From 4f85388aa08b5e9c58b419e71c3e72aa7a22b5bb Mon Sep 17 00:00:00 2001
From: Stephen Kitt <skitt@redhat.com>
Date: Mon, 30 Sep 2024 17:21:09 +0200
Subject: [PATCH] Check that dependencies don't include unmerged commits

Signed-off-by: Stephen Kitt <skitt@redhat.com>
---
 .github/workflows/linting.yml         |  9 +++++++++
 Makefile                              |  1 +
 go.mod                                |  2 +-
 go.sum                                |  4 ++--
 scripts/check-non-release-versions.sh | 23 +++++++++++++++++++++++
 5 files changed, 36 insertions(+), 3 deletions(-)
 create mode 100755 scripts/check-non-release-versions.sh

diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
index 4f6d724ad..e8d4b51e4 100644
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -42,6 +42,15 @@ jobs:
       - name: Create the bundle and validate it
         run: make bundle
 
+  check-branch-dependencies:
+    name: Check branch dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+      - name: Check that no dependencies include unmerged commits
+        run: scripts/check-non-release-versions.sh
+
   crds:
     name: CRDs up-to-date
     runs-on: ubuntu-latest
diff --git a/Makefile b/Makefile
index 0ee4207c4..a06ba85df 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,4 @@
+# Dummy change
 BASE_BRANCH ?= devel
 # Denotes the default operator image version, exposed as a variable for the automated release
 DEFAULT_IMAGE_VERSION ?= $(BASE_BRANCH)
diff --git a/go.mod b/go.mod
index dc1e497a5..9d5d06619 100644
--- a/go.mod
+++ b/go.mod
@@ -15,7 +15,7 @@ require (
 	github.com/prometheus/client_golang v1.20.2
 	github.com/submariner-io/admiral v0.19.0-m3
 	github.com/submariner-io/shipyard v0.19.0-m3
-	github.com/submariner-io/submariner v0.19.0-m3
+	github.com/submariner-io/submariner v0.19.0-m3.0.20240930152152-22aa951d2cb0
 	golang.org/x/net v0.29.0
 	golang.org/x/text v0.18.0
 	k8s.io/api v0.31.1
diff --git a/go.sum b/go.sum
index 297899962..36dc9560d 100644
--- a/go.sum
+++ b/go.sum
@@ -399,8 +399,8 @@ github.com/submariner-io/admiral v0.19.0-m3 h1:LTkYxCvB8S1210P2FZtCb6dzjaPpIgBrR
 github.com/submariner-io/admiral v0.19.0-m3/go.mod h1:xRpP1rDOblEdPHr0qrC+plcTNfShYJAOH2fexqOmI1A=
 github.com/submariner-io/shipyard v0.19.0-m3 h1:NliwAktRPF4OsLj1TDgpaOJD/bmmZW/FH9+mJmWgxbk=
 github.com/submariner-io/shipyard v0.19.0-m3/go.mod h1:BY1ceSnPz1/hN5F9uljcSzy5n5qgAOENsIvZpJ+XPOU=
-github.com/submariner-io/submariner v0.19.0-m3 h1:UHfG15WNOFH05WF6keLtj4+y1nxL7HiDmQqG6uk+EEI=
-github.com/submariner-io/submariner v0.19.0-m3/go.mod h1:0Am9/udIvtZO8hM7YvRTbIsEWGD8YrCR2JHzNmTGyHg=
+github.com/submariner-io/submariner v0.19.0-m3.0.20240930152152-22aa951d2cb0 h1:kPLkNZOI6xux9eStbw8GS6HHJkeoOG4OmiH1gQVX4rg=
+github.com/submariner-io/submariner v0.19.0-m3.0.20240930152152-22aa951d2cb0/go.mod h1:hKbs5L9QPDslJ6n4k3fsPRbr7JbpT5AVr58YgWQQCKQ=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
diff --git a/scripts/check-non-release-versions.sh b/scripts/check-non-release-versions.sh
new file mode 100755
index 000000000..e560ab68c
--- /dev/null
+++ b/scripts/check-non-release-versions.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -x
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf $tmpdir' EXIT
+
+# List all submariner-io dependencies with a - in their version
+# We're looking for versions pointing to commits, of the form
+# vX.Y.Z-0.YYYYMMDDhhmmss-hash
+GOWORK=off go list -m -mod=mod -json all | \
+    jq -r 'select(.Path | contains("/submariner-io/")) | select(.Main != true) | select(.Version | contains ("-")) | select(.Version | length > 14) "\(.Path) \(.Version)"' | \
+    while read -r project version; do
+	cd "$tmpdir" || exit 1
+	git clone "https://$project"
+	cd "${project##*/}" || exit 1
+	hash="${version##*-}"
+	branch="${GITHUB_BASE_REF:-devel}"
+	if ! git merge-base --is-ancestor "$hash" "origin/$branch"; then
+	    printf "%s branch %s does not contain commit %s\n" "$project" "$branch" "$hash"
+	    exit 1
+	fi
+    done