| name | bumping-reva |
| description | Use when the user asks to bump, update, or upgrade the OpenCloud reva dependency to a specific version (e.g. "reva bump to 2.48.0", "bump reva to v2.48.0"). Covers editing go.mod, re-vendoring, bumping the OpenCloud LatestTag, the single commit, and opening the PR against main. |
Bumping Reva
Overview
Bumping reva updates the pinned opencloud-eu/reva dependency (github.com/opencloud-eu/reva/v2) to a tagged release, re-vendors the module graph, and bumps the OpenCloud dev version. It touches go.mod, go.sum, vendor/** and pkg/version/version.go, lands as one commit, and ships as a PR whose body is the reva changelog for that version.
Template PR: https://github.com/opencloud-eu/opencloud/pull/3127
Prerequisites
- The reva release must already be tagged. A reva release is cut by merging its release PR (title
🎉 Release X.Y.Z, branch next-release/main). The user merges that PR themselves — this skill starts after the tag vX.Y.Z exists. Verify the tag before doing anything (step 1); if it's missing, stop and ask the user to merge the reva release PR first.
gh (GitHub CLI), authenticated — tag lookup and PR creation go through gh api / gh pr. Verify with gh auth status; if it fails, ask the user to run gh auth login (suggest ! gh auth login so it runs in-session).gh needs the system keyring, so run all gh commands with the sandbox disabled.- Go toolchain + network —
go get / go mod tidy / go mod vendor hit the Go module proxy. Run them with the sandbox disabled (network access).
git and base64 (decoding the changelog) — standard on macOS/Linux.
Inputs
REVA_VERSION — the new reva tag, always normalized to a leading v (e.g. v2.48.0). If the user didn't give it, ask (or take the latest reva release tag).OC_VERSION — the OpenCloud target for LatestTag, without the +dev suffix (e.g. 7.4.0). Do not ask or guess — derive it from the open OpenCloud release PR (step 3). It can be a new major (e.g. 8.0.0) when release-please picked up a breaking change.
What changes
| File | What |
|---|
go.mod | github.com/opencloud-eu/reva/v2 → REVA_VERSION (+ indirect deps pulled by go mod tidy) |
go.sum | updated by go get / go mod tidy |
vendor/** | re-vendored by go mod vendor (incl. vendor/modules.txt) |
pkg/version/version.go | LatestTag = "<OC_VERSION>+dev" |
Procedure
1. Verify the reva tag exists
gh api repos/opencloud-eu/reva/commits/$REVA_VERSION --jq '.sha'
2. Bump the dependency and re-vendor
go get github.com/opencloud-eu/reva/v2@$REVA_VERSION
go mod tidy
go mod vendor
(Sandbox disabled — these need network.) Notes:
- Right after a fresh tag the module proxy can lag; if
go get reports the version as unknown, retry, or use GOPROXY=direct go get github.com/opencloud-eu/reva/v2@$REVA_VERSION.
go mod tidy will also bump indirect dependencies that reva pulled in — that is expected (the template PR did the same).
3. Bump the OpenCloud dev version
OC_VERSION is the version of the open OpenCloud release PR — the release-please PR from branch next-release/main, titled 🎉 Release X.Y.Z (e.g. #3143). Derive it, don't ask:
gh pr list --repo opencloud-eu/opencloud --head next-release/main --state open \
--json title --jq '.[0].title' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1
This is the next release target and tracks breaking changes — it may be a new major (e.g. 8.0.0), not just a minor bump. If no such PR is open, stop and ask the user.
Edit pkg/version/version.go:
LatestTag = "<OC_VERSION>+dev"
4. Fetch the reva changelog for the PR body
gh api "repos/opencloud-eu/reva/contents/CHANGELOG.md?ref=$REVA_VERSION" --jq '.content' | base64 -d
Take only the section for this version and trim it exactly like the web bump: start at the first content heading (### 🐛 Bug Fixes / ### 📈 Enhancement / ### 💥 Breaking changes), drop the # Changelog title, the ## [x.y.z] - date header and the ### ❤️ Thanks to all contributors! block, and stop before the next ## [...] version header.
Then prepend two summary bullets so the final PR body is:
- bump opencloud version to <OC_VERSION>
- reva bump <REVA_VERSION without the leading v>
### 🐛 Bug Fixes
...trimmed reva changelog...
Write this to a file for --body-file (e.g. in the scratchpad).
5. Confirm before committing
The vendor/ diff is huge — do not dump it. Show the user:
git diff go.mod pkg/version/version.go
git diff --stat | tail -1
Confirm the reva line in go.mod is exactly github.com/opencloud-eu/reva/v2 REVA_VERSION, show the target branch (main), and the PR body. Do not commit until the user approves.
6. Commit, push, open PR
gh pr create --base main \
--title "[full-ci] chore: bump reva to $REVA_VERSION_NO_V" \
--label "Type:Maintenance" \
--body-file <body-file>
(gh commands need the sandbox disabled — they require the system keyring.)
Quick reference
REVA_VERSION=v2.48.0
gh api repos/opencloud-eu/reva/commits/$REVA_VERSION --jq '.sha'
OC_VERSION=$(gh pr list --repo opencloud-eu/opencloud --head next-release/main --state open \
--json title --jq '.[0].title' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
go get github.com/opencloud-eu/reva/v2@$REVA_VERSION && go mod tidy && go mod vendor
gh api "repos/opencloud-eu/reva/contents/CHANGELOG.md?ref=$REVA_VERSION" --jq '.content' | base64 -d
Common mistakes
- Running the bump before the reva release PR is merged — the tag won't exist and
go get will fail. Verify the tag first (step 1).
- Forgetting to re-run
go mod vendor after go mod tidy, leaving vendor/ out of sync with go.mod.
- Asking for or hardcoding
OC_VERSION — always derive it from the open next-release/main release PR (step 3); it can even be a new major after a breaking change.
- Reading the changelog from reva
main instead of the tag (?ref=$REVA_VERSION). Always pin to the tag.
- Missing the
[full-ci] prefix in the PR title, the Type:Maintenance label, or the two summary bullets at the top of the body.
- Dumping the full
vendor/ diff at the confirmation step instead of go.mod + version.go + a --stat summary.
- Committing before the user confirms the diff.
