Skip to content

fix: pin oapi-codegen version via go.mod tool directive#210

Merged
rgarcia merged 1 commit intomainfrom
rgarcia/pin-oapi-codegen-version
Apr 10, 2026
Merged

fix: pin oapi-codegen version via go.mod tool directive#210
rgarcia merged 1 commit intomainfrom
rgarcia/pin-oapi-codegen-version

Conversation

@rgarcia
Copy link
Copy Markdown
Contributor

@rgarcia rgarcia commented Apr 10, 2026

Summary

  • Adds tool github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen directive to server/go.mod, pinning oapi-codegen at v2.6.0 via go.sum
  • Switches server/Makefile from go install ...@latest to go tool oapi-codegen so the pinned version is always used
  • Removes the OAPI_CODEGEN binary variable and install target from the Makefile (no longer needed)

This is the root cause fix for the version regression in #201 (where @latest resolved to v2.5.1 instead of v2.6.0). PR #209 already restored the generated code; this PR prevents it from happening again by adopting the same go.mod tool directive pattern used in kernel/kernel.

Test plan

  • go vet ./... passes
  • Unit tests pass (go test -race on all non-e2e packages)
  • go tool oapi-codegen -config ./oapi-codegen.yaml ./openapi-3.0.yaml uses pinned v2.6.0
  • CI server-test workflow passes

🤖 Generated with Claude Code


Note

Low Risk
Low risk build tooling change: it only affects OpenAPI code generation and Go module dependency resolution, not runtime behavior. Main risk is unexpected dependency/tooling differences if the pinned tool or updated transitive deps behave differently across environments.

Overview
Pins oapi-codegen for reproducible OpenAPI generation. server/go.mod now declares oapi-codegen as a Go tool dependency (and updates module sums), and server/Makefile switches oapi-generate from installing @latest into bin/ to invoking go tool oapi-codegen.

This removes the Makefile’s local oapi-codegen install target/variable and updates Go module dependencies (including bumping github.com/getkin/kin-openapi to v0.133.0) to reflect the pinned toolchain.

Reviewed by Cursor Bugbot for commit d7632bf. Bugbot is set up for automated code reviews on this repo. Configure here.

@firetiger-agent
Copy link
Copy Markdown

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR modifies build tooling and dependencies (go.mod, Makefile) but does not change kernel API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.

@rgarcia rgarcia requested a review from ulziibay-kernel April 10, 2026 15:50
PR #201 inadvertently downgraded oapi-codegen from v2.6.0 to v2.5.1
because the Makefile used `go install @latest`. Pin the version using
Go's tool directive in go.mod (same pattern as kernel/kernel) so that
`go tool oapi-codegen` always uses the declared version.

Also removes the patch_strict_optional_json post-processing script since
v2.6.0 natively generates io.EOF handling and omitempty tags.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@rgarcia rgarcia force-pushed the rgarcia/pin-oapi-codegen-version branch from 196af8a to d7632bf Compare April 10, 2026 15:51
@socket-security
Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedgolang/​github.com/​getkin/​kin-openapi@​v0.132.0 ⏵ v0.133.074 +1100100100100

View full report

@rgarcia rgarcia merged commit 78d3f54 into main Apr 10, 2026
7 checks passed
@rgarcia rgarcia deleted the rgarcia/pin-oapi-codegen-version branch April 10, 2026 18:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants