fix: devcontainers go version stops drifting (#13523)

Signed-off-by: David L. Chandler <david.chandler@solo.io>

Author: chandler-solo

.github/workflows/unit.yaml

@@ -37,4 +37,19 @@ jobs:
       # The make will error if test coverage drops below a certain threshold
       # We intentionally ignore the errors while we build out our test coverage, to establish a good baseline
       # However, we should strive to establish a baseline, and then make it required on PRs
-      run: make --always-make --ignore-errors validate-test-coverage
+      run: make --always-make --ignore-errors validate-test-coverage
+
+  # Catches version drift between go.mod, Dockerfile, and Makefile
+  version-drift:
+    name: Version Drift Check
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Go
+      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+      with:
+        go-version-file: tools/go.mod
+    - name: Run drift tests
+      working-directory: tools
+      run: go test -v -count=1 ./build-tools/

tools/build-tools/Dockerfile

@@ -1,9 +1,6 @@
 # Based on Istio's build-tools image: https://github.com/istio/tools/tree/228d21452fd640bf7389d7d41fecaa715ce73249/docker/build-tools
-ARG GO_VERSION=1.25.7
-ARG GO_BASE_IMAGE=golang:${GO_VERSION}-bookworm
 ARG UBUNTU_BASE_IMAGE=ubuntu:noble
 
-FROM ${GO_BASE_IMAGE} AS go_context
 FROM ${UBUNTU_BASE_IMAGE} AS build_tools
 
 ARG TARGETARCH
@@ -14,10 +11,9 @@ LABEL "io.kgateway.version"="${VERSION}"
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Pinned tool versions (keep aligned with `go.mod` and repo tooling where possible)
+# Pinned tool versions (not tracked in go.mod)
 ENV RUST_VERSION=1.86.0
 ENV KUBECTL_VERSION=1.35.0
-ENV HELM_VERSION=v3.19.2
 ENV PROTOC_VERSION=33.2
 ENV BUF_VERSION=v1.62.1
 ENV YQ_VERSION=4.50.1
@@ -87,8 +83,15 @@ RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
       docker-buildx-plugin \
     && rm -rf /var/lib/apt/lists/*
 
-# Go toolchain (copy from official golang image to match go.mod)
-COPY --from=go_context /usr/local/go /usr/local/go
+# go.mod is the single source of truth for Go, Helm, and Kind versions.
+# Tool install steps below extract their version from it at build time.
+COPY go.mod /tmp/go.mod
+
+# Go toolchain (version from go.mod)
+RUN set -eux; \
+    GO_VERSION=$(grep '^go ' /tmp/go.mod | awk '{print $2}'); \
+    test -n "$GO_VERSION" || { echo "Failed to extract Go version from go.mod"; exit 1; }; \
+    curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${TARGETARCH}.tar.gz" | tar -C /usr/local -xz
 
 # Install protoc
 RUN set -eux; \
@@ -112,8 +115,10 @@ RUN set -eux; \
 COPY tools/build-tools/kind /usr/local/bin/kind
 RUN chmod 555 /usr/local/bin/kind
 
-# helm
+# helm (version from go.mod helm.sh/helm/v3)
 RUN set -eux; \
+    HELM_VERSION=$(grep 'helm.sh/helm/v3' /tmp/go.mod | awk '{print $2}'); \
+    test -n "$HELM_VERSION" || { echo "Failed to extract Helm version from go.mod"; exit 1; }; \
     curl -fsSL -o /tmp/helm.tgz "https://get.helm.sh/helm-${HELM_VERSION}-linux-${TARGETARCH}.tar.gz"; \
     mkdir -p /tmp/helm; \
     tar -xzf /tmp/helm.tgz -C /tmp/helm; \

tools/build-tools/version_drift_test.go

@@ -6,8 +6,6 @@ import (
 	"regexp"
 	"runtime"
 	"testing"
-
-	"golang.org/x/mod/modfile"
 )
 
 func TestDockerfileVersionsMatchGoMod(t *testing.T) {
@@ -22,48 +20,15 @@ func TestDockerfileVersionsMatchGoMod(t *testing.T) {
 	}
 	dockerfile := string(dockerfileBytes)
 
-	gotGoVersion := mustMatch1(t, dockerfile, `(?m)^ARG GO_VERSION=([^\s]+)\s*$`, "Dockerfile ARG GO_VERSION")
-	gotHelmVersion := mustMatch1(t, dockerfile, `(?m)^ENV HELM_VERSION=([^\s]+)\s*$`, "Dockerfile ENV HELM_VERSION")
-
-	goModPath := filepath.Join(rootDir, "go.mod")
-	goModBytes, err := os.ReadFile(goModPath)
-	if err != nil {
-		t.Fatalf("read go.mod: %v", err)
-	}
-
-	parsed, err := modfile.Parse(goModPath, goModBytes, nil)
-	if err != nil {
-		t.Fatalf("parse go.mod: %v", err)
+	// Go and Helm versions are extracted directly from go.mod at Docker build
+	// time, so there are no hardcoded values to drift. Verify the Dockerfile
+	// does NOT contain stale hardcoded versions.
+	if regexp.MustCompile(`(?m)^ARG GO_VERSION=`).FindStringIndex(dockerfile) != nil {
+		t.Fatalf("Dockerfile should not hardcode ARG GO_VERSION; the Go version is derived from go.mod at build time")
 	}
-	if parsed.Go == nil || parsed.Go.Version == "" {
-		t.Fatalf("go.mod is missing a go version directive")
-	}
-
-	wantGoVersion := parsed.Go.Version
-	wantHelmVersion := requireVersion(t, parsed, "helm.sh/helm/v3")
-	wantKindVersion := requireVersion(t, parsed, "sigs.k8s.io/kind")
-
-	makefilePath := filepath.Join(rootDir, "Makefile")
-	makefileBytes, err := os.ReadFile(makefilePath)
-	if err != nil {
-		t.Fatalf("read Makefile: %v", err)
+	if regexp.MustCompile(`(?m)^ENV HELM_VERSION=`).FindStringIndex(dockerfile) != nil {
+		t.Fatalf("Dockerfile should not hardcode ENV HELM_VERSION; the Helm version is derived from go.mod at build time")
 	}
-	makefile := string(makefileBytes)
-	gotKindVersion := mustMatch1(t, makefile, `(?m)^KIND_VERSION\s*\?=\s*([^\s]+)\s*$`, "Makefile KIND_VERSION")
-
-	t.Run("go", func(t *testing.T) {
-		t.Parallel()
-		if gotGoVersion != wantGoVersion {
-			t.Fatalf("GO_VERSION drift detected: Dockerfile has %q, go.mod has %q", gotGoVersion, wantGoVersion)
-		}
-	})
-
-	t.Run("helm", func(t *testing.T) {
-		t.Parallel()
-		if gotHelmVersion != wantHelmVersion {
-			t.Fatalf("HELM_VERSION drift detected: Dockerfile has %q, go.mod helm.sh/helm/v3 is %q", gotHelmVersion, wantHelmVersion)
-		}
-	})
 
 	t.Run("kind", func(t *testing.T) {
 		t.Parallel()
@@ -77,8 +42,16 @@ func TestDockerfileVersionsMatchGoMod(t *testing.T) {
 			t.Fatalf("KIND_VERSION drift risk detected: Dockerfile should not download kind via curl")
 		}
 
-		if gotKindVersion != wantKindVersion {
-			t.Fatalf("KIND_VERSION drift detected: Makefile has %q, go.mod sigs.k8s.io/kind is %q", gotKindVersion, wantKindVersion)
+		// KIND_VERSION in the Makefile is derived from go.mod at make time,
+		// so there is no hardcoded literal to drift. Verify it stays dynamic.
+		makefilePath := filepath.Join(rootDir, "Makefile")
+		makefileBytes, err := os.ReadFile(makefilePath)
+		if err != nil {
+			t.Fatalf("read Makefile: %v", err)
+		}
+		makefile := string(makefileBytes)
+		if regexp.MustCompile(`(?m)^KIND_VERSION\s*\?=\s*v[\d.]+\s*$`).FindStringIndex(makefile) != nil {
+			t.Fatalf("KIND_VERSION drift risk detected: Makefile should derive KIND_VERSION from go.mod, not hardcode it")
 		}
 	})
 }
@@ -113,27 +86,3 @@ func fileExists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
 }
-
-func mustMatch1(t *testing.T, content, pattern, label string) string {
-	t.Helper()
-
-	re := regexp.MustCompile(pattern)
-	m := re.FindStringSubmatch(content)
-	if len(m) != 2 {
-		t.Fatalf("%s not found (pattern %q)", label, pattern)
-	}
-	return m[1]
-}
-
-func requireVersion(t *testing.T, mf *modfile.File, modulePath string) string {
-	t.Helper()
-
-	for _, req := range mf.Require {
-		if req.Mod.Path == modulePath {
-			return req.Mod.Version
-		}
-	}
-
-	t.Fatalf("go.mod is missing required module %q", modulePath)
-	return ""
-}

tools/go.mod

@@ -7,7 +7,7 @@ tool (
 	sigs.k8s.io/controller-runtime/tools/setup-envtest
 )
 
-require golang.org/x/mod v0.32.0
+require golang.org/x/mod v0.32.0 // indirect
 
 require (
 	al.essio.dev/pkg/shellescape v1.6.0 // indirect