Check that dependencies don't include unmerged commits

Signed-off-by: Stephen Kitt <[email protected]>

.github/workflows/linting.yml

@@ -42,6 +42,15 @@ jobs:
       - name: Create the bundle and validate it
         run: make bundle
 
+  check-branch-dependencies:
+    name: Check branch dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+      - name: Check that no dependencies include unmerged commits
+        run: scripts/check-non-release-versions.sh
+
   crds:
     name: CRDs up-to-date
     runs-on: ubuntu-latest

Makefile

@@ -1,3 +1,4 @@
+# Dummy change
 BASE_BRANCH ?= devel
 # Denotes the default operator image version, exposed as a variable for the automated release
 DEFAULT_IMAGE_VERSION ?= $(BASE_BRANCH)

go.mod

@@ -15,7 +15,7 @@ require (
 	github.com/prometheus/client_golang v1.20.2
 	github.com/submariner-io/admiral v0.19.0-m3
 	github.com/submariner-io/shipyard v0.19.0-m3
-	github.com/submariner-io/submariner v0.19.0-m3
+	github.com/submariner-io/submariner v0.19.0-m3.0.20240930152152-22aa951d2cb0
 	golang.org/x/net v0.29.0
 	golang.org/x/text v0.18.0
 	k8s.io/api v0.31.1

go.sum

@@ -399,8 +399,8 @@ github.com/submariner-io/admiral v0.19.0-m3 h1:LTkYxCvB8S1210P2FZtCb6dzjaPpIgBrR
 github.com/submariner-io/admiral v0.19.0-m3/go.mod h1:xRpP1rDOblEdPHr0qrC+plcTNfShYJAOH2fexqOmI1A=
 github.com/submariner-io/shipyard v0.19.0-m3 h1:NliwAktRPF4OsLj1TDgpaOJD/bmmZW/FH9+mJmWgxbk=
 github.com/submariner-io/shipyard v0.19.0-m3/go.mod h1:BY1ceSnPz1/hN5F9uljcSzy5n5qgAOENsIvZpJ+XPOU=
-github.com/submariner-io/submariner v0.19.0-m3 h1:UHfG15WNOFH05WF6keLtj4+y1nxL7HiDmQqG6uk+EEI=
-github.com/submariner-io/submariner v0.19.0-m3/go.mod h1:0Am9/udIvtZO8hM7YvRTbIsEWGD8YrCR2JHzNmTGyHg=
+github.com/submariner-io/submariner v0.19.0-m3.0.20240930152152-22aa951d2cb0 h1:kPLkNZOI6xux9eStbw8GS6HHJkeoOG4OmiH1gQVX4rg=
+github.com/submariner-io/submariner v0.19.0-m3.0.20240930152152-22aa951d2cb0/go.mod h1:hKbs5L9QPDslJ6n4k3fsPRbr7JbpT5AVr58YgWQQCKQ=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=

scripts/check-non-release-versions.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -x
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf $tmpdir' EXIT
+
+# List all submariner-io dependencies with a - in their version
+# We're looking for versions pointing to commits, of the form
+# vX.Y.Z-0.YYYYMMDDhhmmss-hash
+GOWORK=off go list -m -mod=mod -json all | \
+    jq -r 'select(.Path | contains("/submariner-io/")) | select(.Main != true) | select(.Version | contains ("-")) | select(.Version | length > 14) "\(.Path) \(.Version)"' | \
+    while read -r project version; do
+	cd "$tmpdir" || exit 1
+	git clone "https://$project"
+	cd "${project##*/}" || exit 1
+	hash="${version##*-}"
+	branch="${GITHUB_BASE_REF:-devel}"
+	if ! git merge-base --is-ancestor "$hash" "origin/$branch"; then
+	    printf "%s branch %s does not contain commit %s\n" "$project" "$branch" "$hash"
+	    exit 1
+	fi
+    done