lukaszraczylo/traefik-llmgateway
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefik-llmgateway.git synced 2026-10-12 04:54:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: ship vendor/ in the release archive so the catalog can import

Browse Source 
The Traefik Plugin Catalog analyzer rejected v1.0.43:

  import "github.com/lukaszraczylo/oss-telemetry" error:
  unable to find source related to: "github.com/lukaszraczylo/oss-telemetry"

piceus fetches the source archive at the released tag and interprets it
with Yaegi. It never runs go mod download, so every non-stdlib import in
production code must exist in the archive own vendor/ tree.

.gitattributes carried "vendor/ export-ignore" with an explicit warning
to remove it the moment production code imported a third-party package.
That happened when llmgateway.go took on oss-telemetry for anonymous
usage reporting, and the warning was missed. The tag itself always had
vendor/; git archive stripped it, so the tarball shipped a go.mod
requiring a module whose source was absent.

Verified by reproducing the analyzer: the v1.0.43 archive contains 0
vendor entries, the fixed archive contains 71, and interpreting the
extracted archive under yaegi passes.
This commit is contained in:
lukaszraczylo
2026-08-23 10:35:46 +01:00
parent 1089a2b41a
commit 2a5b086020
1 changed files with 24 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitattributes
+24 -12
View File
@@ -3,18 +3,30 @@
# (.goreleaser.yaml), so these entries are the actual filter for the
# release source tarball — not the archive block's own file globs, which
# have no negation syntax and cannot exclude anything.
# WARNING (v0.2 final review wave, 2026-08-20): vendor/ is safe to
# export-ignore ONLY because every current go.mod dependency
# (github.com/stretchr/testify, its go.yaml.in/yaml/v3 indirect) is a
# TEST-only dependency, imported solely by *_test.go files — which are
# themselves export-ignored below, so the released tarball never contains
# code that imports them and never needs vendor/ to build. go.mod itself
# is NOT export-ignored and ships in every release tarball as-is. The
# moment any non-test .go file (production code, not *_test.go) imports a
# third-party package, this line MUST be removed: otherwise the tarball
# ships a go.mod requiring a module its own vendor/ was stripped out of,
# and the extracted source cannot build standalone.
vendor/ export-ignore
# vendor/ is deliberately NOT export-ignored, and must stay that way.
#
# It WAS export-ignored until 2026-08-23, on the reasoning that every
# dependency was test-only (github.com/stretchr/testify and its
# go.yaml.in/yaml/v3 indirect), imported solely by *_test.go files that
# are themselves export-ignored below — so the tarball never contained
# code needing vendor/ to build. That comment carried an explicit warning
# to remove the line the moment production code imported a third-party
# package.
#
# That happened, and the warning was missed: llmgateway.go took on
# github.com/lukaszraczylo/oss-telemetry as a RUNTIME dependency. The
# release tarball then shipped a go.mod requiring a module whose source
# had been stripped, and the Traefik Plugin Catalog analyzer (piceus)
# rejected v1.0.43 with:
#
# import "github.com/lukaszraczylo/oss-telemetry" error:
# unable to find source related to: "github.com/lukaszraczylo/oss-telemetry"
#
# piceus fetches the source ARCHIVE at the released tag and interprets it
# with Yaegi. It never runs `go mod download`, so every non-stdlib import
# in production code must be present in the archive's own vendor/ tree.
# Shipping vendor/ also costs the test-only deps a few hundred KB in the
# tarball, which is the correct trade against being unimportable.
integration/ export-ignore
tools/ export-ignore
docs/ export-ignore