feat: add version drift-check for cluster_setup scripts and docs - #190
feat: add version drift-check for cluster_setup scripts and docs#190kupratyu-splunk wants to merge 1 commit into
Conversation
Tags every hardcoded tool/chart version in tools/cluster_setup and docs/deployment/k0s-quick-reference.md with an inline ver:<KEY> marker, cross-checked against a new versions.env source of truth by check_versions.sh. Wired into cluster-setup-tests.yml so drift fails CI instead of silently diverging between scripts and docs. Co-Authored-By: Claude <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b98eb0d65d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| done < <(grep -rn 'ver:[A-Za-z0-9_]\+' \ | ||
| --include='*.sh' --include='*.md' \ | ||
| "${REPO_ROOT}/tools/cluster_setup" "${REPO_ROOT}/docs/deployment" 2>/dev/null) |
There was a problem hiding this comment.
Because this scan only discovers existing ver: markers, it cannot enforce the stated requirement that every pinned version is checked. For example, the online k0s installer still hardcodes the unmarked cert-manager URL at k0s_cluster_with_stack.sh:3337 and KubeRay versions at lines 4844–4851. Bumping K0S_CERT_MANAGER_VERSION and every marked occurrence to v1.14.0 still makes this check pass while the online installer fetches v1.13.0, allowing the online and air-gapped paths to drift.
Useful? React with 👍 / 👎.
|
|
||
| # Require a non-identifier char (or start of line) before "ver:" so this | ||
| # doesn't false-match inside words like "nvidia-driver:latest-dkms". | ||
| [[ "${content}" =~ (^|[^A-Za-z0-9_-])ver:([A-Za-z0-9_]+) ]] || continue |
There was a problem hiding this comment.
This regex extracts only the first ver:<KEY> occurrence from each grep result. Several newly tagged documentation lines contain multiple markers, such as the binaries row in K0S_README.md:1394; changing its second YQ_VERSION value to v9.99.9 still produces “No version drift” because only the preceding K0S_VERSION marker is checked. Iterate through all marker matches in each line rather than using a single BASH_REMATCH.
Useful? React with 👍 / 👎.
| fi | ||
|
|
||
| expected="${EXPECTED[${key}]}" | ||
| if ! grep -qF -- "${expected}" <<<"${content}"; then |
There was a problem hiding this comment.
The fixed-string containment test accepts a different version whenever it starts with the expected value. For example, with YQ_VERSION=v4.44.10 in versions.env, a tagged site containing v4.44.100 passes this check. This can silently miss ordinary patch-version drift, so the match needs version-token boundaries while still permitting formats such as a leading v or an embedded URL.
Useful? React with 👍 / 👎.
| done < <(grep -rn 'ver:[A-Za-z0-9_]\+' \ | ||
| --include='*.sh' --include='*.md' \ | ||
| "${REPO_ROOT}/tools/cluster_setup" "${REPO_ROOT}/docs/deployment" 2>/dev/null) |
There was a problem hiding this comment.
The grep runs in a process substitution, so its nonzero status is not propagated, and stderr is discarded. If either configured scan root is missing, renamed, or unreadable while the other still contains markers, the script reports success without checking that entire scope; for example, removing docs/deployment still yields “Checked 50 marker(s). No version drift.” Capture and validate the scan command's status instead of treating partial output as a complete scan.
Useful? React with 👍 / 👎.
1 participant
Tags every hardcoded tool/chart version in tools/cluster_setup and docs/deployment/k0s-quick-reference.md with an inline ver: marker, cross-checked against a new versions.env source of truth by check_versions.sh. Wired into cluster-setup-tests.yml so drift fails CI instead of silently diverging between scripts and docs.
Description
Related Issues
Type of Change
Changes Made
Testing Performed
make test)make lint)Test Environment
Test Steps
Documentation
Checklist
Breaking Changes
Impact:
Migration Path:
Screenshots/Recordings
Additional Notes
Reviewer Notes
Please pay special attention to:
Commit Message Convention: This PR follows Conventional Commits