feat: add ops/gmpctl interactive scripts #1817

bwplotka · 2025-12-04T21:39:04Z

See ops/gmpctl/README.md and cl/840052660 for details.

I removed release bot given ops/gmpctl.sh release is now trivial, @hsmatulis agreed.

See go/gmp:toil-automation for motivation. * listing Go vulns + severity * create a security vuln fix commit * create a new fork release that syncs with certain upstream tag (see go/gmp:fork-toil) * cut RC Signed-off-by: bwplotka <bwplotka@google.com> chore: update chore: add go version check Signed-off-by: bwplotka <bwplotka@gmail.com>

Signed-off-by: bwplotka <bwplotka@gmail.com>

ops/gmpctl/lib.sh

ops/gmpctl/main.go

hsmatulis

Looks good! Just a plumbing issue

hack/presubmit.sh

bernot-dev · 2025-12-17T15:46:15Z

ops/gmpctl/gmp.go

+	// ReleaseBranches contains hardcoded list of active branches. We could pull it out from somewhere.
+	ReleaseBranches = []string{
+		"release/0.17",
+		"release/0.15",
+		"release/0.14",
+		"release/0.12",
+		"release-2.45.3-gmp",
+		"release-2.53.5-gmp",
+		"release-0.27.0-gmp",
+	}


Let's not hardcode these. Otherwise, this becomes another point of manual maintenance.

What do you suggest instead? Putting them in a static YAML and committed is similarly "hardcoded". Having this locally for each of us will also get obsolete even quicker.

It's hard to pull it from g3 on demand.

I can add TODO, but I don't see a quick path for not hardcoding those for. What am I missing?

Perhaps we can pull some of it from github actions dependabot for PE branches? Or maintain some other coordinated config?

bernot-dev · 2025-12-17T21:58:07Z

ops/gmpctl/vulnupdatelist/vuln.go

+// compileUpdateList decodes the JSON stream from govulncheck and extracts
+// a list of modules that need to be updated to a fixed version.


Why do we need Go code to accomplish this? Can we just run an existing tool?

What "just run an existing tool" means for you here?

If you mean why another Go command, I agree, ideally I move vulnupdatelist as another gmpctl command or just add as a library, will add TODO or move 👍🏽

Or did you mean anything else?

bernot-dev · 2025-12-17T22:01:16Z

.bingo/Variables.mk

+SHFMT := $(GOBIN)/shfmt-v3.12.0
+$(SHFMT): $(BINGO_DIR)/shfmt.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/shfmt-v3.12.0"
+	@cd $(BINGO_DIR) && GOWORK=off GOOS=$(GOHOSTOS) GOARCH=$(GOHOSTARCH) GOARM=$(GOHOSTARM) $(GO) build -mod=mod -modfile=shfmt.mod -o=$(GOBIN)/shfmt-v3.12.0 "mvdan.cc/sh/v3/cmd/shfmt"


Are we still using Bingo? Most tools have moved to go tool.

Well, looks like we do because we have this file. 🙈

Do you ask me to move from bingo to go tool here in this PR, now? (:

bernot-dev · 2025-12-17T22:06:40Z

ops/gmpctl/main.go

+// runLibFunction runs certain function from libScript that is not expected
+// to pass any return parameters.


Do we have to jump back and forth between Go code and Bash scripts? Why not implement these bash functions in Go?

Because of time constraints, because of how quickly I could experiment with bash. So it is an iteration. I'm sorry but I won't be able to port everything in this iteration, I will try to do some.

I would love to prioritize use and enablement of automation for our release process for the team.

Is any bash use a blocker for you?

bernot-dev

I count 33 TODOs. That seems like a lot of TODO debt to take on for one PR.

bwplotka · 2025-12-18T10:02:25Z

I count 33 TODOs. That seems like a lot of TODO debt to take on for one PR.

Well, it's either that or manual process 10 steps on every vulnfix/release. Which one do we prefer? 🙈

Thanks for feedback! It's an iteration and I do need team help to make it better and portable for everyone. Let's iterate.

BTW: Anyone is welcome to send PRs to this PR etc to contribute the improvements 🤗

bwplotka force-pushed the scripts2 branch from 7089fa9 to 6037263 Compare December 4, 2025 22:04

bwplotka requested review from bernot-dev, hsmatulis and ridwanmsharif December 4, 2025 22:07

bwplotka force-pushed the scripts2 branch from 6037263 to 3a30d8c Compare December 4, 2025 22:21

bwplotka mentioned this pull request Dec 4, 2025

feat: add interactive automation #1793

Closed

4 tasks

bwplotka force-pushed the scripts2 branch 6 times, most recently from 77d1159 to ee97a7d Compare December 5, 2025 16:12

feat: move to gmpctl; adding shmft

5cc808d

Signed-off-by: bwplotka <bwplotka@gmail.com>

bwplotka force-pushed the scripts2 branch from ee97a7d to 5cc808d Compare December 5, 2025 16:35

bwplotka commented Dec 9, 2025

View reviewed changes

ops/gmpctl/lib.sh Show resolved Hide resolved

bwplotka commented Dec 9, 2025

View reviewed changes

ops/gmpctl/main.go Show resolved Hide resolved

bwplotka force-pushed the scripts2 branch 2 times, most recently from 73f3c0f to c264e29 Compare December 11, 2025 19:32

bwplotka changed the title ~~feat: add hack/gmpctl interactive scripts~~ feat: add ops/gmpctl interactive scripts Dec 11, 2025

bwplotka force-pushed the scripts2 branch 3 times, most recently from d6d8e27 to 7a07b02 Compare December 11, 2025 21:19

hsmatulis requested changes Dec 11, 2025

View reviewed changes

hack/presubmit.sh Outdated Show resolved Hide resolved

bwplotka force-pushed the scripts2 branch from 7a07b02 to 372e688 Compare December 15, 2025 14:12

bwplotka mentioned this pull request Dec 15, 2025

fix: fix release/0.17 vulnerabilities #1832

Merged

bwplotka force-pushed the scripts2 branch 2 times, most recently from 562deb1 to 0748cd6 Compare December 16, 2025 18:25

bwplotka requested a review from hsmatulis December 16, 2025 18:26

bwplotka force-pushed the scripts2 branch from 0748cd6 to 8187df0 Compare December 16, 2025 18:26

chore: move gmpctl to ops/

d61c0bb

bwplotka force-pushed the scripts2 branch from 8187df0 to d61c0bb Compare December 16, 2025 19:33

bernot-dev reviewed Dec 17, 2025

View reviewed changes

bernot-dev requested changes Dec 17, 2025

View reviewed changes

		// compileUpdateList decodes the JSON stream from govulncheck and extracts
		// a list of modules that need to be updated to a fixed version.

		// runLibFunction runs certain function from libScript that is not expected
		// to pass any return parameters.

feat: add ops/gmpctl interactive scripts #1817

Are you sure you want to change the base?

feat: add ops/gmpctl interactive scripts #1817

Uh oh!

Conversation

bwplotka commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hsmatulis left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bernot-dev Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

bwplotka Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bernot-dev Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

bwplotka Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

bernot-dev Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

bwplotka Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bernot-dev Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

bwplotka Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bernot-dev left a comment

Choose a reason for hiding this comment

Uh oh!

bwplotka commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bwplotka commented Dec 4, 2025 •

edited

Loading

bwplotka Dec 18, 2025 •

edited

Loading

bwplotka Dec 18, 2025 •

edited

Loading

bwplotka Dec 18, 2025 •

edited

Loading

bwplotka commented Dec 18, 2025 •

edited

Loading