Files
milvus/.github/workflows/mac.yaml
T
Li LiuandGitHub c819a2c5e1 build(deps): upgrade go toolchain to 1.26.5 (#51271)
## What
- Upgrade the root, pkg, client, test, and telemetry example modules
from Go 1.26.4 to Go 1.26.5.
- Upgrade CPU/GPU builder Dockerfiles, macOS CI Go setup, KRTE build
arg, rpm setup, meta-migration builder, and go-client test image to Go
1.26.5.
- Point CPU and GPU builder consumption in `.env` to the successful
build-env tag `20260714-c135601`.

## Why
- Latest direct Trivy scan of
`milvusdb/milvus:master-20260711-1993feae-amd64` reports CVE-2026-39822
in Go stdlib 1.26.4, fixed in 1.26.5.
- The normal daily image scan is currently blocked through Jenkins
`milvus_scan_image_daily` #540 with `exec format error`; last successful
scan is #508 from 2026-06-10, so this was verified by direct image scan.

## Image coverage
- Go toolchain fixes are shared by all Milvus runtime images; no per-OS
runtime Dockerfile package change is required.
- Builder definitions are updated for CPU ubuntu22.04, ubuntu20.04,
ubuntu24.04, amazonlinux2023, rockylinux9 and GPU ubuntu22.04,
ubuntu20.04.
- No runtime image variant is deliberately skipped; this is not an
OS-package CVE.

## Verification
- `go.dev/dl/?mode=json&include=all` confirms go1.26.5 is stable and
linux amd64/arm64 tarballs exist.
- `go env GOTOOLCHAIN GOVERSION` selects `auto` / `go1.26.5` after the
module update.
- `go list -m` succeeds for root, pkg, client, tests/go_client, and both
telemetry examples.
- `cd pkg && go test -tags dynamic,test -gcflags="all=-N -l" -count=1
./util/typeutil` passes after rebasing onto the latest upstream master.
- Jenkins build-env #40 succeeded and published builder tag
`20260714-c135601`; `.env` now selects that tag for CPU and GPU CI
builds.
- A repo-wide audit found no remaining Go 1.26.4 toolchain pins.

Note: full root `go mod tidy` is not included because this checkout has
a root-owned `deployments/docker/dev/volumes/etcd/member` directory that
makes `go mod tidy` fail with permission errors; `go mod tidy -e`
subsequently OOMed locally. No go.sum changes were produced by the
successful module tidies.

Generated by autonomous CVE maintenance.

---------

Signed-off-by: Li Liu <li.liu@zilliz.com>
2026-07-15 17:20:36 +08:00

95 lines
3.5 KiB
YAML

name: Mac Code Checker
# This workflow is triggered by manual dispatch.
on:
workflow_dispatch:
inputs:
branch:
description: 'Branch to run the workflow on'
required: true
default: 'master'
type: string
concurrency:
group: ${{ github.workflow }}-${{ github.event.inputs.branch || github.sha }}
cancel-in-progress: false
jobs:
mac:
name: Code Checker MacOS
runs-on: macos-15
timeout-minutes: 480
steps:
- name: Checkout
uses: actions/checkout@v2
with:
ref: ${{ github.event.inputs.branch || github.ref }}
- name: Setup Python environment
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Install CMake 3.31.8
run: |
cmake --version || true
which cmake || true
if ! brew list cmake &>/dev/null; then
brew uninstall cmake -f
fi
curl -LO https://github.com/Kitware/CMake/releases/download/v3.31.8/cmake-3.31.8-macos-universal.tar.gz
tar -zxf cmake-3.31.8-macos-universal.tar.gz -C /tmp/
sudo mv /tmp/cmake-3.31.8-macos-universal/CMake.app /Applications/
sudo rm -f /usr/local/bin/cmake /usr/local/bin/cpack /usr/local/bin/ctest
sudo rm -f /opt/homebrew/bin/cmake /opt/homebrew/bin/cpack /opt/homebrew/bin/ctest
echo -e "\n=== Creating symlinks for CMake ==="
sudo ln -s /Applications/CMake.app/Contents/bin/cmake /usr/local/bin/cmake
sudo ln -s /Applications/CMake.app/Contents/bin/cpack /usr/local/bin/cpack
sudo ln -s /Applications/CMake.app/Contents/bin/ctest /usr/local/bin/ctest
CMAKE_MODULE_DIR="/Applications/CMake.app/Contents/share/cmake-3.31"
sudo ln -s "$CMAKE_MODULE_DIR" /usr/local/share/cmake-3.31
export PATH="/usr/local/bin:$PATH"
cmake --version
which cmake
- name: Setup Go environment
uses: actions/setup-go@v4
with:
go-version: '1.26.5'
cache: false
- name: Download Caches
uses: ./.github/actions/macos-cache-restore
- name: Code Check
env:
CCACHE_DIR: /var/tmp/ccache
CCACHE_COMPILERCHECK: content
CCACHE_COMPRESS: 1
CCACHE_COMPRESSLEVEL: 9
CCACHE_MAXSIZE: 1G
run: |
if [[ ! -d "/var/tmp/ccache" ]];then
mkdir -p /var/tmp/ccache
fi
brew install libomp ninja ccache pkg-config
BREW_PREFIX=$(brew --prefix)
# aws-sdk-cpp 1.11.750 had a packaging bug where Paginator.h was
# not installed (missing CMake install rule for pagination headers).
# Homebrew backported the fix with "rebuild 1", but the CI runner's
# formula may be stale. Run brew update first so we get the
# patched bottle.
brew update
brew install aws-sdk-cpp || brew upgrade aws-sdk-cpp
# Install llvm@17 explicitly as a stable version
brew install llvm@17
if [[ ! -d "${BREW_PREFIX}/opt/llvm" ]]; then
ln -s ${BREW_PREFIX}/opt/llvm@17 ${BREW_PREFIX}/opt/llvm
fi
pip3 install conan==2.25.1
make milvus
- name: Upload Cmake log
uses: actions/upload-artifact@v4
if: ${{ failure() }}
with:
name: cmake-log
path: cmake_build/CMakeFiles/*.log
- name: Save Caches
uses: ./.github/actions/macos-cache-save
if: github.event_name != 'pull_request'