chore(azldev): move azldev to a proper go module tool#18052
Draft
dmcilvaney wants to merge 1 commit into
Draft
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Moves azldev version management into Go modules and updates CI to resolve and validate immutable tool hashes.
Changes:
- Adds the azldev Go tool dependency and supporting documentation.
- Refactors GitHub and ADO workflows to resolve the post-merge azldev hash.
- Adds resolver tests and dependency-smoke coverage.
Reviewed changes
Copilot reviewed 14 out of 15 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
go.mod |
Declares the azldev tool and dependencies. |
go.sum |
Locks Go dependency checksums. |
DEVELOPING.md |
Documents Go-based installation and usage. |
.github/workflows/lint.yaml |
Runs azldev through go tool. |
.github/workflows/dependency-smoke.yml |
Adds resolver test execution. |
.github/workflows/azldev-smoke.yml |
Builds the runner from a resolved hash. |
.github/workflows/check-rendered-specs.yml |
Resolves the post-merge tool and render scope. |
.github/workflows/containers/azldev-runner.Dockerfile |
Installs azldev using an immutable hash. |
.github/workflows/ado/templates/steps/install-deps.yml |
Resolves azldev from go.mod. |
.github/workflows/ado/templates/steps/get-changes-info.yml |
Validates PR commit state before installation. |
.github/instructions/pr-check-workflows.instructions.md |
Updates runner-build guidance. |
scripts/ci/render-specs-check/resolve_azldev_version.py |
Implements secure version/hash resolution. |
scripts/ci/render-specs-check/tests/conftest.py |
Configures resolver test imports. |
scripts/ci/render-specs-check/tests/requirements.txt |
Pins pytest. |
scripts/ci/render-specs-check/tests/test_resolve_azldev_version.py |
Tests resolver behavior and validation. |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 14 out of 15 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
go.mod:5
- The stated Dependabot migration is incomplete:
.github/dependabot.ymlcurrently configures onlypipandgithub-actions, so Dependabot will not scan this root Go module or propose azldev updates. Add a rootgomodupdate entry (preferably scoped togithub.com/microsoft/azure-linux-dev-tools) so this tool declaration is actually managed as intended.
tool github.com/microsoft/azure-linux-dev-tools/cmd/azldev
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 15 out of 16 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
scripts/ci/render-specs-check/resolve_azldev_version.py:125
- Resolving only the azldev module to a commit hash does not reproduce the tool selected by this repository's module graph.
go tool azldevand the documented unversionedgo installhonor rootgo.modtransitive versions/replacements, while every Docker/ADO install usesgo install ...@<hash>, which ignores rootgo.mod. Consequently, a Dependabot transitive update (explicitly enabled here) can change the developer/lint binary without changing this hash or settingrender-all, so the render gates test a different binary. Build CI from a validated post-merge module graph, or restrict and validate the graph so only the top-level azldev pin can vary.
module = json.loads(_run_go("mod", "download", "-json", f"{AZLDEV_MODULE}@{version}"))
dmcilvaney
force-pushed
the
damcilva/4.0/pipelines/go_tool_azldev
branch
from
July 21, 2026 23:05
8bc90e3 to
48a6ef8
Compare
dmcilvaney
force-pushed
the
damcilva/4.0/pipelines/go_tool_azldev
branch
from
July 22, 2026 00:59
48a6ef8 to
cc220c6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Move azldev version management into a conventional nested Go module so Dependabot can update the direct azldev dependency. Dependabot does not yet support dependencies declared solely by Go tool directives.
tools/azldev/go.modand resolve it to a validated immutable Git hash at the GitHub Actions, Docker, and ADO installation boundaries..azldev-versiontemporarily for compatibility with the currently deployed trusted rendered-spec workflow.4.0PRs must rebase so their raw heads includetools/azldev/go.mod.