chore(ci): disable buildvcs for builds and tests by davdhacs · Pull Request #19201 · stackrox/stackrox

davdhacs · 2026-02-25T19:07:56Z

Description

Change: turn off Go's buildvcs version control injection

buildvcs=true/auto has been the Go default since Go 1.18 (2022). With auto, when the .git repo files are found during the build, the build stamps vcs.revision, vcs.time, and vcs.modified into every binary's BuildInfo. This data is hashed into the GOCACHE key. So every commit produces different keys even when no source files changed — invalidating large parts of both the build and test result caches.

No code in the repository reads this VCS data (version info is managed separately via status.sh; there are no debug.ReadBuildInfo() calls).

Result: Disabling buildvcs improves Go build and test cache hit rates.

Local measurement

7 binaries (central, sensor/kubernetes, sensor/upgrader, migrator, roxctl, compliance, config-controller), after an empty commit (no source changes, only VCS data differs):

Scenario	buildvcs=true	buildvcs=false
Cold (empty cache)	51.8s	50.1s
Warm (same commit)	~3s	~2s
Warm (new commit)	12.1s	1.9s
Test results cached (new commit)	0 of 3	3 of 3

With buildvcs=true, a new commit recompiles all main packages and invalidates all test result caches — even when no source files changed. With buildvcs=false, build and test caches are fully reused.

Reproduce locally

OUTDIR=$(mktemp -d)
TARGETS="./central ./sensor/kubernetes ./sensor/upgrader ./migrator ./roxctl ./compliance/cmd/compliance ./config-controller"

# Seed cache
go clean -cache && go clean -testcache
CGO_ENABLED=0 go build -trimpath -buildvcs=true -o "$OUTDIR/" $TARGETS
CGO_ENABLED=0 go test -trimpath -buildvcs=true ./pkg/version/... ./pkg/env/... ./pkg/utils/...

# Verify warm same commit
CGO_ENABLED=0 go test -trimpath -buildvcs=true ./pkg/version/... ./pkg/env/... ./pkg/utils/...
# expect: (cached) on all packages

# Empty commit (changes VCS data only)
git commit --allow-empty -m "test vcs change"

# Test after new commit
time CGO_ENABLED=0 go build -trimpath -buildvcs=true -o "$OUTDIR/" $TARGETS
# expect: ~12s (recompiles main packages)

CGO_ENABLED=0 go test -trimpath -buildvcs=true ./pkg/version/... ./pkg/env/... ./pkg/utils/...
# expect: 0 cached (test results invalidated)

git reset HEAD~1
rm -rf "$OUTDIR"

# Repeat with -buildvcs=false to compare

References

https://tip.golang.org/doc/go1.18#go-version

Go 1.18.0: -buildvcs=true (required VCS tool, broke Docker/CI builds)
Go 1.18.2: -buildvcs=auto (silently skips when VCS tool missing)

openshift-ci · 2026-02-25T19:08:00Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

rhacs-bot · 2026-02-25T19:42:26Z

Images are ready for the commit at 6f7378f.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-189-g6f7378f72f.

codecov · 2026-02-25T20:49:36Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.55%. Comparing base (02aadd3) to head (8fcd23f).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #19201      +/-   ##
==========================================
- Coverage   49.56%   49.55%   -0.01%     
==========================================
  Files        2675     2675              
  Lines      201820   201820              
==========================================
- Hits       100023   100011      -12     
- Misses      94340    94349       +9     
- Partials     7457     7460       +3

Flag	Coverage Δ
go-unit-tests	`49.55% <ø> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

sourcery-ai

Hey - I've found 1 issue, and left some high level feedback:

Using go-mod-with-buildvcs / go-build-with-buildvcs as cache key prefixes while the intent is to disable buildvcs is confusing; consider renaming these prefixes to reflect the post-change behavior so it’s easier to compare and reason about cache behavior over time.
The change to always run the cache save step with PR-specific keys will increase cache writes and storage churn; if this is intended to be temporary, consider centralizing the feature flag (e.g., a single workflow-level input or environment toggle) so it’s easy to turn off or scope down (e.g., to a subset of workflows or branches) after the experiment.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Using `go-mod-with-buildvcs` / `go-build-with-buildvcs` as cache key prefixes while the intent is to *disable* `buildvcs` is confusing; consider renaming these prefixes to reflect the post-change behavior so it’s easier to compare and reason about cache behavior over time.
- The change to always run the cache save step with PR-specific keys will increase cache writes and storage churn; if this is intended to be temporary, consider centralizing the feature flag (e.g., a single workflow-level input or environment toggle) so it’s easy to turn off or scope down (e.g., to a subset of workflows or branches) after the experiment.

## Individual Comments

### Comment 1
<location path=".github/actions/cache-go-dependencies/action.yaml" line_range="20-29" />
<code_context>
+    # TEMPORARY: always save with PR-specific keys for cache testing.
</code_context>
<issue_to_address>
**suggestion:** Cache comment mentions PR-specific keys, but the keys themselves are not PR-scoped.

These cache keys:
- `go-mod-with-buildvcs-${{ hashFiles('**/go.sum') }}`
- `go-build-with-buildvcs-${{ github.job }}-${{ steps.cache-paths.outputs.GOARCH }}-${{ steps.cache-paths.outputs.TAG }}`

are not PR-scoped (they lack something like `github.ref_name` or `github.event.pull_request.number`), so caches will be shared across branches/PRs with the same hash/job/arch/TAG. Either update the keys to include a PR identifier if the intent is truly PR-specific caches, or adjust the comment to describe the broader sharing behavior accurately.

Suggested implementation:

```
    # TEMPORARY: always save with broader cache keys (shared across branches/PRs) for cache testing.

```

If the intention is to truly scope caches per PR instead of sharing them across branches/PRs, you should also modify the `key:` (and optionally `restore-keys:`) fields for:
- `go-mod-with-buildvcs-${{ hashFiles('**/go.sum') }}`  
- `go-build-with-buildvcs-${{ github.job }}-${{ steps.cache-paths.outputs.GOARCH }}-${{ steps.cache-paths.outputs.TAG }}`  

to include a PR identifier such as `${{ github.ref_name }}` or `${{ github.event.pull_request.number }}` where those keys are defined elsewhere in this file.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

sourcery-ai · 2026-02-25T22:01:35Z

.github/actions/cache-go-dependencies/action.yaml

+    # TEMPORARY: always save with PR-specific keys for cache testing.
    - name: Cache Go Dependencies (save)
-      if: inputs.save == 'true' && (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch)
      uses: actions/cache@v5
      with:
        path: ${{ steps.cache-paths.outputs.GOMODCACHE }}
-        key: go-mod-v1-${{ hashFiles('**/go.sum') }}
-        restore-keys: go-mod-v1-
-
-    - name: Cache Go Dependencies (restore)
-      if: ${{ !(inputs.save == 'true' && (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch)) }}
-      uses: actions/cache/restore@v5
-      with:
-        path: ${{ steps.cache-paths.outputs.GOMODCACHE }}
-        key: go-mod-v1-${{ hashFiles('**/go.sum') }}
-        restore-keys: go-mod-v1-
+        key: go-mod-with-buildvcs-${{ hashFiles('**/go.sum') }}
+        restore-keys: go-mod-with-buildvcs-

    - name: Cache Go Build (save)
-      if: inputs.save == 'true' && (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch)
      uses: actions/cache@v5


suggestion: Cache comment mentions PR-specific keys, but the keys themselves are not PR-scoped.

These cache keys:

go-mod-with-buildvcs-${{ hashFiles('**/go.sum') }}

go-build-with-buildvcs-${{ github.job }}-${{ steps.cache-paths.outputs.GOARCH }}-${{ steps.cache-paths.outputs.TAG }}

are not PR-scoped (they lack something like github.ref_name or github.event.pull_request.number), so caches will be shared across branches/PRs with the same hash/job/arch/TAG. Either update the keys to include a PR identifier if the intent is truly PR-specific caches, or adjust the comment to describe the broader sharing behavior accurately.

Suggested implementation:

# TEMPORARY: always save with broader cache keys (shared across branches/PRs) for cache testing.

If the intention is to truly scope caches per PR instead of sharing them across branches/PRs, you should also modify the key: (and optionally restore-keys:) fields for:

go-mod-with-buildvcs-${{ hashFiles('**/go.sum') }}

go-build-with-buildvcs-${{ github.job }}-${{ steps.cache-paths.outputs.GOARCH }}-${{ steps.cache-paths.outputs.TAG }}

to include a PR identifier such as ${{ github.ref_name }} or ${{ github.event.pull_request.number }} where those keys are defined elsewhere in this file.

davdhacs added 2 commits February 25, 2026 10:51

disable buildvcs for builds and tests

76ede75

TEMPORARY: always save go-caches with pr-specific keys

faa5cb2

openshift-ci bot added the do-not-merge/work-in-progress label Feb 25, 2026

github-actions bot added area/ci ai-review labels Feb 25, 2026

empty commit

cc4e878

TEMPORARY: buildvcs=auto baseline with with-buildvcs cache keys

7175533

sourcery-ai bot reviewed Feb 25, 2026

View reviewed changes

davdhacs added 5 commits February 25, 2026 15:17

empty commit

e03a9e3

TEMPORARY: count cached test results in CI

02f821b

empty commit: test with-buildvcs cache on new SHA

2d07273

TEMPORARY: switch to buildvcs=false with no-buildvcs cache keys

8fcd23f

empty commit

6f7378f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(ci): disable buildvcs for builds and tests#19201

chore(ci): disable buildvcs for builds and tests#19201
davdhacs wants to merge 9 commits intomasterfrom
davdhacs/disable-buildvcs-tests

davdhacs commented Feb 25, 2026 •

edited

Loading

Uh oh!

openshift-ci bot commented Feb 25, 2026

Uh oh!

rhacs-bot commented Feb 25, 2026 •

edited

Loading

Uh oh!

codecov bot commented Feb 25, 2026 •

edited

Loading

Uh oh!

sourcery-ai bot left a comment

Uh oh!

sourcery-ai bot Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

davdhacs commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Local measurement

Reproduce locally

References

Uh oh!

openshift-ci bot commented Feb 25, 2026

Uh oh!

rhacs-bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

sourcery-ai bot Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

davdhacs commented Feb 25, 2026 •

edited

Loading

rhacs-bot commented Feb 25, 2026 •

edited

Loading

codecov bot commented Feb 25, 2026 •

edited

Loading