From 69c7384da295eade16e3a9eb4dd46cbb116bc065 Mon Sep 17 00:00:00 2001 From: Gustavo Diaz Date: Tue, 11 Aug 2026 20:31:13 +0000 Subject: [PATCH] fix: Pin AWS SDK codegen to the versions in go.mod generate-aws-interfaces.sh ran `go get` for each AWS service before invoking ifacemaker. `go get` resolves to the module's latest release and rewrites go.mod, and because `go generate ./pkg/awsapi/...` runs from generate-always, this happened on every build. The effect is that builds are not reproducible and the pinned versions in go.mod are ignored during code generation. Interfaces are generated against whatever AWS published most recently, so an upstream release can change generated code and break tests with no corresponding commit here. This is not theoretical. AWS published service/eks v1.91.0, which adds KubeApiServerConfig, KubeControllerManagerConfig and KubeSchedulerConfig to ekstypes.Cluster. go.mod pins v1.88.0, but builds resolved v1.91.0, so the four pkg/printers golden-file specs that serialize an EKS Cluster started failing on every pull request, including one that changed only a markdown file. The same run also upgraded ssm 1.68.6 -> 1.73.5, iam 1.58.1 -> 1.58.2 and elasticloadbalancingv2 1.58.5 -> 1.58.6. Use `go mod download` instead, which fetches the version already selected in go.mod without modifying it. All eleven services generated by pkg/awsapi/generate are direct requirements, so each resolves to its pinned version. Upgrading an SDK is now an explicit commit, which is what Dependabot is already for. --- build/scripts/generate-aws-interfaces.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/build/scripts/generate-aws-interfaces.sh b/build/scripts/generate-aws-interfaces.sh index 3aaafbf0c4..ccb815e8ae 100755 --- a/build/scripts/generate-aws-interfaces.sh +++ b/build/scripts/generate-aws-interfaces.sh @@ -7,7 +7,13 @@ INTERFACE_NAME="${2}" PACKAGE_NAME="github.com/aws/aws-sdk-go-v2/service/${SERVICE_NAME}" -go get "${PACKAGE_NAME}" +# Resolve the version already selected in go.mod. Using 'go get' here would +# upgrade the module to its latest release and rewrite go.mod mid-build, which +# makes every build non-reproducible: interfaces get generated against whatever +# AWS published most recently rather than the pinned version, so an upstream +# release can change generated code, and break tests that serialize SDK types, +# with no corresponding commit to this repository. +go mod download "${PACKAGE_NAME}" AWS_SDK_DIR=$(go list -m -f '{{.Dir}}' "${PACKAGE_NAME}") "${GOBIN}/ifacemaker" -f "${AWS_SDK_DIR}/*.go" -s Client -i "${INTERFACE_NAME}" -p awsapi \