feat: const with reference digest by fabianburth · Pull Request #2084 · open-component-model/open-component-model

fabianburth · 2026-03-27T11:02:53Z

What this PR does / why we need it

We want to adopt the backwards compatible constructor json schema. This allows component references in the component constructor.

Which issue(s) this PR fixes

open-component-model/ocm-project#961

Testing

How to test the changes

Verification

I have tested the changes locally by running ocm

Signed-off-by: Fabian Burth <fabian.burth@sap.com>

coderabbitai · 2026-03-27T11:03:11Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Added comprehensive test validation for component reference digest handling in the CLI, including success and failure scenarios. Updated Go module dependencies across multiple files, promoting golang.org/x/crypto to direct requirement in examples module and upgrading constructor binding versions.

Changes

Cohort / File(s)	Summary
Test Coverage for Digest Validation `cli/cmd/cmd_test.go`	Added new test `Test_Add_Component_Version_With_Reference_Digest` with 160 lines to validate digest handling when adding component versions, including both successful digest matching and failure cases with intentional digest mismatches.
Go Module Dependency Updates `cli/go.mod`, `cli/integration/go.mod`	Upgraded `ocm.software/open-component-model/bindings/go/constructor` from v0.0.6 to v0.0.7 in both CLI and integration module files.
Example Module Dependency Reorganization `bindings/go/examples/go.mod`	Restructured and expanded dependencies, moving `golang.org/x/crypto v0.48.0` to direct requirements alongside `oras.land/oras-go/v2 v2.6.0`, and added multiple indirect dependencies including OCM-related modules (`configuration v0.0.12` and `dag v0.0.6`) and container/observability libraries with version updates to opentelemetry and protobuf packages.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

feat!: add digest support for component references #2086: New test directly exercises digest field validation and mismatch behavior introduced in that PR.

Suggested reviewers

frewilhelm
jakobmoellerdev

Poem

🐰 Hopping through tests with digest in sight,
Reference checks done wrong and right,
Dependencies bundled, versions aligned,
Component validation, perfectly designed! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 55.56% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'feat: const with reference digest' directly corresponds to the main change—adding support for reference digest handling in component constructor functionality.
Description check	✅ Passed	The description explains the PR's purpose (adopting the backwards compatible constructor JSON schema to allow component references) and references the related issue, which aligns with the changes.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 2

🧹 Nitpick comments (1)

cli/cmd/cmd_test.go (1)
1985-1987: Remove unused variable assignment.

The _ = referencedDesc assignment on line 1986 serves no purpose. The variable was used earlier to verify the referenced component exists but this final assignment is dead code.
🧹 Remove unused assignment
-	// Verify referenced component is still accessible
-	_ = referencedDesc
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@cli/cmd/cmd_test.go` around lines 1985 - 1987, Remove the dead assignment "_
= referencedDesc" at the end of the test: the variable referencedDesc is already
used earlier to verify the referenced component, so delete the final no-op
assignment (search for referencedDesc in the test function in cmd_test.go and
remove the standalone "_ = referencedDesc" line) to eliminate the
unused-assignment noise and keep the test unchanged otherwise.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@bindings/go/constructor/runtime/convert_desc.go`:
- Around line 202-210: ConvertFromDescriptorReference currently always
constructs a non-nil *Digest for the returned Reference which can break callers
that treat nil Digest as "not provided"; update the code in
ConvertFromDescriptorReference to only populate the Reference.Digest pointer
when the input reference.Digest is meaningful (non-nil and/or has non-empty
HashAlgorithm/NormalisationAlgorithm/Value) to mirror
ConvertToDescriptorReference behavior — leave Reference.Digest nil when the
descriptor contains a zero-value digest. Ensure you check the input
reference.Digest and only set the Digest fields (HashAlgorithm,
NormalisationAlgorithm, Value) into the new *Digest when at least one of those
fields is non-empty.

In `@bindings/go/constructor/spec/v1/resources/schema-2020-12.json`:
- Around line 398-400: The change adds "additionalProperties": false to the
"component" object schema which makes validation breaking for any existing
component objects with extra fields; revert this strictness by removing or
setting "additionalProperties" to true on the "component" definition or, if the
strict rule is intentional, document the breaking change and bump the
schema/contract version so consumers are aware; refer to the "component" schema
entry and the "additionalProperties" flag when making the update.

---

Nitpick comments:
In `@cli/cmd/cmd_test.go`:
- Around line 1985-1987: Remove the dead assignment "_ = referencedDesc" at the
end of the test: the variable referencedDesc is already used earlier to verify
the referenced component, so delete the final no-op assignment (search for
referencedDesc in the test function in cmd_test.go and remove the standalone "_
= referencedDesc" line) to eliminate the unused-assignment noise and keep the
test unchanged otherwise.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d4c7b6ae-2c29-4148-a1e5-93ebf3a5daa6

📥 Commits

Reviewing files that changed from the base of the PR and between 18fca4d and c0fce2b.

📒 Files selected for processing (9)

bindings/go/constructor/construct.go
bindings/go/constructor/runtime/constructor.go
bindings/go/constructor/runtime/convert_desc.go
bindings/go/constructor/runtime/convert_v1.go
bindings/go/constructor/spec/v1/constructor.go
bindings/go/constructor/spec/v1/constructor_test.go
bindings/go/constructor/spec/v1/convert.go
bindings/go/constructor/spec/v1/resources/schema-2020-12.json
cli/cmd/cmd_test.go

Signed-off-by: Fabian Burth <fabian.burth@sap.com>

fabianburth · 2026-03-27T12:01:04Z

Unit test fail due to local go.work. Will run a manual ocm add cv to test the behaviour and then split the PR.

# Conflicts: # bindings/go/constructor/construct.go

Signed-off-by: Fabian Burth <fabian.burth@sap.com>

piotrjanik

LGTMm, though docker.io rejects connection in actions. Rate limit?

Signed-off-by: Fabian Burth <fabian.burth@sap.com>

fabianburth added 2 commits March 27, 2026 12:00

feat(constructor): add digest support for component references

d8e88b1

Signed-off-by: Fabian Burth <fabian.burth@sap.com>

Merge branch 'main' into feat/constructor-with-reference-digest

c0fce2b

fabianburth requested a review from a team as a code owner March 27, 2026 11:02

github-actions Bot added kind/feature new feature, enhancement, improvement, extension size/m Medium labels Mar 27, 2026

coderabbitai Bot reviewed Mar 27, 2026

View reviewed changes

Comment thread bindings/go/constructor/runtime/convert_desc.go Outdated

Comment thread bindings/go/constructor/spec/v1/resources/schema-2020-12.json

fabianburth added 2 commits March 27, 2026 12:22

feat(constructor): add digest support for component references

6f6d255

Signed-off-by: Fabian Burth <fabian.burth@sap.com>

feat(constructor): run task generate

f51a2c2

Signed-off-by: Fabian Burth <fabian.burth@sap.com>

fabianburth added 3 commits March 27, 2026 16:44

Merge branch 'main' into feat/constructor-with-reference-digest

aedfc82

# Conflicts: # bindings/go/constructor/construct.go

chore(deps): update constructor binding to v0.0.7

2bb43eb

Signed-off-by: Fabian Burth <fabian.burth@sap.com>

chore: remove obsolete tests

6fc8d68

Signed-off-by: Fabian Burth <fabian.burth@sap.com>

piotrjanik previously approved these changes Mar 27, 2026

View reviewed changes

piotrjanik reviewed Mar 27, 2026

View reviewed changes

fabianburth changed the title ~~feat: constructor with reference digest~~ feat: const with reference digest Mar 27, 2026

chore: go mod tidy

7f31fe6

Signed-off-by: Fabian Burth <fabian.burth@sap.com>

fabianburth dismissed piotrjanik’s stale review via 7f31fe6 March 27, 2026 16:57

jakobmoellerdev approved these changes Mar 27, 2026

View reviewed changes

frewilhelm approved these changes Mar 30, 2026

View reviewed changes

jakobmoellerdev approved these changes Mar 30, 2026

View reviewed changes

Merge branch 'main' into feat/constructor-with-reference-digest

f23495d

jakobmoellerdev enabled auto-merge (squash) March 30, 2026 07:22

jakobmoellerdev merged commit 9dfd9a0 into open-component-model:main Mar 30, 2026
22 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: const with reference digest#2084

feat: const with reference digest#2084
jakobmoellerdev merged 9 commits into
open-component-model:mainfrom
fabianburth:feat/constructor-with-reference-digest

fabianburth commented Mar 27, 2026

Uh oh!

coderabbitai Bot commented Mar 27, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

fabianburth commented Mar 27, 2026

Uh oh!

piotrjanik left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

fabianburth commented Mar 27, 2026

What this PR does / why we need it

Which issue(s) this PR fixes

Testing

How to test the changes

Verification

Uh oh!

coderabbitai Bot commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

fabianburth commented Mar 27, 2026

Uh oh!

piotrjanik left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coderabbitai Bot commented Mar 27, 2026 •

edited

Loading