chore: add VERSION file with base version tag by davdhacs · Pull Request #19421 · stackrox/stackrox

davdhacs · 2026-03-13T16:44:16Z

Description

Add a VERSION file containing the base version tag (4.11.x), following the same pattern as COLLECTOR_VERSION, SCANNER_VERSION, and FACT_VERSION.

Changes

VERSION — new file containing 4.11.x
make/env.mk — make tag falls back to VERSION when git describe fails (enables shallow clones, .git-less builds)
start-release.yml — verifies VERSION matches the release being created, updates VERSION on master to the next minor release

Release automation

The start-release workflow:

Verifies the VERSION file matches the release (e.g. releasing 4.11.0 requires VERSION to contain 4.11.x). Fails early if they don't match.
Updates VERSION on master to the next minor release (e.g. 4.12.x) after tagging.

The release branch inherits the correct VERSION naturally from the branching point.

Why

This file is the foundation for enabling Go build and test caches across commits. Go's cache keys include -X ldflags; the per-commit MainVersion from git describe invalidates both the link cache (re-links all binaries) and test cache (re-runs all tests) on every commit.

With a VERSION file, companion changes to go-tool.sh can use the stable base tag for test builds and linking, while release binaries still get the full git describe version.

Measured impact (with companion go-tool.sh changes)

Job	Today	With cache enabled	Speedup
go unit tests	45m	14m	3.3x
go-postgres	35m	4m	8.7x
sensor-integration	21m	5m	4x
Build step (link cache)	41s	~21s	2x

Test cache hit rate: 92% (1942/2108 packages). Data from PR #19404 which tested all changes together.

Also enables

Shallow clones (make tag falls back to VERSION when git describe fails)
Faster status.sh (read file vs make tag overhead)

Partially generated by AI.

openshift-ci · 2026-03-13T16:44:21Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

sourcery-ai

Hey - I've left some high level feedback:

The VERSION file is added empty in this PR; consider initializing it to the current base version (e.g., 4.11.x) so that local use and any tooling that reads it before the first start-release run behave as intended.
The workflow only updates VERSION when the release branch does not already exist; if a release branch is re-run or recreated, VERSION may diverge from the intended value—verify this matches the release process expectations or add a guard/update behavior for existing branches.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The VERSION file is added empty in this PR; consider initializing it to the current base version (e.g., `4.11.x`) so that local use and any tooling that reads it before the first `start-release` run behave as intended.
- The workflow only updates VERSION when the release branch does not already exist; if a release branch is re-run or recreated, VERSION may diverge from the intended value—verify this matches the release process expectations or add a guard/update behavior for existing branches.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

davdhacs · 2026-03-13T17:00:50Z

The VERSION file is added empty in this PR; consider initializing it to the current base version (e.g., 4.11.x) so that local use and any tooling that reads it before the first start-release run behave as intended.

no, the VERSION file is not empty. This may be a github diff bug/symptom of a new 1 line file being added.

The workflow only updates VERSION when the release branch does not already exist; if a release branch is re-run or recreated, VERSION may diverge from the intended value—verify this matches the release process expectations or add a guard/update behavior for existing branches.

The verification step runs unconditionally (not gated by branch-exists == false), so it will catch a mismatch even on re-runs. The update on master IS gated by branch-exists == false, which matches the existing behavior for the tag creation step — re-running a release doesn't re-tag master either. If a release branch is fully recreated (deleted and re-created), both the tag and VERSION update would run again, producing the correct result.

For patch releases (needs.variables.outputs.patch != 0), the workflow checks out the existing release branch which already has the correct VERSION inherited from when the branch was originally created.

rhacs-bot · 2026-03-13T17:04:10Z

Images are ready for the commit at 1ccb305.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-320-g1ccb305a2d.

Add a VERSION file containing the base version tag (e.g. "4.11.x"), following the same pattern as COLLECTOR_VERSION, SCANNER_VERSION, and FACT_VERSION. The start-release workflow automatically updates VERSION on both the release branch (set to A.B.x) and master (set to A.(B+1).x) when creating a new release. This file enables Go build and test cache optimizations (companion PRs). Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

codecov · 2026-03-13T18:29:25Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.71%. Comparing base (66a258b) to head (1ccb305).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #19421   +/-   ##
=======================================
  Coverage   49.70%   49.71%           
=======================================
  Files        2701     2701           
  Lines      203453   203453           
=======================================
+ Hits       101134   101143    +9     
+ Misses      94790    94784    -6     
+ Partials     7529     7526    -3

Flag	Coverage Δ
go-unit-tests	`49.71% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Remove fetch-depth: 0 from build, unit-tests, scanner-build, scanner-db-integration-tests, and style workflows. These jobs use make tag which now falls back to the VERSION file when git describe fails on shallow clones. Kept fetch-depth: 0 for misc-checks (needs git diff --check) and all release/periodic workflows (unchanged). Saves ~12s and ~220MB per job on checkout. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

davdhacs added area/ci ai-assisted labels Mar 13, 2026

openshift-ci bot added the do-not-merge/work-in-progress label Mar 13, 2026

davdhacs force-pushed the davdhacs/version-file branch from cc38a6f to a9ca808 Compare March 13, 2026 16:53

github-actions bot added the ai-review label Mar 13, 2026

davdhacs force-pushed the davdhacs/version-file branch from a9ca808 to b8696b1 Compare March 13, 2026 16:55

sourcery-ai bot reviewed Mar 13, 2026

View reviewed changes

davdhacs force-pushed the davdhacs/version-file branch from b8696b1 to 7470f28 Compare March 13, 2026 16:56

davdhacs force-pushed the davdhacs/version-file branch 2 times, most recently from 7eecf8f to 33cce69 Compare March 13, 2026 17:08

davdhacs force-pushed the davdhacs/version-file branch 3 times, most recently from afff196 to 80518f8 Compare March 13, 2026 17:56

davdhacs force-pushed the davdhacs/version-file branch 3 times, most recently from 6bf70f1 to 6cde900 Compare March 13, 2026 19:26

davdhacs force-pushed the davdhacs/version-file branch from 6cde900 to 1ccb305 Compare March 13, 2026 19:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: add VERSION file with base version tag#19421

chore: add VERSION file with base version tag#19421
davdhacs wants to merge 2 commits intomasterfrom
davdhacs/version-file

davdhacs commented Mar 13, 2026 •

edited

Loading

Uh oh!

openshift-ci bot commented Mar 13, 2026

Uh oh!

sourcery-ai bot left a comment

Uh oh!

davdhacs commented Mar 13, 2026 •

edited

Loading

Uh oh!

rhacs-bot commented Mar 13, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

davdhacs commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Release automation

Why

Measured impact (with companion go-tool.sh changes)

Also enables

Uh oh!

openshift-ci bot commented Mar 13, 2026

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

davdhacs commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rhacs-bot commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

davdhacs commented Mar 13, 2026 •

edited

Loading

davdhacs commented Mar 13, 2026 •

edited

Loading

rhacs-bot commented Mar 13, 2026 •

edited

Loading

codecov bot commented Mar 13, 2026 •

edited

Loading