v0.1.0 readiness: release pipeline, operator-plane proto contract, storage units, SDK parity

.github/workflows/deploy.yaml

@@ -68,6 +68,7 @@ jobs:
       with:
         context: .
         file: Dockerfile.sam-control-plane
+        build-args: VERSION=${{ github.ref_type == 'tag' && github.ref_name || github.sha }}
         platforms: ${{ github.ref_type == 'tag' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
         push: true
         tags: ${{ steps.meta-cp.outputs.tags }}
@@ -136,6 +137,7 @@ jobs:
       with:
         context: .
         file: Dockerfile.sam-console
+        build-args: VERSION=${{ github.ref_type == 'tag' && github.ref_name || github.sha }}
         platforms: ${{ github.ref_type == 'tag' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
         push: true
         tags: ${{ steps.meta-console.outputs.tags }}

.github/workflows/test.yaml

@@ -67,6 +67,30 @@ jobs:
       run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
     - run: make verify
 
+  # A build id whose cmd/ directory no longer exists only fails on the tag
+  # push, after the release is already underway; catch it on the PR instead.
+  goreleaser-check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      with:
+        go-version: ${{ env.GO_VERSION }}
+        cache: false
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        fetch-depth: 0
+        persist-credentials: false
+    - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      with:
+        distribution: goreleaser
+        version: "~> v2"
+        args: check
+    - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      with:
+        distribution: goreleaser
+        version: "~> v2"
+        args: build --snapshot --clean --single-target
+
   helm-lint:
     runs-on: ubuntu-latest
     steps:

.goreleaser.yaml

@@ -31,7 +31,7 @@ builds:
       - amd64
       - arm64
     ldflags:
-      - -s -w
+      - -s -w -X github.com/google/sam/internal/version.Version={{ .Tag }}
   - id: sam-router
     main: ./cmd/sam-router
     binary: sam-router
@@ -59,21 +59,7 @@ builds:
       - amd64
       - arm64
     ldflags:
-      - -s -w
-  - id: sam-box
-    main: ./cmd/sam-box
-    binary: sam-box
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - windows
-      - darwin
-    goarch:
-      - amd64
-      - arm64
-    ldflags:
-      - -s -w
+      - -s -w -X github.com/google/sam/internal/version.Version={{ .Tag }}
   - id: sam-console
     main: ./cmd/sam-console
     binary: sam-console
@@ -87,7 +73,7 @@ builds:
       - amd64
       - arm64
     ldflags:
-      - -s -w
+      - -s -w -X github.com/google/sam/internal/version.Version={{ .Tag }}
   - id: sam-one
     main: ./cmd/sam-one
     binary: sam-one
@@ -102,23 +88,6 @@ builds:
       - arm64
     ldflags:
       - -s -w -X github.com/google/sam/internal/version.Version={{ .Tag }}
-  - id: nano-init
-    main: .
-    # nano-init is its own module: it carries a userspace TCP stack, and that
-    # dependency has no business in the graph every other binary builds from.
-    dir: ./cmd/nano-init
-    binary: nano-init
-    env:
-      - CGO_ENABLED=0
-    # linux only: nano-init is PID 1 inside a Linux sandbox — TUN ioctls,
-    # netlink, namespaces and vsock have no meaning anywhere else.
-    goos:
-      - linux
-    goarch:
-      - amd64
-      - arm64
-    ldflags:
-      - -s -w
 archives:
   - formats:
       - tar.gz
@@ -133,6 +102,3 @@ archives:
       - goos: windows
         formats:
           - zip
-    # nano-init only builds for linux (see build id "nano-init" above), so the
-    # windows and darwin archives intentionally have one fewer binary.
-    allow_different_binary_count: true

Dockerfile.sam-console

@@ -5,7 +5,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=0 go build -o /bin/sam-console ./cmd/sam-console
+ARG VERSION=devel
+RUN CGO_ENABLED=0 go build -buildvcs=false -ldflags="-X github.com/google/sam/internal/version.Version=${VERSION}" -o /bin/sam-console ./cmd/sam-console
 
 FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
 

Dockerfile.sam-control-plane

@@ -4,7 +4,8 @@ WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -buildvcs=false -o sam-control-plane ./cmd/sam-control-plane
+ARG VERSION=devel
+RUN CGO_ENABLED=0 GOOS=linux go build -buildvcs=false -ldflags="-X github.com/google/sam/internal/version.Version=${VERSION}" -o sam-control-plane ./cmd/sam-control-plane
 # Pre-create the sqlite data dir owned by the nonroot UID so that a fresh
 # named/anonymous volume mounted over it inherits writable ownership instead
 # of defaulting to root.

Makefile

@@ -259,7 +259,7 @@ update:
 	go mod tidy
 
 docker-build-control-plane:
-	docker build --load -t sam-control-plane:local -f Dockerfile.sam-control-plane .
+	docker build --load --build-arg VERSION="$(VERSION)" -t sam-control-plane:local -f Dockerfile.sam-control-plane .
 
 docker-build-router:
 	docker build --load --build-arg VERSION="$(VERSION)" -t sam-router:local -f Dockerfile.sam-router .
@@ -274,7 +274,7 @@ docker-build-e2e-runtime:
 	docker build --load -t sam-e2e-runtime:local -f tests/e2e/docker/Dockerfile.sam-runtime .
 
 docker-build-sam-console:
-	docker build --load -t sam-console:local -f Dockerfile.sam-console .
+	docker build --load --build-arg VERSION="$(VERSION)" -t sam-console:local -f Dockerfile.sam-console .
 
 docker-build: docker-build-control-plane docker-build-router docker-build-node docker-build-mock-oidc docker-build-e2e-runtime docker-build-sam-console