mesh-build-go: a relative replace still resolves in the temporary modfile #597

2026-11-02T18:41:04Z

mesh-tools commented

2026-11-02 18:41:04 +00:00

Issue 1126 (the controller's removal), a blocking fault met in its release sdk1 (ADR 0593): the running mesh-build-go copies a module's go.mod into pins/<dir>/ and runs go mod verify there, so a relative replace (./buildstep, ../mesh-delivery-builder/buildrun) points nowhere and the build fails. Met twice (route-proxy at 13:53, then eight modules of sdk1), so the kind is fixed: delivered before sdk1, because the running build module judges that release.

Quick fix: rewrite the one replace route-proxy had. Thorough fix, chosen: absoluteReplaces in ensureModfile (the one place the version path and the pins path write the temporary modfile) makes every relative target absolute under the go.mod's own directory, single-line and block, with or without a version; and mesh-build-node refuses a package.json with a relative file:/link:/portal: dependency, naming it (no catalogue module uses one today).
Tests: TestARelativeReplaceStillResolvesInTheTemporaryModfile runs real go mod verify with three relative replaces (failed before the fix); TestAModuleDependingOnARelativeDirectoryIsRefusedNamingIt. gofmt, vet with and without the integration tag, unit and integration tests of mesh-build-go and mesh-build-node pass against mesh-sdk as on main.
The same commit is cherry-picked onto sdk1's mesh-catalog branch (identical by range-diff), so the release does not undo it.

Reviewed-by: review-1126@shanks at 45084af849

https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Issue 1126 (the controller's removal), a blocking fault met in its release sdk1 (ADR 0593): the running mesh-build-go copies a module's go.mod into `pins/<dir>/` and runs `go mod verify` there, so a relative replace (`./buildstep`, `../mesh-delivery-builder/buildrun`) points nowhere and the build fails. Met twice (route-proxy at 13:53, then eight modules of sdk1), so the kind is fixed: delivered before sdk1, because the running build module judges that release. - Quick fix: rewrite the one replace route-proxy had. Thorough fix, chosen: `absoluteReplaces` in `ensureModfile` (the one place the version path and the pins path write the temporary modfile) makes every relative target absolute under the go.mod's own directory, single-line and block, with or without a version; and mesh-build-node refuses a package.json with a relative `file:`/`link:`/`portal:` dependency, naming it (no catalogue module uses one today). - Tests: TestARelativeReplaceStillResolvesInTheTemporaryModfile runs real `go mod verify` with three relative replaces (failed before the fix); TestAModuleDependingOnARelativeDirectoryIsRefusedNamingIt. gofmt, vet with and without the integration tag, unit and integration tests of mesh-build-go and mesh-build-node pass against mesh-sdk as on main. - The same commit is cherry-picked onto sdk1's mesh-catalog branch (identical by range-diff), so the release does not undo it. Reviewed-by: review-1126@shanks at 45084af849fc370367d371bf790a97651cce479d https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

mesh-tools added 1 commit 2026-11-02 18:41:04 +00:00

A relative replace of a go.mod still resolves in the temporary modfile, so a module with a sibling package builds and verifies through the pins path

mesh/delivery merged: source.main moved to novox/mesh-catalog@ee75d4327ce5

Details

mesh/check being carried to 45084af849fc on ee75d4327ce5 | from c52afdf88b84

45084af849

ensureModfile copied go.mod word for word into pins/<dir>/, where `go mod verify` runs, so a replace to ./x or ../x pointed
nowhere (route-proxy's failure of 2026-11-02 13:53, met a second time with the release's sibling packages). Every relative
replace target is now made absolute under the tree the go.mod came from. mesh-build-node installs a module's own npm
packages in a scratch copy of package.json, so a file:, link: or portal: dependency on a relative path would fail the same
way; it is refused naming the package and its path, as a module without a lock is.

Quick fix: rewrite the one replace route-proxy had, in ensureModfile (minutes). Thorough fix: the kind, a go.mod or
package.json copied away from its tree, for every replace form (single, block, with a version, ./ and ../) in the one place
all copies go through (ensureModfile, which versions.go and the pins share), and the same kind in the other build module
that copies a manifest. Chosen: thorough, since it was met twice and hides a failure until the delivery (quick-or-thorough,
fix-a-bug-met-twice). Test: TestARelativeReplaceStillResolvesInTheTemporaryModfile runs real go mod verify in the pins directory.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

mesh-tools commented

2026-11-02 18:41:08 +00:00

Delivery novox/mesh-catalog@45084af849fc — merged since 2026-11-02T18:51:35Z

Source — source.main moved to novox/mesh-catalog@ee75d4327c. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-11-02 18:41 (new) → proposed (announced): novox/mesh-catalog#597's head announced
2026-11-02 18:41 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-02 18:51 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@45084af849fc` — **merged** since 2026-11-02T18:51:35Z **Source** — source.main moved to novox/mesh-catalog@ee75d4327ce5. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-11-02 18:41 (new) → proposed (announced): novox/mesh-catalog#597's head announced - 2026-11-02 18:41 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-02 18:51 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit ee75d4327c into main

2026-11-02 18:51:34 +00:00

mesh-tools deleted branch fix/build-go-relative-replace

2026-11-02 18:51:34 +00:00

mesh-tools referenced this pull request

2026-11-02 18:57:46 +00:00

sdk1: build modules, provisioner and checks follow ADR 0593 #598

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#597