Go import paths with typos are ignored by ko during release

[grantr]

For the 0.8.1 release of eventing-contrib, some go import paths in YAML files were invalid due to typos (fixed in knative/eventing-contrib#543). ko resolve ignores any string that is not a valid go import path, so those strings were not recognized as buildable. The release succeeded, and some yaml files released were invalid (kafka-channel.yaml, kafka-channel-ccp.yaml).

Ideally tests would have caught this, and I'm not sure why they didn't (something else to investigate) but a simple safeguard might be to add a grep to release.sh that looks for ko-replaceable strings, e.g. image:\s+knative.dev or image:\s+github.com, and fails the release if they exist.

See ko-build/ko#9 for a more complete solution.

/cc @imjasonh @matzew

[imjasonh]

The underlying issue is fixed in ko-build/ko#58 which was just merged.

If you update your ko version (go get -u github.com/google/ko/cmd/ko) -- and expect/force developers to use a recent ko -- you can start prefixing expected import paths with ko:// and invoking ko resolve --strict -f config/.

This will cause ko to fail loudly if it finds an import path a human has marked but that it can't interpret as a valid Go main package.

[adrcunha]

Current prow-tests image contains a ko version that includes the fix above:

https://storage.googleapis.com/knative-prow/logs/ci-knative-serving-continuous/1173630354808901632/build-log.txt

>> ko built from commit
b7eb9dfe48be3773c7d931208e8f6fec129acf07

Using ko:// paths is now safe for all jobs running on Prow.