Skip to content

feat(cli): independent otdfctl releases#3268

Merged
alkalescent merged 3 commits into
DSPX-2655-migrate-otdfctlfrom
DSPX-2660-otdfctl-release-pipeline
Apr 10, 2026
Merged

feat(cli): independent otdfctl releases#3268
alkalescent merged 3 commits into
DSPX-2655-migrate-otdfctlfrom
DSPX-2660-otdfctl-release-pipeline

Conversation

@alkalescent

Copy link
Copy Markdown
Contributor

Proposed Changes

  • Add otdfctl component to platform release-please configuration for independent versioned releases
  • Tags follow the monorepo per-component pattern: otdfctl/v0.30.0
  • Register otdfctl/pkg/config/config.go as extra-file so release-please bumps the Version constant (already has // x-release-please-version marker)
  • Create release workflow that triggers on otdfctl/v* tags, builds 8 cross-platform binaries (darwin amd64/arm64, linux amd64/arm/arm64, windows amd64/arm/arm64), and uploads artifacts to the GitHub release

Files added/modified

File Change
release-please-config.main.json Add otdfctl package entry with extra-files
release-please-manifest.json Add "otdfctl": "0.30.0" version tracking
release-please-config.otdfctl.json New — component config for release/otdfctl/vX.Y branches
release-otdfctl.yaml New — build and upload workflow on release publish

PR Stack (DSPX-2654)

  1. feat(cli): migrate otdfctl into platform monorepo #3205 — Subtree merge + module path rewrite (DSPX-2655, DSPX-2656)
  2. feat(cli): Makefile and build scripts #3208 — Makefile and build scripts (DSPX-2657)
  3. feat(cli): add otdfctl to platform CI matrix #3221 — CI workflows (DSPX-2658)
  4. feat(cli): migrate e2e tests and fix lint errors #3236 — e2e tests and lint fixes (DSPX-2659)
  5. This PR — Release pipeline (DSPX-2660)

Checklist

  • I have added or updated unit tests
  • I have added or updated integration tests (if appropriate)
  • I have added or updated documentation

Testing Instructions

  • Verify JSON configs are valid: cat .github/release-please/release-please-config.main.json | jq .packages.otdfctl
  • Verify manifest version: cat .github/release-please/release-please-manifest.json | jq .otdfctl
  • Verify reusable_release-please.yaml config lookup: branch release/otdfctl/v0.30 → sanitized name otdfctl → resolves to release-please-config.otdfctl.json
  • Full release flow testable after merge by creating a manual release with tag otdfctl/v0.30.0

@alkalescent
alkalescent requested review from a team as code owners April 7, 2026 19:23
@coderabbitai

coderabbitai Bot commented Apr 7, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4c739574-6632-4e0f-be96-a934a034562c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch DSPX-2660-otdfctl-release-pipeline

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@gemini-code-assist

Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request establishes an independent release pipeline for the otdfctl component. By integrating it into the existing release-please infrastructure and defining a new automated workflow, the changes ensure that otdfctl can be versioned and distributed separately from the rest of the monorepo, streamlining the release process for this specific tool.

Highlights

  • Release Configuration: Added otdfctl to the main release-please configuration and created a dedicated component configuration file for independent versioning.
  • Manifest Update: Registered otdfctl in the release-please manifest with an initial version of 0.30.0.
  • Automation: Configured the release pipeline to handle cross-platform binary builds and artifact uploads upon tagging.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files
  • Ignored by pattern: .github/workflows/** (1)
    • .github/workflows/release-otdfctl.yaml
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.


The pipeline flows with steady hand, / To ship the code across the land. / With tags in place and versions set, / The best release is coming yet.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@github-actions github-actions Bot added comp:ci Github Actions Work size/s labels Apr 7, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request configures release-please for the otdfctl component by updating the main configuration, adding a component-specific configuration file, and updating the manifest. A suggestion was provided to add the bump-minor-pre-major setting to the new configuration file to ensure consistent versioning behavior for pre-1.0.0 versions.

Comment thread .github/release-please/release-please-config.otdfctl.json
@github-actions

github-actions Bot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 198.527369ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 101.362467ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 395.16523ms
Throughput 253.06 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 43.137576107s
Average Latency 429.610727ms
Throughput 115.91 requests/second

@github-actions

github-actions Bot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

@dmihalcik-virtru dmihalcik-virtru left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you keep the lists alphabetized, i.e. insert the otdfctl blocks between the lib/* and protocol/* blocks?

@alkalescent
alkalescent force-pushed the DSPX-2660-otdfctl-release-pipeline branch from 69d6f81 to 5af1d61 Compare April 8, 2026 18:10
@alkalescent
alkalescent requested review from a team as code owners April 8, 2026 18:10
@github-actions

github-actions Bot commented Apr 8, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 187.085103ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 106.040328ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 416.329362ms
Throughput 240.19 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 40.923824181s
Average Latency 406.699436ms
Throughput 122.18 requests/second

@alkalescent alkalescent changed the title feat(cli): configure release pipeline for independent otdfctl releases feat(cli): independent otdfctl releases + updates from origin/main Apr 8, 2026
@@ -0,0 +1,251 @@
package main

@elizabethhealy elizabethhealy Apr 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you rebase or update the feature branch from main? i think a lot of these changes are from other commits (like this codegen stuff and the sort proto changes)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

@alkalescent
alkalescent force-pushed the DSPX-2655-migrate-otdfctl branch from ac9d36a to 40e396b Compare April 10, 2026 15:37
Add otdfctl component to platform release-please configuration for
independent versioned releases with cross-platform binary artifacts.

- Add otdfctl package to release-please-config.main.json with
  extra-files pointing to pkg/config/config.go for version bumps
- Add otdfctl entry to release-please-manifest.json at v0.30.0
- Create release-please-config.otdfctl.json for release branch support
- Create release-otdfctl.yaml workflow: triggers on otdfctl/v* release
  tags, builds 8 cross-platform binaries via Makefile, uploads artifacts
  to GitHub release

DSPX-2660

Signed-off-by: Krish Suchak <suchak.krish@gmail.com>
@alkalescent
alkalescent force-pushed the DSPX-2660-otdfctl-release-pipeline branch from 5af1d61 to ed7b855 Compare April 10, 2026 15:45
@github-actions

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 158.102197ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 82.953986ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 392.38623ms
Throughput 254.85 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 41.021727361s
Average Latency 408.176062ms
Throughput 121.89 requests/second

@github-actions

Copy link
Copy Markdown
Contributor

@github-actions

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 195.924031ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 99.337078ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 411.675142ms
Throughput 242.91 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 40.6696308s
Average Latency 405.087933ms
Throughput 122.94 requests/second

@github-actions

Copy link
Copy Markdown
Contributor

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

  • examples
  • otdfctl
  • sdk
  • service
  • lib/fixtures
  • tests-bdd

See the workflow run for details.

@alkalescent alkalescent changed the title feat(cli): independent otdfctl releases + updates from origin/main feat(cli): independent otdfctl releases Apr 10, 2026
@alkalescent

Copy link
Copy Markdown
Contributor Author

changed to alphabetical order @dmihalcik-virtru

env:
SEM_VER: ${{ steps.version.outputs.version }}
COMMIT_SHA: ${{ github.sha }}
run: make build

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: do we need to build everything?

@alkalescent alkalescent Apr 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

working-directory: otdfctl
There are two Makefiles: the platform one at the root which will build everything and an otdfctl scoped one from the original repo which will build cross-platform otdfctl.

@alkalescent
alkalescent merged commit 572446e into DSPX-2655-migrate-otdfctl Apr 10, 2026
35 of 36 checks passed
@alkalescent
alkalescent deleted the DSPX-2660-otdfctl-release-pipeline branch April 10, 2026 16:38
alkalescent added a commit that referenced this pull request Apr 14, 2026
### Proposed Changes

* Add `otdfctl/e2e` to the `github-actions` dependabot ecosystem so
composite action dependencies (`actions/setup-go`,
`bats-core/bats-action`, `actions/upload-artifact`) are tracked
* Add `otdfctl` gomod entry with daily schedule and
`github.com/opentdf/*` internal dep exclusion, matching existing module
patterns

#### Files modified

| File | Change |
|------|--------|
| `.github/dependabot.yml` | Add `otdfctl/e2e` to github-actions
directories; add `otdfctl` gomod entry |

#### Already configured (no changes needed)

| Workflow | Status |
|----------|--------|
| Backport | Uses repo-wide reusable workflow |
| CodeQL | Scans entire repo (no path filters) |
| Dependency review | Single consolidated deny-license list |
| PR lint | `cli` scope already present |
| Checks matrix | `otdfctl` already in directory list |

#### PR Stack (DSPX-2654)

1. #3205 — Subtree merge + module path rewrite (DSPX-2655, DSPX-2656)
2. #3208 — Makefile and build scripts (DSPX-2657)
3. #3221 — CI workflows (DSPX-2658)
4. #3236 — e2e tests and lint fixes (DSPX-2659)
5. #3268 — Release pipeline (DSPX-2660)
6. **This PR** — Supporting workflows (DSPX-2661)

### Checklist

- [ ] I have added or updated unit tests
- [x] I have added or updated integration tests (if appropriate)
- [x] I have added or updated documentation

### Testing Instructions

- Verify YAML is valid: `python3 -c "import yaml;
yaml.safe_load(open('.github/dependabot.yml'))"`
- Verify otdfctl gomod entry: search for `directory: "/otdfctl"` in
dependabot.yml
- Verify github-actions directories include `/otdfctl/e2e`
alkalescent added a commit that referenced this pull request Apr 20, 2026
* Add otdfctl component to platform release-please configuration for
independent versioned releases
* Tags follow the monorepo per-component pattern: `otdfctl/v0.30.0`
* Register `otdfctl/pkg/config/config.go` as extra-file so
release-please bumps the `Version` constant (already has `//
x-release-please-version` marker)
* Create release workflow that triggers on `otdfctl/v*` tags, builds 8
cross-platform binaries (darwin amd64/arm64, linux amd64/arm/arm64,
windows amd64/arm/arm64), and uploads artifacts to the GitHub release

| File | Change |
|------|--------|
| `release-please-config.main.json` | Add `otdfctl` package entry with
`extra-files` |
| `release-please-manifest.json` | Add `"otdfctl": "0.30.0"` version
tracking |
| `release-please-config.otdfctl.json` | **New** — component config for
`release/otdfctl/vX.Y` branches |
| `release-otdfctl.yaml` | **New** — build and upload workflow on
release publish |

1. #3205 — Subtree merge + module path rewrite (DSPX-2655, DSPX-2656)
2. #3208 — Makefile and build scripts (DSPX-2657)
3. #3221 — CI workflows (DSPX-2658)
4. #3236 — e2e tests and lint fixes (DSPX-2659)
5. **This PR** — Release pipeline (DSPX-2660)

- [ ] I have added or updated unit tests
- [x] I have added or updated integration tests (if appropriate)
- [x] I have added or updated documentation

- Verify JSON configs are valid: `cat
.github/release-please/release-please-config.main.json | jq
.packages.otdfctl`
- Verify manifest version: `cat
.github/release-please/release-please-manifest.json | jq .otdfctl`
- Verify `reusable_release-please.yaml` config lookup: branch
`release/otdfctl/v0.30` → sanitized name `otdfctl` → resolves to
`release-please-config.otdfctl.json`
- Full release flow testable after merge by creating a manual release
with tag `otdfctl/v0.30.0`

---------

Signed-off-by: Krish Suchak <suchak.krish@gmail.com>
alkalescent added a commit that referenced this pull request Apr 20, 2026
### Proposed Changes

* Add `otdfctl/e2e` to the `github-actions` dependabot ecosystem so
composite action dependencies (`actions/setup-go`,
`bats-core/bats-action`, `actions/upload-artifact`) are tracked
* Add `otdfctl` gomod entry with daily schedule and
`github.com/opentdf/*` internal dep exclusion, matching existing module
patterns

#### Files modified

| File | Change |
|------|--------|
| `.github/dependabot.yml` | Add `otdfctl/e2e` to github-actions
directories; add `otdfctl` gomod entry |

#### Already configured (no changes needed)

| Workflow | Status |
|----------|--------|
| Backport | Uses repo-wide reusable workflow |
| CodeQL | Scans entire repo (no path filters) |
| Dependency review | Single consolidated deny-license list |
| PR lint | `cli` scope already present |
| Checks matrix | `otdfctl` already in directory list |

#### PR Stack (DSPX-2654)

1. #3205 — Subtree merge + module path rewrite (DSPX-2655, DSPX-2656)
2. #3208 — Makefile and build scripts (DSPX-2657)
3. #3221 — CI workflows (DSPX-2658)
4. #3236 — e2e tests and lint fixes (DSPX-2659)
5. #3268 — Release pipeline (DSPX-2660)
6. **This PR** — Supporting workflows (DSPX-2661)

### Checklist

- [ ] I have added or updated unit tests
- [x] I have added or updated integration tests (if appropriate)
- [x] I have added or updated documentation

### Testing Instructions

- Verify YAML is valid: `python3 -c "import yaml;
yaml.safe_load(open('.github/dependabot.yml'))"`
- Verify otdfctl gomod entry: search for `directory: "/otdfctl"` in
dependabot.yml
- Verify github-actions directories include `/otdfctl/e2e`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp:ci Github Actions Work size/s

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants