From 2cad1cc9365ca65ce43d5dfb41443229cf2eea90 Mon Sep 17 00:00:00 2001 From: Benjamin Pracht Date: Mon, 17 Aug 2026 09:25:02 -0700 Subject: [PATCH] Update renovate and pinning behavior, run tools from go.mod (#4759) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Renovate config:recommended (config:base is deprecated) and matchPackageNames globs instead of the deprecated matchPackagePrefixes. Vulnerability alerts get a fast path: 2-day quarantine, no concurrency/hourly/schedule limits. Go modules are no longer grouped into one "go deps" PR — each gets its own, so a bad bump can be reverted alone. The pion modules stay grouped as a documented exception: they're co-released and interdependent, so individual PRs wouldn't build. First-party github.com/livekit/** skips the 2-week quarantine. go.mod's go directive is no longer an update target — the build toolchain is pinned in the Dockerfile instead. Dockerfile deps get pinDigests; the golang image is ungrouped with separateMinorPatch so a patch and a minor bump are each separately approvable. Custom manager to bump the builder image's -alpineA.B suffix together with its digest, which the stock docker manager holds fixed. - Pinning Both Dockerfiles pin golang and alpine by digest alongside the readable tag. GOTOOLCHAIN=local so a go.mod bump fails loudly instead of silently downloading a different toolchain. apk upgrade in the runtime stage — a digest pin plus the 2-week quarantine would otherwise ship base-package CVEs Alpine has already fixed. This relies on a cold layer cache, which holds today because the release workflow configures no buildx cache; there's a comment saying so. Workflows resolve the Go version from the Dockerfile via .github/scripts/go-version.sh, so tests, releases and images share one toolchain. - Tools All four code generators now come from the module graph, and tools/tools.go (the pre-Go-1.24 blank-import idiom) is replaced by go.mod tool directives: tool how why goimports go tool lives in x/tools — its own module is the one being selected gotestfmt go tool zero dependencies, nothing to skew wire go run pins x/tools v0.24.1; building it in our graph changes its output counterfeiter go run unchanged, matches its //go:generate directives The wire distinction is load-bearing. Building wire inside our module raises it from the x/tools v0.24.1 it pins to our v0.48.0, and that module version difference changes what it generates: it falls back to v/v2/v3 instead of deriving real identifiers from the type. wire_gen.go is regenerated here to match the in-module build — a cosmetic rename of 9 lines, with no other change to the generated code. golangci-lint deliberately keeps its action rather than becoming a tool: it pins its own x/tools (v0.44.0 vs our v0.48.0) for the analyzers it bundles, adding it to go.mod would double our go.mod/go.sum (158→338 / 441→889 lines), and the action supplies caching, only-new-issues and PR annotations that invoking a binary can't. Its version stays manual by request. --- .github/scripts/go-version.sh | 50 ++++++++++++++++++++++++ .github/workflows/buildtest.yaml | 29 ++++++++------ .github/workflows/docker.yaml | 19 +++++++--- .github/workflows/release.yaml | 11 +++++- Dockerfile | 23 +++++++++-- cmd/test-server/Dockerfile | 16 +++++++- go.mod | 11 +++++- go.sum | 4 ++ magefile.go | 51 +++++++------------------ pkg/service/wire_gen.go | 18 ++++----- renovate.json | 65 +++++++++++++++++++++++++++----- tools/tools.go | 23 ----------- 12 files changed, 216 insertions(+), 104 deletions(-) create mode 100755 .github/scripts/go-version.sh delete mode 100644 tools/tools.go diff --git a/.github/scripts/go-version.sh b/.github/scripts/go-version.sh new file mode 100755 index 000000000..9ce6fab1a --- /dev/null +++ b/.github/scripts/go-version.sh @@ -0,0 +1,50 @@ +#!/usr/bin/env bash +# Copyright 2026 LiveKit, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# +# Print the Go toolchain version pinned by a Dockerfile's golang builder image. +# +# usage: .github/scripts/go-version.sh [dockerfile] (default: Dockerfile) +# +# The pinned `golang:X.Y.Z-alpineA.B@sha256:...` builder image is the single source +# of truth, and Renovate keeps it current via an approvable PR. Each workflow reads +# the version out of the Dockerfile it builds against (setup-go cannot parse a +# Dockerfile itself), so a job's Go runtime always matches the image it produces. +# +# Deliberately NOT derived from go.mod's `go` directive: that is the module +# minimum, owned by the toolchain and by dependency requirements, and the go +# command may rewrite it to a bare major.minor. +set -euo pipefail + +dockerfile="${1:-Dockerfile}" + +if [ ! -f "$dockerfile" ]; then + echo "$dockerfile: no such file" >&2 + exit 1 +fi + +version=$(sed -nE 's/^FROM[[:space:]]+golang:([0-9]+\.[0-9]+\.[0-9]+)[^[:space:]]*.*/\1/p' "$dockerfile" | sort -u) + +if [ -z "$version" ]; then + echo "$dockerfile: no pinned 'FROM golang:X.Y.Z-...' base image found" >&2 + exit 1 +fi + +if [ "$(printf '%s\n' "$version" | wc -l)" -ne 1 ]; then + echo "$dockerfile pins more than one Go version: $(echo $version)" >&2 + exit 1 +fi + +echo "$version" diff --git a/.github/workflows/buildtest.yaml b/.github/workflows/buildtest.yaml index 250bc7b5d..b11478cd9 100644 --- a/.github/workflows/buildtest.yaml +++ b/.github/workflows/buildtest.yaml @@ -35,29 +35,34 @@ jobs: auto-start: true - run: redis-cli ping + # Test with the same Go toolchain the published image is built with + - name: Resolve Go version + id: go-version + run: | + # Assign first so a failed lookup trips `set -e`; inside echo its exit + # status would be discarded and an empty version written. + version=$(.github/scripts/go-version.sh Dockerfile) + echo "version=$version" >> "$GITHUB_OUTPUT" + - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 with: - go-version: "^1.26" - - - name: Set up gotestfmt - run: go install github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@v2.4.1 + go-version: ${{ steps.go-version.outputs.version }} - name: Replace mutexes run: | go get github.com/sasha-s/go-deadlock grep -rl sync.Mutex ./pkg | xargs sed -i 's/sync\.Mutex/deadlock\.Mutex/g' grep -rl sync.RWMutex ./pkg | xargs sed -i 's/sync\.RWMutex/deadlock\.RWMutex/g' - go install golang.org/x/tools/cmd/goimports@latest - grep -rl deadlock.Mutex ./pkg | xargs goimports -w - grep -rl deadlock.RWMutex ./pkg | xargs goimports -w + grep -rl deadlock.Mutex ./pkg | xargs go tool goimports -w + grep -rl deadlock.RWMutex ./pkg | xargs go tool goimports -w go mod tidy + # Run mage at the version go.mod pins, rather than the mage-action's + # `version: latest`, so the binary matches the mage/mg library the magefile is + # compiled against and Renovate owns the version like any other module. - name: Mage Build - uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4 - with: - version: latest - args: build + run: go run github.com/magefile/mage build - name: Lint uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 @@ -67,7 +72,7 @@ jobs: - name: Test run: | set -euo pipefail - MallocNanoZone=0 go test -race -json -v ./... 2>&1 | tee /tmp/gotest.log | gotestfmt + MallocNanoZone=0 go test -race -json -v ./... 2>&1 | tee /tmp/gotest.log | go tool gotestfmt # Upload the original go test log as an artifact for later review. - name: Upload test log diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml index d9b9397eb..72a510135 100644 --- a/.github/workflows/docker.yaml +++ b/.github/workflows/docker.yaml @@ -43,19 +43,28 @@ jobs: type=semver,pattern=v{{version}} type=semver,pattern=v{{major}}.{{minor}} + # Generate with the same Go toolchain the published image is built with + - name: Resolve Go version + id: go-version + run: | + # Assign first so a failed lookup trips `set -e`; inside echo its exit + # status would be discarded and an empty version written. + version=$(.github/scripts/go-version.sh Dockerfile) + echo "version=$version" >> "$GITHUB_OUTPUT" + - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 with: - go-version-file: "go.mod" + go-version: ${{ steps.go-version.outputs.version }} - name: Download Go modules run: go mod download + # Run mage at the version go.mod pins, rather than the mage-action's + # `version: latest`, so the binary matches the mage/mg library the magefile is + # compiled against and Renovate owns the version like any other module. - name: Generate code - uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4 - with: - version: latest - args: generate + run: go run github.com/magefile/mage generate - name: Set up Docker Buildx uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 0cad91850..c19e14113 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -32,10 +32,19 @@ jobs: - name: Fetch all tags run: git fetch --force --tags + # Release with the same Go toolchain the published image is built with + - name: Resolve Go version + id: go-version + run: | + # Assign first so a failed lookup trips `set -e`; inside echo its exit + # status would be discarded and an empty version written. + version=$(.github/scripts/go-version.sh Dockerfile) + echo "version=$version" >> "$GITHUB_OUTPUT" + - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 with: - go-version-file: "go.mod" + go-version: ${{ steps.go-version.outputs.version }} - name: Run GoReleaser uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7 diff --git a/Dockerfile b/Dockerfile index 4fb0a92f6..c71b191d3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,7 +12,12 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.26-alpine AS builder +# Pinned by digest so the build is reproducible even if the tag is republished. +# The tag is kept alongside it for readability; Renovate updates both together. +# This image is also the single source of truth for the Go toolchain: CI reads the +# version out of this line (see .github/scripts/go-version.sh) so tests and images +# always run the same runtime. +FROM golang:1.26.6-alpine3.24@sha256:af8d6740070b8906d12eae1c3e3ea0957fb63f492051ea05e354c38ef9fe88df AS builder ARG TARGETPLATFORM ARG TARGETARCH @@ -20,6 +25,10 @@ RUN echo building for "$TARGETPLATFORM" WORKDIR /workspace +# Build with exactly the toolchain in this image; fail (don't silently download) +# if go.mod ever requires a newer version, so the pinned image stays authoritative. +ENV GOTOOLCHAIN=local + # Copy the Go Modules manifests COPY go.mod go.mod COPY go.sum go.sum @@ -31,12 +40,20 @@ RUN go mod download COPY cmd/ cmd/ COPY pkg/ pkg/ COPY test/ test/ -COPY tools/ tools/ COPY version/ version/ RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH GO111MODULE=on go build -a -o livekit-server ./cmd/server -FROM alpine +FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b + +# Pull the latest security patches for base packages within the pinned Alpine +# release. The digest above is only refreshed by a Renovate PR, so without this +# an image can ship base-package CVEs that Alpine has already fixed. +# NOTE: this relies on the build starting with a cold layer cache, which is true +# today because the release workflow configures no buildx cache. If cache-from/ +# cache-to is ever added, this layer needs a cache-busting ARG (as ../cloud does +# with SECURITY_REFRESH) or it will be served stale. +RUN apk upgrade --no-cache COPY --from=builder /workspace/livekit-server /livekit-server diff --git a/cmd/test-server/Dockerfile b/cmd/test-server/Dockerfile index 0182aadea..e0dc826db 100644 --- a/cmd/test-server/Dockerfile +++ b/cmd/test-server/Dockerfile @@ -14,12 +14,19 @@ # Mock LiveKit API server for SDK conformance testing. Build from the repo # root: docker build -f cmd/test-server/Dockerfile -t livekit/test-server . -FROM golang:1.26-alpine AS builder +# +# Pinned by digest so the build is reproducible even if the tag is republished. +# The tag is kept alongside it for readability; Renovate updates both together. +FROM golang:1.26.6-alpine3.24@sha256:af8d6740070b8906d12eae1c3e3ea0957fb63f492051ea05e354c38ef9fe88df AS builder ARG TARGETARCH WORKDIR /workspace +# Build with exactly the toolchain in this image; fail (don't silently download) +# if go.mod ever requires a newer version, so the pinned image stays authoritative. +ENV GOTOOLCHAIN=local + COPY go.mod go.mod COPY go.sum go.sum RUN go mod download @@ -30,7 +37,12 @@ COPY version/ version/ RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH GO111MODULE=on go build -a -o livekit-test-server ./cmd/test-server -FROM alpine +FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b + +# Pull the latest security patches for base packages within the pinned Alpine +# release; the digest above is only refreshed by a Renovate PR. See the note in +# the repo-root Dockerfile about the cold-cache assumption. +RUN apk upgrade --no-cache COPY --from=builder /workspace/livekit-test-server /livekit-test-server diff --git a/go.mod b/go.mod index c92cb7d88..c05dab566 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,6 @@ require ( github.com/livekit/psrpc v0.7.3 github.com/mackerelio/go-osstat v0.2.8 github.com/magefile/mage v1.17.2 - github.com/maxbrunsfeld/counterfeiter/v6 v6.12.2 github.com/mitchellh/go-homedir v1.1.0 github.com/moby/moby/client v0.5.1 github.com/olekukonko/tablewriter v1.1.4 @@ -73,9 +72,11 @@ require ( github.com/go-logr/stdr v1.2.2 // indirect github.com/goccy/go-json v0.10.6 // indirect github.com/golang-jwt/jwt/v5 v5.3.1 // indirect + github.com/gotesttools/gotestfmt/v2 v2.4.1 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect github.com/mattn/go-colorable v0.1.15 // indirect github.com/mattn/go-isatty v0.0.22 // indirect + github.com/maxbrunsfeld/counterfeiter/v6 v6.12.2 // indirect github.com/moby/moby/api v1.55.0 // indirect github.com/nyaruka/phonenumbers v1.8.1 // indirect github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect @@ -94,6 +95,7 @@ require ( go.opentelemetry.io/proto/otlp v1.10.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 // indirect + golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 // indirect golang.org/x/time v0.15.0 // indirect ) @@ -155,6 +157,13 @@ require ( google.golang.org/grpc v1.83.0 // indirect ) +tool ( + github.com/google/wire/cmd/wire + github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt + github.com/maxbrunsfeld/counterfeiter/v6 + golang.org/x/tools/cmd/goimports +) + replace github.com/pion/webrtc/v4 => github.com/livekit/webrtc-pion/v4 v4.2.18-warp.1 replace github.com/pion/dtls/v3 => github.com/livekit/dtls/v3 v3.1.5-warp.1 diff --git a/go.sum b/go.sum index e4b6afec2..1b1baa645 100644 --- a/go.sum +++ b/go.sum @@ -107,6 +107,8 @@ github.com/google/wire v0.7.0 h1:JxUKI6+CVBgCO2WToKy/nQk0sS+amI9z9EjVmdaocj4= github.com/google/wire v0.7.0/go.mod h1:n6YbUQD9cPKTnHXEBN2DXlOp/mVADhVErcMFb0v3J18= github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= +github.com/gotesttools/gotestfmt/v2 v2.4.1 h1:Ml+KPqPocp/KckpizL+tgsy/dlddI4/z2w6lgS7YIFE= +github.com/gotesttools/gotestfmt/v2 v2.4.1/go.mod h1:oQJg2KZ2aGoqEbMC2PDaAeBYm0tOkocgixK9FzsCdp4= github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -402,6 +404,8 @@ golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 h1:RJhm5l6Fo4rmEIcndxDllNhhf/fAx8qIm4t6A7vpm2A= +golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959/go.mod h1:LV7u5Oco+Z/g6XI7PqN+EUUUGGkEcmB1uj2ceI0fOVg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= diff --git a/magefile.go b/magefile.go index d4d42fa68..ff2f6f9f4 100644 --- a/magefile.go +++ b/magefile.go @@ -51,9 +51,14 @@ func init() { } } -// explicitly reinstall all deps +// downloads module deps at the versions pinned in go.mod +// +// Code generators are not installed here: they run as `go run ` from their +// //go:generate directives (see pkg/service/wire_gen.go and the counterfeiter +// directives under pkg/), so they always execute at the version go.mod pins and +// Renovate keeps them current alongside every other module. func Deps() error { - return installTools(true) + return mageutil.Run(context.Background(), "go mod download") } // builds LiveKit server @@ -109,9 +114,6 @@ func BuildLinux() error { func Deadlock() error { ctx := context.Background() - if err := mageutil.InstallTool("golang.org/x/tools/cmd/goimports", "latest", false); err != nil { - return err - } if err := mageutil.Run(ctx, "go get github.com/sasha-s/go-deadlock"); err != nil { return err } @@ -121,7 +123,7 @@ func Deadlock() error { if err := mageutil.Pipe("grep -rl sync.RWMutex ./pkg", "xargs sed -i -e s/sync.RWMutex/deadlock.RWMutex/g"); err != nil { return err } - if err := mageutil.Pipe("grep -rl deadlock.Mutex\\|deadlock.RWMutex ./pkg", "xargs goimports -w"); err != nil { + if err := mageutil.Pipe("grep -rl deadlock.Mutex\\|deadlock.RWMutex ./pkg", "xargs go tool goimports -w"); err != nil { return err } if err := mageutil.Run(ctx, "go mod tidy"); err != nil { @@ -137,7 +139,7 @@ func Sync() error { if err := mageutil.Pipe("grep -rl deadlock.RWMutex ./pkg", "xargs sed -i -e s/deadlock.RWMutex/sync.RWMutex/g"); err != nil { return err } - if err := mageutil.Pipe("grep -rl sync.Mutex\\|sync.RWMutex ./pkg", "xargs goimports -w"); err != nil { + if err := mageutil.Pipe("grep -rl sync.Mutex\\|sync.RWMutex ./pkg", "xargs go tool goimports -w"); err != nil { return err } if err := mageutil.Run(context.Background(), "go mod tidy"); err != nil { @@ -199,7 +201,7 @@ func Clean() { // regenerate code func Generate() error { - mg.Deps(installDeps, generateWire) + mg.Deps(generateWire) fmt.Println("generating...") return mageutil.Run(context.Background(), "go generate ./...") @@ -207,40 +209,13 @@ func Generate() error { // code generation for wiring func generateWire() error { - mg.Deps(installDeps) if !checksummer.IsChanged() { return nil } fmt.Println("wiring...") - wire, err := mageutil.GetToolPath("wire") - if err != nil { - return err - } - cmd := exec.Command(wire) - cmd.Dir = "pkg/service" - mageutil.ConnectStd(cmd) - if err := cmd.Run(); err != nil { - return err - } - - return nil -} - -// implicitly install deps -func installDeps() error { - return installTools(false) -} - -func installTools(force bool) error { - tools := map[string]string{ - "github.com/google/wire/cmd/wire": "latest", - } - for t, v := range tools { - if err := mageutil.InstallTool(t, v, force); err != nil { - return err - } - } - return nil + // Matches the //go:generate directive in pkg/service/wire_gen.go, so running + // wire here and running `go generate ./...` produce the same output. + return mageutil.RunDir(context.Background(), "pkg/service", "go run github.com/google/wire/cmd/wire") } diff --git a/pkg/service/wire_gen.go b/pkg/service/wire_gen.go index b64fbb063..0da441132 100644 --- a/pkg/service/wire_gen.go +++ b/pkg/service/wire_gen.go @@ -86,23 +86,23 @@ func InitializeServer(conf *config.Config, currentNode routing.LocalNode) (*Live } rtcEgressLauncher := NewEgressLauncher(egressClient, ioInfoService, objectStore) topicFormatter := rpc.NewTopicFormatter() - roomClient, err := rpc.NewTypedRoomClient(clientParams) + v, err := rpc.NewTypedRoomClient(clientParams) if err != nil { return nil, err } - participantClient, err := rpc.NewTypedParticipantClient(clientParams) + v2, err := rpc.NewTypedParticipantClient(clientParams) if err != nil { return nil, err } - roomService, err := NewRoomService(limitConfig, apiConfig, router, roomAllocator, objectStore, rtcEgressLauncher, topicFormatter, roomClient, participantClient) + roomService, err := NewRoomService(limitConfig, apiConfig, router, roomAllocator, objectStore, rtcEgressLauncher, topicFormatter, v, v2) if err != nil { return nil, err } - agentDispatchInternalClient, err := rpc.NewTypedAgentDispatchInternalClient(clientParams) + v3, err := rpc.NewTypedAgentDispatchInternalClient(clientParams) if err != nil { return nil, err } - agentDispatchService := NewAgentDispatchService(limitConfig, agentDispatchInternalClient, topicFormatter, roomAllocator, router) + agentDispatchService := NewAgentDispatchService(limitConfig, v3, topicFormatter, roomAllocator, router) egressService := NewEgressService(egressClient, rtcEgressLauncher, ioInfoService, roomService) ingressConfig := getIngressConfig(conf) ingressClient, err := rpc.NewIngressClient(clientParams) @@ -117,11 +117,11 @@ func InitializeServer(conf *config.Config, currentNode routing.LocalNode) (*Live } sipService := NewSIPService(sipConfig, nodeID, messageBus, sipClient, sipStore, roomService, telemetryService) rtcService := NewRTCService(conf, roomAllocator, router, telemetryService) - whipParticipantClient, err := rpc.NewTypedWHIPParticipantClient(clientParams) + v4, err := rpc.NewTypedWHIPParticipantClient(clientParams) if err != nil { return nil, err } - serviceWHIPService, err := NewWHIPService(conf, router, roomAllocator, clientParams, topicFormatter, whipParticipantClient) + serviceWHIPService, err := NewWHIPService(conf, router, roomAllocator, clientParams, topicFormatter, v4) if err != nil { return nil, err } @@ -146,8 +146,8 @@ func InitializeServer(conf *config.Config, currentNode routing.LocalNode) (*Live if err != nil { return nil, err } - authHandler := getTURNAuthHandlerFunc(turnAuthHandler) - server, err := newInProcessTurnServer(conf, authHandler) + v5 := getTURNAuthHandlerFunc(turnAuthHandler) + server, err := newInProcessTurnServer(conf, v5) if err != nil { return nil, err } diff --git a/renovate.json b/renovate.json index 213b7913d..f4320b2d0 100644 --- a/renovate.json +++ b/renovate.json @@ -1,34 +1,79 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": ["config:base", "helpers:pinGitHubActionDigests"], + "extends": [ + "config:recommended", + "helpers:pinGitHubActionDigests" + ], "minimumReleaseAge": "2 weeks", "commitBody": "Generated by renovateBot", + "prConcurrentLimit": 5, + "vulnerabilityAlerts": { + "enabled": true, + "minimumReleaseAge": "2 days", + "prConcurrentLimit": 0, + "prHourlyLimit": 0, + "schedule": [] + }, "packageRules": [ { - "schedule": "before 6am every monday", "matchManagers": ["github-actions"], "groupName": "github workflows" }, { - "schedule": "before 6am every monday", "matchManagers": ["dockerfile"], - "groupName": "docker deps" + "groupName": "docker deps", + "pinDigests": true }, { - "schedule": "before 6am every monday", + "description": "Go modules are never grouped: each module gets its own PR so a bad bump can be reverted on its own", "matchManagers": ["gomod"], - "groupName": "go deps" + "groupName": null }, { + "description": "Exception to the rule above: the pion modules are co-released and depend on each other, so bumping them one at a time produces PRs that don't build", "matchManagers": ["gomod"], - "matchPackagePrefixes": ["github.com/pion"], + "matchPackageNames": ["github.com/pion{/,}**"], "groupName": "pion deps" }, { + "description": "First-party deps, no need to quarantine new releases", "matchManagers": ["gomod"], - "matchPackagePrefixes": ["github.com/livekit"], - "groupName": "livekit deps" + "matchPackageNames": [ + "github.com/livekit{/,}**" + ], + "minimumReleaseAge": null + }, + { + "description": "The go directive is the module minimum, owned by the go toolchain and dependency requirements; the build toolchain is pinned in the Dockerfile builder image instead", + "matchManagers": ["gomod"], + "matchDepTypes": ["golang"], + "enabled": false + }, + { + "description": "Build toolchain pin (Dockerfile golang image): a patch bump (stays on the current minor) and a minor bump each get their own approvable PR", + "matchManagers": ["dockerfile"], + "matchPackageNames": ["golang"], + "groupName": null, + "separateMinorPatch": true } ], - "postUpdateOptions": ["gomodTidy"] + "customManagers": [ + { + "customType": "regex", + "description": "Bump the builder image's Alpine suffix (golang:X.Y.Z-alpineA.B) along with its pinned digest. The base docker manager only bumps the Go version and holds the Alpine suffix fixed. This looks up the golang image (not alpine) with regex versioning that treats the Alpine minor as the version to bump and the Go version as the fixed compatibility, so Renovate only proposes an Alpine that actually exists as a published golang tag. The digest is captured so a suffix bump rewrites the pin instead of leaving a stale one.", + "managerFilePatterns": [ + "/(^|/)Dockerfile$/", + "/(^|/)[^/]*\\.Dockerfile$/" + ], + "matchStrings": ["FROM golang:(?\\d+\\.\\d+\\.\\d+-alpine\\d+\\.\\d+)@(?sha256:[0-9a-f]+)"], + "datasourceTemplate": "docker", + "depNameTemplate": "golang", + "versioningTemplate": "regex:^(?\\d+\\.\\d+\\.\\d+)-alpine(?\\d+)\\.(?\\d+)$" + } + ], + "postUpdateOptions": [ + "gomodTidy" + ], + "schedule": ["before 9am on monday"], + "updateNotScheduled": false } diff --git a/tools/tools.go b/tools/tools.go deleted file mode 100644 index f77dcd861..000000000 --- a/tools/tools.go +++ /dev/null @@ -1,23 +0,0 @@ -// Copyright 2023 LiveKit, Inc. -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -//go:build tools -// +build tools - -package tools - -import ( - _ "github.com/google/wire/cmd/wire" - _ "github.com/maxbrunsfeld/counterfeiter/v6" -)