refactor: use exclude directives instead of replace directives for pinning#8056
Merged
aaron-prindle merged 1 commit intoGoogleContainerTools:mainfrom Nov 15, 2022
Merged
Conversation
…nning The 'replace' directive is very heavy-handed: it replaces nodes in the dependency graph with different source code. That distorts their apparent transitive dependencies, and makes a module that uses 'exclude' directives much more difficult for downstream consumers to use even if they aren't using the parts of the module that depend on the replaced versions. In contrast, the 'exclude' directive knocks out specific version requirements from the module graph without otherwise affecting the dependencies of any remaining module in the graph. 'exclude' directives also make it clearer why particular pins are necessary: normally only the 'require' directive is needed to select desired versions (since they are not upgraded implicitly), so having 'exclude' blocks for specific conflicting requirements more clearly shows which of the transitive dependencies are believed to be spurious.
Codecov Report
@@ Coverage Diff @@
## main #8056 +/- ##
==========================================
- Coverage 70.48% 66.51% -3.98%
==========================================
Files 515 597 +82
Lines 23150 29146 +5996
==========================================
+ Hits 16317 19386 +3069
- Misses 5776 8322 +2546
- Partials 1057 1438 +381
📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
Contributor
Author
|
I think your |
aaron-prindle
approved these changes
Nov 15, 2022
Contributor
There was a problem hiding this comment.
LGTM! Thanks for this, I have created #8094 to track the suggested Follow-up Work. We will be more tactful in how we use excludes + requires going forward.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The 'replace' directive is very heavy-handed: it replaces nodes in the dependency graph with different source code. That distorts their apparent transitive dependencies, and makes a module that uses 'exclude' directives much more difficult for downstream consumers to use even if they aren't using the parts of the module that depend on the replaced versions.
In contrast, the 'exclude' directive knocks out specific version requirements from the module graph without otherwise affecting the dependencies of any remaining module in the graph.
'exclude' directives also make it clearer why particular pins are necessary: normally only the 'require' directive is needed to select desired versions (since they are not upgraded implicitly), so having 'exclude' blocks for specific conflicting requirements more clearly shows which of the transitive dependencies are believed to be spurious.
(See https://go.dev/ref/mod#go-mod-file-exclude.)
Follow-up Work
In the long term, the code should be updated to work with dependencies selected using only
requiredirectives, which respect the requirements of dependencies, rather than pinning versions below those requirements.Testing
The following is a diff of
go list -m allbefore and after this change.Note that the former
replacetargets are now the MVS-selected versions.One additional module is now visible in the module graph (
github.com/docker/spdystream), but it has no effect on the resulting artifacts because it does not provide any transitively-imported package.