Port Old Bash to New Go CI Tool

[kalverra]

Intent

Port a few low-risk bash scripts over to the new Go CI tool (tools/ci) to prove the concept works end-to-end before migrating more of the critical-path CI flow. This is the first in a series of ports toward replacing untested bash embedded in workflows with a tested Go CLI.

Big Changes

ci image resolve replaces resolve-chainlink-image.sh

A new image command (with resolve subcommand) replaces .github/scripts/resolve-chainlink-image.sh. Domain logic lives in internal/image (pure function: options in, (resolvedURI, error) out, with trimming/lowercasing/validation), and cmd/image.go is a thin cobra shell that reads flags with env fallbacks and renders human or --json output. When GITHUB_OUTPUT is set, it writes resolved_image via internal/ghaction.

This moves untested bash (and its bespoke bash test harness + dedicated workflow) into Go with a proper test suite, matching the tool's internal/cmd separation and dual-output conventions.

ci changeset check-tags replaces check-changeset-tags.sh

A new changeset command (with check-tags subcommand) replaces .github/scripts/check-changeset-tags.sh. internal/changeset parses changeset frontmatter (validating the chainlink semver), scans content for release tags loaded from an embedded tags.txt, and returns a Result. A golden test (TestAllowedTags) guards the exact tag set against unintentional drift.

This replaces an unvalidated inline tag list with an embedded golden file, and adds real tests where the shell script had none.

Small Changes

• Updated legacy-non-functional-tests.yml, legacy-system-tests.yml, and changeset.yml to invoke ci image resolve / ci changeset check-tags via a new setup-ci-cli action instead of running the bash scripts inline.
• Deleted .github/scripts/resolve-chainlink-image.sh, resolve-chainlink-image_test.sh, check-changeset-tags.sh, and the resolve-chainlink-image-tests.yml workflow (all superseded by the Go commands and tests).
• Documented the two new commands in tools/ci/README.md.
• Added gopkg.in/yaml.v3 dependency for changeset frontmatter parsing.

Callouts

• changeset output consistency — changeset.go unconditionally calls SetOutput while image.go guards on GITHUB_OUTPUT. Local human output may pick up has_tags=/found_tags= lines. Worth deciding on a single convention.
• Multi-file changesets — CHANGESET_FILE_PATH comes from dorny/paths-filter (list-files: shell) and can contain multiple space-separated paths; a single path is currently assumed, which can produce confusing os.Stat failures. This is a known follow-up, not addressed in this port.
• Duplicate logic parity — reviewers should confirm the Go implementations preserve the bash behavior exactly (case-insensitivity, whitespace trimming, case-sensitive image tag, error exit codes), since these scripts feed onward CI steps.

[github-actions]

✅ No conflicts with other open PRs targeting develop

[trunk-io]

   

View Full Report ↗︎ ⋅ Docs

[Tofel]

do we need some mechanism to validate/expand this list automatically, when what release process expects changes?

[erikburt]

The tags list was previously stored in the shell script, so I think this is a lateral move at-worst.

[kalverra]

I've slightly improved it further by moving it to a golden file, tags.txt, instead of directly in code.

[Copilot]

Pull request overview

Risk Rating: MEDIUM — This ports CI-critical workflow logic from bash to a Go CLI (tools/ci) and wires it into multiple GitHub Actions workflows. While the logic itself is small, any mismatch in CLI behavior/outputs can break CI pipelines.

Summary:
Ports the legacy “resolve Chainlink image” and “changeset tag checking” bash scripts to the ci Go tool, updates workflows to use the new commands, and removes the old scripts and their dedicated workflow tests.

Changes:

• Add ci image resolve (plus unit tests) to compute public/SDLC ECR image URIs and set resolved_image output.
• Add ci changeset check-tags (plus unit tests) to validate changeset semver frontmatter and detect allowed release tags.
• Update workflows to call the new Go CLI and delete the legacy bash scripts and the resolver bash test workflow.

Areas needing scrupulous human review:

• ci changeset check-tags input contract vs dorny/paths-filter output format (*_files may include multiple paths).
• GitHub Actions output behavior (ensuring outputs go to GITHUB_OUTPUT file only when expected; avoid polluting stdout in non-Actions runs).
• Workflow integration points (legacy-*-tests.yml, changeset.yml) to confirm step outputs are still consumed as intended.

Reviewed changes

Copilot reviewed 19 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/ci/README.md	Documents new ci image resolve and ci changeset check-tags commands.
tools/ci/internal/image/image.go	Implements image URI resolution for public vs SDLC ECR.
tools/ci/internal/image/image_test.go	Unit tests for image URI resolution + normalization/validation.
tools/ci/internal/changeset/tags.txt	Adds canonical allowed changeset tags list (embedded).
tools/ci/internal/changeset/changeset.go	Implements frontmatter semver validation + tag detection using embedded tags list.
tools/ci/internal/changeset/changeset_test.go	Golden test for allowed tags + functional tests for CheckTags.
tools/ci/go.mod	Adds YAML dependency for changeset frontmatter parsing.
tools/ci/go.sum	Updates checksums for new YAML dependency and transitive modules.
tools/ci/cmd/root.go	Registers new image and changeset command groups.
tools/ci/cmd/image.go	Adds ci image resolve command (flags/env + JSON + GitHub output).
tools/ci/cmd/image_test.go	CLI-level tests for ci image resolve output + GITHUB_OUTPUT writing.
tools/ci/cmd/changeset.go	Adds ci changeset check-tags command (file arg/env + JSON + outputs).
tools/ci/cmd/changeset_test.go	CLI-level tests for ci changeset check-tags JSON/human modes + outputs.
.github/workflows/resolve-chainlink-image-tests.yml	Removes legacy bash-based resolver test workflow.
.github/workflows/legacy-system-tests.yml	Switches resolver step to ci image resolve (after setting up CI CLI).
.github/workflows/legacy-non-functional-tests.yml	Switches resolver step to ci image resolve (after setting up CI CLI).
.github/workflows/changeset.yml	Switches changeset tag check step to ci changeset check-tags (after setting up CI CLI).
.github/scripts/resolve-chainlink-image.sh	Deletes legacy bash resolver implementation.
.github/scripts/resolve-chainlink-image_test.sh	Deletes legacy bash resolver tests.
.github/scripts/check-changeset-tags.sh	Deletes legacy bash changeset tag checker.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cl-sonarqube-production]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube