Automate dependency pinning and updating script for Kustomize

[antoooks]

Eschewed features

• This issue is not requesting templating, unstuctured edits, build-time side-effects from args or env vars, or any other eschewed feature.

What would you like to have added?

Pinning dependency and updating the dependencies inside the code is a required step on Kustomize release process. Currently there is no automated way of doing this step.

Why is this needed?

There are several highlighted issues with current release, pin, and update command gorepomod:

• As part of release automation improvement Release automation #3952
• We cannot run gorepomod outside $GOSRC
• We cannot run gorepomod in our own repo, we have to rename our cloned directory into sigs.k8s.io/kustomize and put it under $GOSRC

Can you accomplish the motivating task without this feature, and if so, how?

Yes, we still can pin and update the dependency using gorepomod

What other solutions have you considered?

Can't think of any.

Anything else we should know?

No response

Feature ownership

• I am interested in contributing this feature myself! 🎉

[natasha41575]

Apologies if I misunderstood while you were explaining in the meeting - we do have a script that automatically pins dependencies , e.g.

versionKyaml=v0.10.20 
gorepomod pin kyaml

will pin all the dependencies to the that version of kyaml without requiring manually editing the code.

Is that what you were looking for? If so, then we probably need to redefine this issue because the script already exists. Or are you proposing something different?

The manual part is that we then have to make a PR for each time we pin the dependencies. I think this is more covered by #3952 and your ongoing proposal in the Miro board, but adding context here for completion:

The release flow is something like

1. Release kyaml
2. Run gorepomod pin kyaml
3. Create + merge the PR that pins kyaml
4. Release cmd/config
5. Run gorepomod pin cmd/config
6. Create + merge the PR that pins cmd/config
7. Release api
8. Run gorepomod pin api
9. Create + merge the PR that pins api
10. Release kustomize

The part we are hoping to automate is creating and merging all these PRs, would be great if all we had to do was click a button or run a single script to do a "release" and not have to release each module individually. Ideally, that would mean either eliminating the PR creation/merging steps or somehow automating them in a way that doesn't require human intervention. I'm not sure how possible that is, but any steps to get us closer to that would be great.

[antoooks]

I see, thank you for the clarification. I do aware that we have gorepomod pin to do the release, but it seems cannot work outside $GOSRC directory and cannot work with personal repo ( we have to rename it to sigs.k8s.io/kustomize instead of using our own repo name github.com/antoooks/kustomize) making it effortful to test and modify for release, so I'm thinking of modifying it so it will work outside $GOSRC and maybe some improvement to support automation. I think we need further discussion on this, I will follow up on Slack

[natasha41575]

synced offline, agreed that modifications to that we can work outside of $GOSRC directory will be great.

/triage accepted

[antoooks]

/close

[k8s-ci-robot]

@antoooks: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.