Skip to content

fix(ci): build otdfctl release binaries with GOWORK=off [backport to release/otdfctl/v0.38] - #4117

Merged
elizabethhealy merged 1 commit into
release/otdfctl/v0.38from
backport-4115-to-release/otdfctl/v0.38
Sep 28, 2026
Merged

elizabethhealy merged 1 commit into
release/otdfctl/v0.38from
backport-4115-to-release/otdfctl/v0.38

Conversation

@opentdf-automation

Copy link
Copy Markdown
Contributor

Description

Backport of #4115 to release/otdfctl/v0.38.

## Summary

`release-otdfctl.yaml` runs `make build` with the root `go.work`, so the
published otdfctl binaries are compiled against the **in-repo** `sdk/`,
`protocol/go`, `lib/*` instead of the versions pinned in
`otdfctl/go.mod`.

That's inconsistent with:
- the release-please PR check, which runs `.github/scripts/work-init.sh`
to drop `./sdk` from the workspace and validate against the pinned
versions
- what users get from `go install
github.com/opentdf/platform/otdfctl@vX`

On release branches this can break a release after it's published: e.g.
on `release/otdfctl/v0.38`, otdfctl pins `sdk v0.33.0` (which includes
#3945), but the in-tree `sdk/` did not until #4114. The release-please
check would pass while the post-publish binary build would fail to
compile, leaving a release with no artifacts.

This sets `GOWORK=off` on the build step so binaries are built strictly
from `otdfctl/go.mod`. `setup-go` still reads the Go version from
`go.work`.

## Test plan
- [ ] actionlint passes
- [ ] Locally: `cd otdfctl && GOWORK=off make build` succeeds on `main`
- [ ] Next `otdfctl/v*` release uploads binaries successfully
- [ ] Consider backporting to active `release/otdfctl/*` branches

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated the release build to use dependencies specified for `otdfctl`.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: CoopAgent <coopagent@users.noreply.github.com>
(cherry picked from commit e8a2f7f)
@coderabbitai

coderabbitai Bot commented Sep 28, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5f9f35ee-f4fa-4917-b712-0113ca37b9dd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@opentdf-automation
opentdf-automation Bot force-pushed the backport-4115-to-release/otdfctl/v0.38 branch from 574146a to d95b6ce Compare September 28, 2026 18:47
@github-actions github-actions Bot added comp:ci Github Actions Work size/xs labels Sep 28, 2026
@github-actions

Copy link
Copy Markdown
Contributor

X-Test Failure Report

@github-actions

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 122.741137ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 72.152784ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 245.377258ms
Throughput 407.54 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 35.948761781s
Average Latency 358.759882ms
Throughput 139.09 requests/second

@github-actions

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 247.00466ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 141.683762ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 420.893319ms
Throughput 237.59 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 59.68919138s
Average Latency 595.377894ms
Throughput 83.77 requests/second

@github-actions

Copy link
Copy Markdown
Contributor

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

  • otdfctl
  • service
  • tests-bdd

See the workflow run for details.

@elizabethhealy
elizabethhealy merged commit 632b06a into release/otdfctl/v0.38 Sep 28, 2026
42 of 43 checks passed
@elizabethhealy
elizabethhealy deleted the backport-4115-to-release/otdfctl/v0.38 branch September 28, 2026 18:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp:ci Github Actions Work size/xs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant