Skip to content

fix: 💚 Fix cpex build #862

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
evaline-ju merged 1 commit into from
Sep 3, 2026
Merged

fix: 💚 Fix cpex build #862

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions authbridge/cmd/authbridge-cpex/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,9 @@ require (
github.com/rogpeppe/go-internal v1.15.0 // indirect
github.com/segmentio/asm v1.2.1 // indirect
github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect
github.com/tidwall/gjson v1.18.0 // indirect

@huang195 huang195 Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: worth closing the hole that let this reach main, because nothing on this PR verifies the fix.

authbridge-cpex appears in exactly one workflow — build.yaml — which triggers only on v* tags, pushes to main, and workflow_dispatch. ci.yaml's Go matrix is [authbridge-proxy, authbridge-envoy]. So every green check here comes from jobs that never resolve the cpex module graph, and the next time authlib gains a dependency this breaks again the same way.

A full cpex build in ci.yaml is genuinely awkward (CGO plus libcpex_ffi.a from the pinned CPEX tarball), but the failure class here is module-graph drift, not compilation — so it can be caught without building anything:

      - name: Verify module graph is tidy
        run: |
          while IFS= read -r -d '' mod; do
            (cd "$(dirname "$mod")" && go mod tidy -diff)
          done < <(find authbridge -name go.mod -not -path '*/demos/*' -print0 | sort -z)

go mod tidy -diff (Go 1.23+; these modules are on 1.26.5) exits non-zero if go.mod/go.sum would change, needs no CGO and no FFI archive, and covers praxis and the lite-tags module for free.

Note the machinery already exists: dependabot-tidy.yml triggers on pull_request and runs go mod tidy across every authbridge/**/go.mod via that same find, but is gated if: github.actor == 'dependabot[bot]' — which is why the tidy check on this PR reads skipping. Ungating a read-only (-diff) variant for all PRs is probably the smallest change that closes the loop.

@evaline-ju evaline-ju Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

follow-up issue filed #863, keeping this PR scoped to just fix

github.com/tidwall/match v1.1.1 // indirect
github.com/tidwall/pretty v1.2.1 // indirect

@huang195 huang195 Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: cmd/authbridge-praxis appears to have the identical gap, and this PR leaves it broken.

The chain is the same one that broke cpex:

  • cmd/authbridge-praxis/go.mod:37 has replace github.com/rossoctl/cortex/authbridge/authlib => ../../authlib, so it builds against local authlib despite the pinned pseudo-version above it.
  • cmd/authbridge-praxis/main.go imports authlib/praxis; authlib/praxis/praxis.go and authlib/praxis/policy.go both import authlib/pipeline; pipeline/snapshot.go imports gjson.
  • cmd/authbridge-praxis/go.mod and go.sum contain no tidwall entries at all.
  • Its Dockerfile sets ENV GOWORK=off before go build, so the workspace can't paper over the missing require the way go build from authbridge/ does locally.

Nobody noticed because praxis is in neither the ci.yaml matrix nor the build.yaml image matrix, so it is built nowhere in CI.

I verified this by reading imports rather than running the praxis image build, so please sanity-check before acting. Either add the same three indirects to cmd/authbridge-praxis/go.mod/go.sum while you're here, or file a follow-up — the go mod tidy -diff gate in my other comment would surface it automatically.

@evaline-ju evaline-ju Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see these changes in flight on #855 so I purposely left this 😄

github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
golang.org/x/crypto v0.55.0 // indirect
Expand Down
7 changes: 7 additions & 0 deletions authbridge/cmd/authbridge-cpex/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,13 @@ github.com/tchap/go-patricia/v2 v2.3.3 h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhg
github.com/tchap/go-patricia/v2 v2.3.3/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU=
github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0=
github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=
github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz34TSfO3JaE=
github.com/vektah/gqlparser/v2 v2.5.36 h1:CN9mKVHgMkc+XftdOWIhb4HEL8wKSYkFAqhf8booa7s=
Expand Down
Loading