fix(ops): group OpenTelemetry module upgrades and sync semconv imports in Go files - #2015
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the vulnerability fixing logic in ops/gmpctl/lib.sh to use go get for updating modules instead of direct sed replacements in go.mod. It also introduces special handling for OpenTelemetry modules to upgrade them simultaneously and align semconv imports to prevent conflicting Schema URL errors. The review feedback highlights potential script crashes due to the use of grep in pipelines under set -o pipefail and set -o errexit when no matches are found, and suggests using awk to safely handle these cases.
| echo "🔄 Updating OpenTelemetry modules simultaneously:${otel_args}..." | ||
| go get ${otel_args} | ||
|
|
||
| # OpenTelemetry SDK resource detectors (e.g. WithProcessRuntimeDescription, WithTelemetrySDK) |
There was a problem hiding this comment.
I am assuming we can equally in our fork remove the explicit schema at this point? 🤔
There was a problem hiding this comment.
Ok, we can delete the explicit scheme - confirmed with @dashpole https://github.com/GoogleCloudPlatform/prometheus/blob/a24099b1f7e42d86bae4e911d245fdcf932f7cff/tracing/tracing.go#L33
6763f5e to
6bca81e
Compare
…s in Go files - Uses `go list -m all` to include direct and indirect `go.opentelemetry.io/otel*` modules (such as `otel/trace`, `otel/sdk`, `otel/metric`) in simultaneous upgrades. - Dynamically queries the exact `semconv` package version imported by `go.opentelemetry.io/otel/sdk/resource` and updates hardcoded `semconv` imports across Go files to match. Signed-off-by: bwplotka <bwplotka@google.com>
6bca81e to
c5c876a
Compare
Signed-off-by: bwplotka <bwplotka@google.com>
…to prevent pipefail exit Signed-off-by: bwplotka <bwplotka@google.com>
Signed-off-by: bwplotka <bwplotka@google.com>
Signed-off-by: bwplotka <bwplotka@google.com>
Signed-off-by: bwplotka <bwplotka@google.com>
…ulnfix Signed-off-by: bwplotka <bwplotka@google.com>
…ution fails Signed-off-by: bwplotka <bwplotka@google.com>
| done | ||
| if [[ -n "${otel_args// /}" ]]; then | ||
| echo "🔄 Updating OpenTelemetry modules simultaneously:${otel_args}..." | ||
| go get ${otel_args} |
There was a problem hiding this comment.
BTW: sed was on purpose here -- it limits the chained updates related to this dep. go mod tidy after sed-ing scopes updates only to things that truly are needed.
e.g. client_golang update does not need latest 0.x common, and breaking changes on those occur.
${SED} -i "s|\( ${mod_path} \).*|\1${desired_version}|" "${dir}/go.mod"
Something to keep in mind, but we could try with this, especially AI is forcing this all the time ;p
2 participants
Description
This PR fixes vulnerability updates for OpenTelemetry modules in
gmpctl:go list -m allto discover all direct and indirectgo.opentelemetry.io/otel*modules (such asotel/trace,otel/sdk,otel/metric, etc.) and upgrades them simultaneously to avoid version drift and partial module upgrades.semconvImport Synchronization: Dynamically queries the exactsemconvpackage version imported bygo.opentelemetry.io/otel/sdk/resourceand updates hardcodedsemconvimports in.gofiles. This preventsconflicting Schema URLerrors during tracer provider initialization (e.g.failed to install a new tracer provider: error detecting resource: conflicting Schema URL: https://opentelemetry.io/schemas/1.40.0 and https://opentelemetry.io/schemas/1.41.0).Signed-off-by: bwplotka bwplotka@google.com