feat(tools): add automated tool updater#12359
Open
DariuszPorowski wants to merge 5 commits into
Open
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces a repository-wide mechanism to centrally pin, validate, and automatically refresh external CLI tool versions and SHA-256 checksums via a YAML manifest and a new Go-based updater, then wires it into Make and GitHub Actions.
Changes:
- Adds
build/tools.yamlas the canonical tool manifest and commits the generatedbuild/tools.generated.mkinclude consumed by existingmake install-<tool>targets. - Introduces
cmd/tool-updaterplusinternal/toolinghelpers to validate the manifest, check release sources, and refresh checksums/versions (including syncing Terraform consumer files). - Adds a scheduled
update-toolsGitHub Actions workflow to runmake update-toolsand open/update a PR using a GitHub App token.
Reviewed changes
Copilot reviewed 40 out of 40 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/recipes/terraform/version.go | Updates comments to reflect tools manifest as the source of truth for Terraform pinning. |
| pkg/recipes/terraform/version_test.go | Updates test comments to match the new compatibility-file/updater flow. |
| Makefile | Reorders includes so tool metadata is available before build logic consumes it. |
| internal/tooling/updater.go | Implements version/checksum refresh logic and HTTP retrieval with retry/backoff. |
| internal/tooling/updater_test.go | Adds tests for version bumping, checksum refresh, and shared checksum-file caching. |
| internal/tooling/README.md | Documents updater usage and the tools manifest schema/behavior. |
| internal/tooling/manifest.go | Adds manifest schema, validation, template expansion, and file sync utilities. |
| internal/tooling/manifest_test.go | Adds repository-manifest parsing and helper-function tests. |
| docs/contributing/contributing-code/contributing-code-shell-and-make/README.md | Documents how contributors should manage external CLI pins via make update-tools. |
| cmd/tool-updater/main.go | Adds CLI entrypoint for manifest update and Make include regeneration. |
| build/tools.yaml | Adds the canonical tool manifest with sources, templates, assets, and checksums. |
| build/tools.mk | Switches to consuming generated metadata and adds make update-tools + generator rules. |
| build/tools.generated.mk | Adds committed generated Make metadata for tool versions and platform checksums. |
| build/scripts/install-yq.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-terraform.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-stern.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-shellcheck.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-oras.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-kubectl.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-kind.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-k3d.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-jq.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-helm.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-golangci-lint.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-dlv.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-dapr.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/scripts/install-bicep.sh | Updates comments to reflect tool data source as the manifest/generated include. |
| build/generate.mk | Removes unused CONTROLLER_TOOLS_VERSION variable. |
| build/build.mk | Updates Terraform version wiring comments to reflect tool-metadata include loading. |
| .github/workflows/validate-installers.yaml | Updates workflow comments to point at build/tools.yaml as pin source. |
| .github/workflows/validate-bicep.yaml | Updates workflow comments to point at build/tools.yaml as pin source. |
| .github/workflows/update-tools.yaml | Adds scheduled/manual workflow to run updater and open/update a PR via GitHub App token. |
| .github/workflows/unit-tests.yaml | Updates workflow comments to point at build/tools.yaml as pin source. |
| .github/workflows/lint.yaml | Updates workflow comments to point at build/tools.yaml as pin source. |
| .github/workflows/functional-test-noncloud.yaml | Updates workflow comments to point at build/tools.yaml as pin source. |
| .github/workflows/functional-test-cloud.yaml | Updates workflow comments to point at build/tools.yaml as pin source. |
| .github/workflows/copilot-setup-steps.yml | Expands path triggers and updates comments to reference the manifest-based pins. |
| .github/workflows/build.yaml | Updates workflow comments to point at build/tools.yaml as pin source. |
| .github/actions/create-kind-cluster/action.yaml | Updates composite action comment to reference manifest-based pinning. |
| .devcontainer/post-create.sh | Updates devcontainer post-create comments to reference manifest-based pinning. |
DariuszPorowski
force-pushed
the
fp/whole-takin-lime
branch
3 times, most recently
from
July 9, 2026 20:36
51f876b to
7d6e18b
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #12359 +/- ##
=======================================
Coverage 53.32% 53.32%
=======================================
Files 756 756
Lines 49030 49030
=======================================
Hits 26146 26146
Misses 20454 20454
Partials 2430 2430 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
DariuszPorowski
force-pushed
the
fp/whole-takin-lime
branch
3 times, most recently
from
July 9, 2026 23:05
fe5d5af to
3896335
Compare
DariuszPorowski
enabled auto-merge
July 9, 2026 23:17
Functional Tests - corerp-noncloud180 tests 178 ✅ 1h 21m 42s ⏱️ Results for commit 0ab6a6d. ♻️ This comment has been updated with latest results. |
Functional Tests - upgrade-noncloud3 tests 3 ✅ 3m 35s ⏱️ Results for commit 0ab6a6d. ♻️ This comment has been updated with latest results. |
1 task
DariuszPorowski
force-pushed
the
fp/whole-takin-lime
branch
from
July 13, 2026 17:37
3896335 to
379ddff
Compare
willdavsmith
self-requested a review
July 13, 2026 18:20
- Implemented a new updater for managing tool versions and checksums in the manifest. - Added functionality to retrieve the latest version and checksum from various sources. - Created tests to ensure the updater correctly refreshes versions and checksums. - Introduced a new HTTP client for making requests to version sources. - Updated the Terraform version handling to synchronize with the manifest. - Added tests to verify the correctness of version and checksum updates. - Ensured that comments and documentation reflect the new functionality and structure. Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
DariuszPorowski
force-pushed
the
fp/whole-takin-lime
branch
from
July 13, 2026 23:34
379ddff to
90597c2
Compare
Functional Tests - ucp-cloud4 tests 4 ✅ 33s ⏱️ Results for commit 90597c2. ♻️ This comment has been updated with latest results. |
Functional Tests - corerp-cloud30 tests 29 ✅ 20m 31s ⏱️ Results for commit 90597c2. ♻️ This comment has been updated with latest results. |
…retrieval Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
| make update-tools | ||
| ``` | ||
|
|
||
| Make builds the updater into `bin/` before executing it. This stable path is important on Windows, where security software may block the temporary executable created by `go run`. |
Member
There was a problem hiding this comment.
The Commands section is ambiguous about which target does what, and it doesn't mention the make install-<tool> targets at all — so a reader can't tell "update the pinned versions" from "install a tool locally." Suggest spelling out the two distinct workflows:
make update-tools— checks each tool's release source and advances its pinned version inbuild/tools.yamlto the latest available release (tools markedupdate: falsestay pinned), recomputes the SHA-256 checksums, regenerates the committedbuild/tools.generated.mk, and syncs the TerraformversionFiles. It reaches the network and edits files; it does not install anything onto your machine.make install-<tool>(e.g.make install-yq,make install-kubectl) — downloads and installs that tool's pinned version into a user-ownedbindir, using the metadata from the generated include. This is the one to run when you actually want the binary.
A one-line note that make update-tools also regenerates build/tools.generated.mk as a side effect (there's no separate "regenerate" make target — the generate-make subcommand shown below is the binary-level equivalent) would remove the last bit of ambiguity.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request adds an automated updater for Radius's external CLI tool versions and SHA-256 checksums.
The change:
build/tools.yamlas the canonical tool manifest and commits the generatedbuild/tools.generated.mkMake include.tool-updaterGo command with manifest validation, release-source checks, checksum refreshes, and Terraform version synchronization..github/workflows/update-tools.yamlworkflow, which opens or updates a PR using the Dependabot-manager GitHub App credentials.make install-<tool>targets and uses a stablebin/tool-updaterpath to avoid Windows temporary-executable elevation blocks.internal/tooling/README.md.Type of change
Fixes: #issue_number
Contributor checklist
eng/design-notes/in this repository, if new APIs are being introduced.Validation
go test ./internal/tooling ./cmd/tool-updatergo vet ./internal/tooling ./cmd/tool-updateractionlint