Skip to content

Update buildkit to v0.28.1 #3219

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Elijah-Destigni wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Update buildkit to v0.28.1 #3219

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2ddff00
Update buildkit to v0.28.1
Elijah-Destigni Apr 2, 2026
4828c00
Update golang builder base images
simonbaird Apr 2, 2026
f361ef6
Update buildkit in tools/go.mod also
simonbaird Apr 2, 2026
f267e3c
Update golang version in .tool-versions also
simonbaird Apr 2, 2026
2ca630d
added build tags to benchmark files
Elijah-Destigni Apr 7, 2026
b11865b
Merge branch 'main' into eli/dep-bump
Elijah-Destigni Apr 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .tool-versions
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
golang 1.25.3
golang 1.25.5
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

## Build

FROM docker.io/library/golang:1.25.3 AS build
FROM docker.io/library/golang:1.25.5 AS build

ARG TARGETOS
ARG TARGETARCH
Expand Down
2 changes: 1 addition & 1 deletion Dockerfile.dist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

## Build

FROM registry.access.redhat.com/ubi9/go-toolset:1.25.3@sha256:e8938564f866174a6d79e55dfe577c2ed184b1f53e91d782173fb69b07ce69ef AS build
FROM registry.access.redhat.com/ubi9/go-toolset:1.25.5@sha256:82b82ecf4aedf67c4369849047c2680dba755fe57547bbb05eca211b22038e29 AS build

ARG TARGETOS
ARG TARGETARCH
Expand Down
2 changes: 1 addition & 1 deletion acceptance/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/conforma/cli/acceptance

go 1.25.3
go 1.25.5

require (
cuelang.org/go v0.15.3
Expand Down
2 changes: 2 additions & 0 deletions benchmark/internal/registry/registry.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
2 changes: 2 additions & 0 deletions benchmark/internal/suite/closer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
2 changes: 2 additions & 0 deletions benchmark/internal/suite/suite.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
2 changes: 2 additions & 0 deletions benchmark/internal/untar/untar.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
2 changes: 2 additions & 0 deletions benchmark/offliner/base_images.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
2 changes: 2 additions & 0 deletions benchmark/offliner/nab.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
4 changes: 3 additions & 1 deletion benchmark/offliner/offliner.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "1) Confirm benchmark build tags on offliner sources:"
rg -n '^//go:build benchmark' benchmark/offliner/offliner.go benchmark/offliner/offliner_test.go

echo
echo "2) Confirm benchmark run target does/doesn't pass tags:"
rg -n -C3 'benchmark_%|go run \.|-tags=benchmark' Makefile

Repository: conforma/cli

Length of output: 1772

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "1) Checking for build tags in benchmark/offliner files:"
if fd offliner.go benchmark/offliner/ 2>/dev/null; then
  fd offliner.go benchmark/offliner/ | head -5 | while read -r f; do
    echo "File: $f"
    head -1 "$f"
  done
fi

echo
echo "2) Checking Makefile for benchmark target:"
if [ -f Makefile ]; then
  grep -n -A5 'benchmark_%' Makefile || echo "Pattern not found"
fi

Repository: conforma/cli

Length of output: 457

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Files in benchmark/offliner/:"
ls -la benchmark/offliner/ 2>/dev/null || echo "Directory listing failed"

echo
echo "Checking for other offliner files with build tags:"
find benchmark/offliner/ -name "*.go" -type f -exec head -1 {} + 2>/dev/null | head -20

Repository: conforma/cli

Length of output: 1278

Benchmark target breaks—all Go files are excluded by the build constraint

Line 1 adds //go:build benchmark, but ALL nine Go files in benchmark/offliner/ (base_images.go, nab.go, offliner.go, offliner_test.go, referrers.go, refs.go, related.go, scans.go, subjects.go) have this constraint. The Makefile benchmark target runs go run . without -tags=benchmark (line 170), which excludes every buildable file and causes the build to fail with no source files.

Proposed fix (Makefile) 
 .PHONY: benchmark_%
 benchmark_%: benchmark/%/data.tar.gz
 	`@cd` benchmark/$*
-	`@go` run .
+	`@go` run -tags=benchmark .
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@benchmark/offliner/offliner.go` at line 1, The build constraint `//go:build
benchmark` at the top of benchmark/offliner/*.go (e.g., offliner.go) causes all
package files to be excluded when `go run .` is invoked without tags; update
either the source or the Makefile: either remove or conditionally guard the
`//go:build benchmark` line from the Go files so they build normally, or modify
the Makefile benchmark target to invoke `go run -tags=benchmark .` (or add
`-tags=benchmark` to `go build`/`go test` invocations) so the files are
included; change the approach consistently across the package (files like
offliner.go, base_images.go, refs.go) to ensure the package is not empty at
build time.


// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down Expand Up @@ -51,7 +53,7 @@ func items(sourceImages []name.Reference, destination name.Registry) map[string]

func main() {
if len(os.Args) != 3 {
fmt.Fprintf(os.Stderr, "Usage: %s <image> <directory>\n", os.Args[0])
fmt.Fprintf(os.Stderr, "Usage: %s <image> <directory>", os.Args[0])
os.Exit(1)
}

Expand Down
2 changes: 2 additions & 0 deletions benchmark/offliner/offliner_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
2 changes: 2 additions & 0 deletions benchmark/offliner/referrers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
2 changes: 2 additions & 0 deletions benchmark/offliner/refs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
2 changes: 2 additions & 0 deletions benchmark/offliner/related.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
2 changes: 2 additions & 0 deletions benchmark/offliner/scans.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
2 changes: 2 additions & 0 deletions benchmark/offliner/subjects.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down
7 changes: 6 additions & 1 deletion benchmark/simple/simple.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build benchmark

// Copyright The Conforma Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand Down Expand Up @@ -77,7 +79,10 @@ func ec(dir string) func() {
}`

policy := fmt.Sprintf(`{
"publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZP/0htjhVt2y0ohjgtIIgICOtQtA\nnaYJRuLprwIv6FDhZ5yFjYUEtsmoNcW7rx2KM6FOXGsCX3BNc7qhHELT+g==\n-----END PUBLIC KEY-----",
"publicKey": "-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZP/0htjhVt2y0ohjgtIIgICOtQtA
naYJRuLprwIv6FDhZ5yFjYUEtsmoNcW7rx2KM6FOXGsCX3BNc7qhHELT+g==
-----END PUBLIC KEY-----",
"sources": [
{
"data": [
Expand Down
70 changes: 35 additions & 35 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/conforma/cli

go 1.25.3
go 1.25.5
Copy link
Copy Markdown
Member

@simonbaird simonbaird Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When we update golang we have to also update the builder base image in two dockerfiles.

Copy link
Copy Markdown
Member

@simonbaird simonbaird Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually I can push a commit on top of this to do that.


require (
cuelang.org/go v0.15.3
Expand Down Expand Up @@ -36,7 +36,7 @@ require (
github.com/sigstore/sigstore v1.10.4
github.com/sirupsen/logrus v1.9.4
github.com/smarty/cproxy/v2 v2.1.1
github.com/spdx/tools-golang v0.5.5
github.com/spdx/tools-golang v0.5.7
github.com/spf13/afero v1.15.0
github.com/spf13/cobra v1.10.2
github.com/spf13/pflag v1.0.10
Expand All @@ -48,7 +48,7 @@ require (
github.com/testcontainers/testcontainers-go/modules/registry v0.34.0
golang.org/x/benchmarks v0.0.0-20241115175113-a2b48b605b42
golang.org/x/exp v0.0.0-20250911091902-df9299821621
golang.org/x/net v0.49.0 // indirect
golang.org/x/net v0.51.0 // indirect
golang.org/x/sync v0.19.0
k8s.io/apiextensions-apiserver v0.34.2
k8s.io/apimachinery v0.35.0
Expand All @@ -65,7 +65,7 @@ replace github.com/google/go-containerregistry => github.com/conforma/go-contain
require (
github.com/go-openapi/runtime v0.29.2
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
golang.org/x/text v0.33.0
golang.org/x/text v0.34.0
gopkg.in/yaml.v3 v3.0.1
k8s.io/api v0.35.0
)
Expand Down Expand Up @@ -115,30 +115,30 @@ require (
github.com/alibabacloud-go/tea-utils/v2 v2.0.6 // indirect
github.com/alibabacloud-go/tea-xml v1.1.3 // indirect
github.com/aliyun/credentials-go v1.3.9 // indirect
github.com/anchore/go-struct-converter v0.0.0-20230627203149-c72ef8859ca9 // indirect
github.com/anchore/go-struct-converter v0.1.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/aws/aws-sdk-go-v2 v1.41.0 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 // indirect
github.com/aws/aws-sdk-go-v2/config v1.32.5 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.19.5 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
github.com/aws/aws-sdk-go-v2 v1.41.1 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
github.com/aws/aws-sdk-go-v2/config v1.32.7 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.19.7 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.9 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.12 // indirect
github.com/aws/aws-sdk-go-v2/service/ecr v1.51.2 // indirect
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.2 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.9 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.9 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.88.3 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.30.7 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.3 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.12 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.89.1 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
github.com/aws/smithy-go v1.24.0 // indirect
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.11.0 // indirect
github.com/basgys/goxml2json v1.1.0 // indirect
Expand All @@ -162,18 +162,18 @@ require (
github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
github.com/cockroachdb/apd/v3 v3.2.1 // indirect
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
github.com/containerd/containerd/v2 v2.2.0 // indirect
github.com/containerd/containerd/v2 v2.2.1 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
github.com/containerd/errdefs/pkg v0.3.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/platforms v1.0.0-rc.2 // indirect
github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
github.com/containerd/typeurl/v2 v2.2.3 // indirect
github.com/coreos/go-oidc/v3 v3.17.0 // indirect
github.com/cpuguy83/dockercfg v0.3.2 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
github.com/cyphar/filepath-securejoin v0.6.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
github.com/dgraph-io/badger/v4 v4.8.0 // indirect
Expand All @@ -184,7 +184,7 @@ require (
github.com/distribution/reference v0.6.0 // indirect
github.com/docker/cli v29.3.1+incompatible // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
github.com/docker/docker-credential-helpers v0.9.4 // indirect
github.com/docker/docker-credential-helpers v0.9.5 // indirect
github.com/docker/go-connections v0.5.0 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
Expand Down Expand Up @@ -269,7 +269,7 @@ require (
github.com/json-iterator/go v1.1.12 // indirect
github.com/jstemmer/go-junit-report v1.0.0 // indirect
github.com/kevinburke/ssh_config v1.2.0 // indirect
github.com/klauspost/compress v1.18.2 // indirect
github.com/klauspost/compress v1.18.4 // indirect
github.com/kr/pretty v0.3.1 // indirect
github.com/kr/text v0.2.0 // indirect
github.com/lestrrat-go/blackmagic v1.0.4 // indirect
Expand All @@ -289,18 +289,18 @@ require (
github.com/mattn/go-runewidth v0.0.19 // indirect
github.com/miekg/pkcs11 v1.1.1 // indirect
github.com/mitchellh/go-homedir v1.1.0 // indirect
github.com/moby/buildkit v0.26.3 // indirect
github.com/moby/buildkit v0.28.1 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/go-archive v0.1.0 // indirect
github.com/moby/go-archive v0.2.0 // indirect
github.com/moby/locker v1.0.1 // indirect
github.com/moby/patternmatcher v0.6.0 // indirect
github.com/moby/patternmatcher v0.6.1 // indirect
github.com/moby/sys/sequential v0.6.0 // indirect
github.com/moby/sys/user v0.4.0 // indirect
github.com/moby/sys/userns v0.1.0 // indirect
github.com/moby/term v0.5.2 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/morikuni/aec v1.0.0 // indirect
github.com/morikuni/aec v1.1.0 // indirect
github.com/mozillazg/docker-credential-acr-helper v0.4.0 // indirect
github.com/muhammadmuzzammil1998/jsonc v1.0.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
Expand Down Expand Up @@ -353,7 +353,7 @@ require (
github.com/tchap/go-patricia/v2 v2.3.3 // indirect
github.com/thales-e-security/pool v0.0.2 // indirect
github.com/theupdateframework/go-tuf v0.7.0 // indirect
github.com/theupdateframework/go-tuf/v2 v2.3.0 // indirect
github.com/theupdateframework/go-tuf/v2 v2.4.1 // indirect
github.com/tidwall/gjson v1.17.0 // indirect
github.com/tidwall/match v1.1.1 // indirect
github.com/tidwall/pretty v1.2.1 // indirect
Expand Down Expand Up @@ -398,13 +398,13 @@ require (
go.uber.org/zap v1.27.1 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.47.0 // indirect
golang.org/x/mod v0.31.0 // indirect
golang.org/x/crypto v0.48.0 // indirect
golang.org/x/mod v0.33.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sys v0.41.0 // indirect
golang.org/x/term v0.39.0 // indirect
golang.org/x/term v0.40.0 // indirect
golang.org/x/time v0.14.0 // indirect
golang.org/x/tools v0.40.0 // indirect
golang.org/x/tools v0.41.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/api v0.260.0 // indirect
google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 // indirect
Expand Down
Loading
Loading