Skip to content

chore: bump default DocumentDB version to 0.110.0#364

Open
WentingWu666666 wants to merge 18 commits intodocumentdb:mainfrom
WentingWu666666:developer/bump-documentdb-0.110.0
Open

chore: bump default DocumentDB version to 0.110.0#364
WentingWu666666 wants to merge 18 commits intodocumentdb:mainfrom
WentingWu666666:developer/bump-documentdb-0.110.0

Conversation

@WentingWu666666
Copy link
Copy Markdown
Collaborator

Bumps default database image version (extension + gateway) from 0.109.0 to 0.110.0 across the Helm chart, operator constants, sidecar-injector config, CI workflows, design docs, and tests. Verified with go test on internal/utils, internal/cnpg, and sidecar-injector internal/config.

Copilot AI review requested due to automatic review settings May 5, 2026 17:11
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Bumps the default DocumentDB database image version (extension + gateway) from 0.109.0 to 0.110.0 across operator runtime defaults, Helm values, CNPG sidecar-injector defaults, CI workflows, docs, and tests to keep the database “version track” consistent across the repo.

Changes:

  • Updated compiled-in defaults and plugin defaults to use :0.110.0 tags.
  • Updated Helm chart defaults, CI workflow defaults, and gateway public-image Dockerfile source tag.
  • Updated tests and documentation references to the new default database version.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
operator/src/internal/utils/constants.go Bumps compiled-in default extension/gateway image tags to 0.110.0.
operator/src/internal/controller/documentdb_controller_test.go Updates schema-version expectations to 0.110.0.
operator/src/internal/cnpg/cnpg_sync_test.go Updates test fixtures to 0.110.0 image tags.
operator/documentdb-helm-chart/values.yaml Updates Helm documentDbVersion default to 0.110.0.
operator/cnpg-plugins/sidecar-injector/internal/config/config.go Updates sidecar-injector default gateway image to 0.110.0.
operator/cnpg-plugins/sidecar-injector/internal/config/config_test.go Updates expected default gateway image tag to 0.110.0.
documentdb-playground/aks-setup/scripts/create-cluster.sh Updates commented example pin to 0.110.0.
docs/designs/image-management.md Updates database-track version references to 0.110.0 (but see comment re: operator track version).
AGENTS.md Updates database-track tag example to 0.110.0 (but see comment re: operator track version).
.github/workflows/test-upgrade-and-rollback.yml Updates released baseline database version to 0.110.0.
.github/workflows/release_documentdb_images.yml Updates workflow dispatch default database version to 0.110.0.
.github/workflows/build_documentdb_images.yml Updates build workflow default/version examples to 0.110.0.
.github/dockerfiles/Dockerfile_gateway_public_image Updates gateway source image default tag to pg17-0.110.0.

Comment thread docs/designs/image-management.md Outdated
Comment thread AGENTS.md Outdated
Copy link
Copy Markdown
Collaborator

@guanzhousongmicrosoft guanzhousongmicrosoft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

better to have a config file so only need to update one place

@documentdb-triage-tool documentdb-triage-tool Bot added CI/CD documentation Improvements or additions to documentation ecosystem enhancement New feature or request go Pull requests that update go code test labels May 5, 2026
@documentdb-triage-tool
Copy link
Copy Markdown

🤖 Auto-triaged by documentdb-triage-tool.

Applied: CI/CD, documentation, test, go, ecosystem, enhancement
Project fields suggested: Component ci · Priority P2 · Effort L · Status Needs Review
Confidence: 0.80 (mixed)

Reasoning

component from path globs (ci, docs, test, controllers, playground); effort from diff stats (33+33 LOC, 12 files); LLM: Routine version bump of the default DocumentDB image (0.109.0 → 0.110.0) across config, CI, docs, and tests — small, mechanical, cross-file but low-complexity change.

If a label is wrong, remove it manually and ping @patty-chow so the rules can be tuned. The bot will not re-label items that already have component labels.

@WentingWu666666 WentingWu666666 force-pushed the developer/bump-documentdb-0.110.0 branch from fcf634e to ba6964e Compare May 6, 2026 14:02
@hossain-rayhan
Copy link
Copy Markdown
Collaborator

Maybe we should release v0.2.1 as we are updating core component default versions.

@xgerman
Copy link
Copy Markdown
Collaborator

xgerman commented May 7, 2026

@copilot resolve the merge conflicts in this pull request

wentingwu000 and others added 3 commits May 7, 2026 13:15
Bumps the default database image (extension + gateway) version from 0.109.0 to 0.110.0 across the Helm chart, operator constants, sidecar-injector config, CI workflows, design docs, and tests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
These literals encode contrived stale/matches-installed relationships against hardcoded SQL fixture strings; bumping them broke the assertions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
Chart.appVersion is currently 0.2.0; align tag examples in the version-tracks tables.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
@WentingWu666666 WentingWu666666 force-pushed the developer/bump-documentdb-0.110.0 branch from ba6964e to 6ce1987 Compare May 7, 2026 17:17
@WentingWu666666
Copy link
Copy Markdown
Collaborator Author

WentingWu666666 commented May 7, 2026

Update: the first attempt (DEB_BUILD_OPTIONS=nocheck env var on the job) didn't work upstream's debian/rules override_dh_auto_test unconditionally runs make check and ignores nocheck. The build also runs inside a Docker container that doesn't inherit host env, so the var was doubly useless.

The new fix in commit 50b4169 rewrites packaging/deb/common/rules after checkout (before build_packages.sh) to neutralize the override_dh_auto_test target. Verified working: both Build DocumentDB Packages (amd64) and (arm64) jobs now pass on commit 50b4169 (previously both failed at the check-basic regression suite on commit 678663c).

Original failures: run 25511078036, run 25511375099 both red on setUnion / setDifference projection diffs caused by missing ORDER BY in upstream pg_documentdb/src/test/regress/expected/*.out files.

@team please review:

  • The skip is scoped to the operator-repo CI build only it does not change what gets shipped or what runs in the upstream documentdb repo's own CI.
  • The runtime correctness of the produced .deb (extension + gateway) is still validated end-to-end by the TEST - E2E workflow, which provisions a kind cluster and exercises the operator + DocumentDB + gateway path against a real Mongo client.
  • We will need to file an issue against documentdb/documentdb to add ORDER BY to those regress queries (or otherwise stabilize the output ordering across ICU/planner versions) so we can re-enable the check here. I'll open that follow-up issue once this PR merges.

Anything else you want me to add to this guard (e.g. echo a clearer banner, tag the skip in the build artifact name, or only skip on PR builds and keep it on for nightly main)?

The build-packages job invokes dpkg-buildpackage against documentdb/documentdb@main, which runs dh_auto_test and the upstream check-regress suite. Several regression queries (e.g. setUnion / setDifference with collation 'en' strength 1) lack ORDER BY and depend on planner / ICU library ordering, so they flip success/fail per upstream SHA in our Debian build container.

Upstream's debian/rules override_dh_auto_test unconditionally runs `make check` and ignores DEB_BUILD_OPTIONS=nocheck, so we rewrite the rules file at checkout time to neutralize the test target. The operator repo cannot fix upstream test bugs, and the built artifact is still validated end-to-end by the E2E job.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
wentingwu000 and others added 3 commits May 8, 2026 12:16
This reverts commit 50b4169.

Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
The build-packages job currently checks out documentdb/documentdb@main, which exposes the operator repo's CI to unstable regression tests on upstream HEAD (e.g. setUnion / setDifference projection diffs caused by missing ORDER BY in regress expected output). The chart's values.yaml already pins documentDbVersion (currently 0.109.0), and that version is what the operator actually ships and validates.

Read documentDbVersion from values.yaml at workflow time and translate it to the matching upstream tag (e.g. 0.109.0 -> v0.109-0). The caller-supplied documentdb_ref input still takes precedence for ad-hoc dispatches; the empty default now means 'derive from chart', not 'use main'. This keeps CI builds in lock-step with the shipped chart version and avoids whole classes of upstream-flake outages.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
Without this, edits to the reusable build workflow don't run through E2E and ship untested.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
wentingwu000 and others added 9 commits May 8, 2026 12:16
The gateway packaging script was moved upstream from ./packaging/build_gateway_packages.sh to ./packaging/gateway/build_gateway_packages.sh. With the workflow now pinned to the chart's documentDbVersion (e.g. v0.109-0), the older path is what's actually present at that tag. Probe for either path so this step works against both old tags and main.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
Resolves govulncheck findings:

- GO-2026-4977 (net/mail), GO-2026-4971 (net), GO-2026-4918 (net/http) -- fixed in go1.25.10

- golang.org/x/net@v0.49.0 vuln chain -- fixed in v0.53.0

Applies across all three Go modules covered by the govulncheck workflow:

operator/src, documentdb-kubectl-plugin, operator/cnpg-plugins/sidecar-injector.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
go.mod now requires go >= 1.25.10 (security patch), but the azurelinux Go base image currently ships 1.25.9 with GOTOOLCHAIN=local, causing 'go mod download' to fail.

Set GOTOOLCHAIN=auto in both builder Dockerfiles so Go fetches the required toolchain when the base image lags behind go.mod's minimum version.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
The mcr.microsoft.com/oss/go/microsoft/golang base image enforces GOTOOLCHAIN=local by default and refuses to honor GOTOOLCHAIN=auto unless MS_GOTOOLCHAIN_ALLOW_NON_LOCAL=1 is also set. Without this, 'go mod download' fails when go.mod's required version (1.25.10) exceeds the version shipped in the base image (1.25.9).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
Replace 'go 1.25.10' with 'go 1.25.0' + 'toolchain go1.25.10' in all three modules. The go directive is what GOTOOLCHAIN=local enforces; the toolchain directive is honored by setup-go (so govulncheck still scans against the patched 1.25.10 stdlib) but ignored at build time when GOTOOLCHAIN=local.

This restores compatibility with the mcr.microsoft.com/oss/go/microsoft/golang:1.25-azurelinux3.0 base image, which ships go 1.25.9 and pins GOTOOLCHAIN=local. Reverts the GOTOOLCHAIN=auto / MS_GOTOOLCHAIN_ALLOW_NON_LOCAL=1 escape hatch added earlier (the auto-downloaded upstream Go lacks the systemcrypto GOEXPERIMENT used by the sidecar-injector build script).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
E2E test suite compilation failed because the e2e module's go.sum diverged from its go.mod after the recent x/net + toolchain bumps. Update e2e go.mod to use the same 'go 1.25.0 + toolchain go1.25.10' shape and run 'go mod tidy' so downstream changes from operator/src deps stay consistent.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
The MS azurelinux Go base image (mcr.microsoft.com/oss/go/microsoft/golang:1.25-azurelinux3.0) now resolves to go1.25.10, so we no longer need the 'go 1.25.0 + toolchain go1.25.10' split that worked around the older 1.25.9 base image refusing to honor the toolchain directive under GOTOOLCHAIN=local.

Set 'go 1.25.10' directly across all four modules (operator/src, documentdb-kubectl-plugin, operator/cnpg-plugins/sidecar-injector, test/e2e). Build environments (MS base image) and CI scanners (govulncheck setup-go) both run 1.25.10  no env-var gymnastics required.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
…e chart's pinned version

Adds a probe-images job that checks whether the upstream registry already
publishes documentdb and gateway images at the chart's documentDbVersion.
When both are present, build-packages is skipped and build-documentdb /
build-gateway pull the released images and re-tag them for downstream
test consumption instead of compiling from source. When either image is
missing (e.g. on the PR that bumps the version for the first time), the
workflow falls through to the existing source-build path. A caller-supplied
documentdb_ref forces build mode regardless.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
@WentingWu666666 WentingWu666666 force-pushed the developer/bump-documentdb-0.110.0 branch from 868d769 to ce44af0 Compare May 8, 2026 20:19
wentingwu000 and others added 2 commits May 8, 2026 16:30
GitHub Actions propagates 'skipped' transitively through needs chains
even when the immediate need succeeded. With build-packages skipped
(registry-pull mode), consolidate-images succeeded but create-helm-chart
was still auto-skipped, leaving E2E jobs without the build-helm-chart-*
artifacts they download.

Add an explicit 'if: always() && needs.consolidate-images.result == ''success'''
guard so create-helm-chart runs whenever consolidation succeeds,
regardless of upstream skips.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
Use 'gh api /orgs|/users/{owner}/packages/container/.../versions' with the
workflow's GITHUB_TOKEN, replacing the anonymous OCI registry token dance.
Simpler, fewer moving parts, no jq parsing of token JSON.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Wenting Wu <wentingwu@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CI/CD documentation Improvements or additions to documentation ecosystem enhancement New feature or request go Pull requests that update go code test

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants