgo-search-replace(.exeon Windows).PATH,./vip-next --versionand./vip-next search-replace --helpshould not say the binary is missing.