From 905d802623c2993c632a92251450daa7fd8c6f35 Mon Sep 17 00:00:00 2001 From: Swarit Pandey Date: Mon, 3 Aug 2026 13:06:50 +0530 Subject: [PATCH] fix(build): extract VERSION from version.go correctly in the Makefile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The extraction used `sed 's/.*"//;s/".*//'`, whose greedy `.*"` matches through the *closing* quote of `Version = "1.14.0"`, leaving nothing for the second expression to trim. VERSION has therefore been the empty string, and its only consumers — the two MSI targets — accept that silently: `wix build` gets `-d Version=` and the package is written to dist/stepsecurity-dev-machine-guard--x64.msi. Only local `make build-msi-*` runs are affected. CI builds MSIs in test-build.yml by invoking `wix build` directly with the version resolved in the build job, and release.yml derives the tag with its own (working) expression, so no shipped artifact carries the empty version. Replace it with a single anchored expression: matching `Version =` rules out other lines that merely mention Version, and `[^"]*` cannot run past the closing quote. Both MSI recipes now assert VERSION is non-empty, so a future breakage stops the build instead of producing an unversioned package the way this one did. --- Makefile | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index ca887d7..9acb335 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,8 @@ BINARY := stepsecurity-dev-machine-guard MODULE := github.com/step-security/dev-machine-guard -VERSION := $(shell grep -m1 'Version' internal/buildinfo/version.go | sed 's/.*"//;s/".*//') +# Anchored to the const assignment: [^"]* stops at the closing quote, and +# matching `Version =` rules out other lines mentioning Version. +VERSION := $(shell sed -n 's/^[[:space:]]*Version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' internal/buildinfo/version.go | head -1) COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown") BRANCH := $(shell git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown") TAG := $(shell git describe --tags --exact-match 2>/dev/null || echo "dev") @@ -9,6 +11,10 @@ LDFLAGS := -s -w \ -X $(MODULE)/internal/buildinfo.ReleaseTag=$(TAG) \ -X $(MODULE)/internal/buildinfo.ReleaseBranch=$(BRANCH) +# MSI packaging is the only VERSION consumer, and an empty value is accepted +# silently by both `wix -d` and the -out filename. Fail there instead. +check-version = test -n "$(VERSION)" || { echo "error: no Version found in internal/buildinfo/version.go" >&2; exit 1; } + .PHONY: build build-windows build-windows-task build-windows-arm64 build-windows-task-arm64 build-linux deploy-windows test lint clean smoke build-msi-amd64 build-msi-arm64 build: @@ -37,6 +43,7 @@ build-linux: # Reads Version from internal/buildinfo so MajorUpgrade semantics line up # with whatever the binary reports as `--version`. build-msi-amd64: build-windows build-windows-task + @$(check-version) mkdir -p dist @wix extension list --global 2>/dev/null | grep -q "WixToolset.Util.wixext" || \ wix extension add --global WixToolset.Util.wixext/4.0.5 @@ -50,6 +57,7 @@ build-msi-amd64: build-windows build-windows-task -out dist/stepsecurity-dev-machine-guard-$(VERSION)-x64.msi build-msi-arm64: build-windows-arm64 build-windows-task-arm64 + @$(check-version) mkdir -p dist @wix extension list --global 2>/dev/null | grep -q "WixToolset.Util.wixext" || \ wix extension add --global WixToolset.Util.wixext/4.0.5