Skip to content

fix(ops): group OpenTelemetry module upgrades and sync semconv imports in Go files #2015

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bwplotka merged 8 commits into from
Aug 6, 2026
+31 −5
Merged

fix(ops): group OpenTelemetry module upgrades and sync semconv imports in Go files #2015

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c5c876a
fix(ops): group OpenTelemetry module upgrades and sync semconv import…
bwplotka Jul 25, 2026
7b21619
fix(ops): convert relative vuln_file to absolute path before pushd
bwplotka Aug 5, 2026
6ac7c13
fix(ops): append || true to grep pipelines in otel module resolution …
bwplotka Aug 5, 2026
570505e
fix(ops): guard go get call when otel_args is empty
bwplotka Aug 5, 2026
ad4d1c3
fix(ops): remove semconv import synchronization from vulnfix
bwplotka Aug 5, 2026
3a06cd9
fix(ops): use cut -s to suppress missing delimiter output in vulnfix
bwplotka Aug 6, 2026
cfd5c3b
fix(ops): group all core OpenTelemetry modules and exporters during v…
bwplotka Aug 6, 2026
23bcbd9
fix(ops): log error and return when OpenTelemetry module target resol…
bwplotka Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 31 additions & 5 deletions ops/gmpctl/lib.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,28 +143,54 @@ release-lib::gomod_vulnfix() {
return 1
fi

if [[ "${vuln_file}" != /* ]]; then
vuln_file="$(pwd)/${vuln_file}"
fi

# Read the vulnerability file line by line.
# The `|| [[ -n "$line" ]]` part handles the case where the last line doesn't have a newline.
pushd "${dir}"
Comment thread
bwplotka marked this conversation as resolved.
while IFS= read -r line || [[ -n "$line" ]]; do
# Skip any empty lines in the input file.
if [ -z "$line" ]; then
continue
fi

mod=$(echo "$line" | awk '{print $2}')
mod=$(echo "$line" | awk '{print $1}')
mod_path=$(echo "${mod}" | cut -d'@' -f1)
desired_version=$(echo "${mod}" | cut -d'@' -f2)
desired_version=$(echo "${mod}" | cut -s -d'@' -f2)

if [[ -z "${mod_path}" ]] || [[ -z "${desired_version}" ]]; then
echo "⚠️ Skipping malformed line: $line"
continue
fi

echo "🔄 Updating module '${mod_path}' to version '${desired_version}'..."
${SED} -i "s|\( ${mod_path} \).*|\1${desired_version}|" "${dir}/go.mod"
if [[ "${mod_path}" == go.opentelemetry.io/otel* ]]; then
# OpenTelemetry core API/SDK modules share versions and schema URLs across packages (e.g. otel, otel/sdk, otel/trace, otel/metric).
# Upgrade core otel modules present in the module graph together to avoid conflicting schema URL errors.
otel_mods=$(go list -m all 2>/dev/null | awk '/^go\.opentelemetry\.io\/otel($|\/)/ && !/^go\.opentelemetry\.io\/otel\/(contrib|semconv)/ {print $1}')
all_otel=$(echo "${mod_path} ${otel_mods}" | tr ' ' '\n' | sort -u)
otel_args=""
for m in $(echo "${all_otel}" | tr ' ' '\n'); do
if go list -m "${m}@${desired_version}" >/dev/null 2>&1; then
otel_args="${otel_args} ${m}@${desired_version}"
fi
done
if [[ -n "${otel_args// /}" ]]; then
Comment thread
bwplotka marked this conversation as resolved.
echo "🔄 Updating OpenTelemetry modules simultaneously:${otel_args}..."
go get ${otel_args}

@bwplotka bwplotka Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW: sed was on purpose here -- it limits the chained updates related to this dep. go mod tidy after sed-ing scopes updates only to things that truly are needed.

e.g. client_golang update does not need latest 0.x common, and breaking changes on those occur.

${SED} -i "s|\(	${mod_path} \).*|\1${desired_version}|" "${dir}/go.mod"

Something to keep in mind, but we could try with this, especially AI is forcing this all the time ;p

else
log_err "Could not resolve any OpenTelemetry modules matching version '${desired_version}'"
popd
return 1
fi

else
echo "🔄 Updating module '${mod_path}' to version '${desired_version}'..."
go get "${mod_path}@${desired_version}"
fi
done <"${vuln_file}"
echo "🔄 Resolving ${dir}/go.mod..."
pushd "${dir}"
go mod tidy
popd
}
Expand Down
Loading