bin helpers: add script to verify version image tags against GitHub - #273
Merged
Merged
Conversation
Adds `./bin/verify_version_image_tags.sh` helper script to check if docker images in Artifact Registry for gRPC release branches are tagged with the matching Git commit hash. Usage: ./bin/verify_version_image_tags.sh [options] Options: -n, --num-branches NUM Number of recent version branches to verify (default: 3) -r, --registry REGISTRY Artifact Registry path -l, --languages LANGS Comma-separated list of languages (default: cpp,python,go,java) -m, --include-master Include the master branch in verification Examples: # Verify last 3 versions for all default languages ./bin/verify_version_image_tags.sh # Verify last 5 versions for C++ only ./bin/verify_version_image_tags.sh -n 5 -l cpp # Verify only the master branch for Go ./bin/verify_version_image_tags.sh -n 0 -m -l go
Member
Author
|
Output sample, last 10 branches ( Output |
Member
Author
|
Fail/pass messages sample, checking current cpp master and the latest version branch ( |
Member
Author
|
/gemini review |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new bash script, bin/verify_version_image_tags.sh, which verifies that Docker images in Artifact Registry for the last N version branches of gRPC languages are tagged with their matching Git commit hashes. The review feedback highlights compatibility issues with macOS and older environments due to the use of associative arrays (declare -A), which require Bash 4.0+. Additionally, the feedback recommends removing || true error suppressions on several commands (such as gh and jq) to ensure the script fails fast with clear error messages, and suggests using printf instead of echo for safer JSON handling.
Address PR review feedback and debugging findings across script: - Remove error suppression (`|| true` and `|| echo '[]'`) on GitHub and Google Cloud CLI command substitutions to enforce fail-fast error visibility under `set -eo pipefail`. - Switch variable piping from `echo` to `printf '%s\n'` for reliable multiline branch list and JSON evaluation. - Replace array unfolding in `jq` tag assertions with scalar index evaluations (`index(...) != null`) and switch from tab `\t` to pipe `|` unit delimiters (`IFS='|'`) to prevent whitespace collapsing when images lack commit SHA tags.
Member
Author
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a new bash script, bin/verify_version_image_tags.sh, designed to verify that Docker images in the Artifact Registry for recent gRPC language version branches are correctly tagged with their corresponding Git commit hashes. The review feedback highlights several critical improvements: resolving potential runtime crashes in jq when dealing with untagged images, ensuring compatibility with macOS's default Bash 3.2 by removing associative arrays, optimizing GitHub API calls when the branch count is zero, and adding input validation for the --num-branches argument.
- Skip GraphQL query in fetch_version_branches when count is 0. - Guard printf sorting pipeline against empty branch string outputs. - Add null-coalescing operators (.tags // []) in verify_image_tag to prevent jq errors on untagged image manifests. - Validate that --num-branches is a non-negative integer in main.
Member
Author
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a new bash script, bin/verify_version_image_tags.sh, designed to verify that Docker images in the Artifact Registry for recent gRPC version branches are correctly tagged with their corresponding Git commit hashes. The review feedback highlights two important issues: first, the GraphQL query should use query variables instead of shell string interpolation to prevent syntax errors and improve robustness; second, the command-line argument parsing needs validation to prevent the script from crashing due to unsafe shifts when options are provided without arguments.
- Use GraphQL variables (-F owner, -F name) in fetch_version_branches. - Add jq optional chaining (.data.repository?.refs?.nodes[]?) to handle null repository payloads safely. - Group CLI parameter flags (-n, -r, -l) and add bounds validation ([[ 0 -ge 2 ]]) in main to prevent raw $2 unbound variable errors.
Member
Author
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a new Bash script, bin/verify_version_image_tags.sh, designed to verify that Docker images in Artifact Registry for the last N version branches of gRPC languages are tagged with their matching Git commit hashes. The code review feedback is highly constructive and suggests optimizing JSON parsing using here-strings to avoid ARG_MAX limits, replacing associative arrays with indirect variable references to ensure compatibility with Bash 3 (particularly for macOS users), and gracefully handling gcloud command failures to prevent abrupt script termination under set -e.
- Stream tags JSON via here-string (<<< "${tags_json}") to eliminate
unnecessary subshell pipeline creation in verify_image_tag.
- Add compound error check (||) around gcloud list-tags invocations
to emit clean diagnostic messages to stderr upon failure.
- Replace inline single-quoted query string with quoted heredoc assignment (read -r -d '' gql_query << 'QUERY'). - Remove # shellcheck disable=SC2016 annotation while preserving literal GraphQL variable syntax and static lint compliance.
arjan-bal
removed their request for review
July 28, 2026 16:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
./bin/verify_version_image_tags.shhelper script to check if docker images in Artifact Registry for gRPC release branches are tagged with the matching Git commit hash.Disclaimer: AI generated under my supervision.