feat: improve binary size with build tags#976
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughThis PR computes a shared ChangesBuild tags propagation
Unrelated dependency and controller edits
Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
dosubot
Bot
added
the
size:S
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 29-37: The Generate metadata step is interpolating github.ref_name
directly inside the run script, which creates a template-injection risk; move
VERSION into an env variable for that step and reference it as a shell variable
in the metadata script instead. Update the Generate metadata block to avoid
literal ${ { } } expansion in the shell, and keep the existing outputs like
COMMIT_HASH, BUILD_TIMESTAMP, and BUILD_TAGS unchanged while using VERSION
safely via the step environment.
In `@Dockerfile`:
- Line 31: The Dockerfile build command is using BUILD_TAGS without protection,
so an unset arg can shift tokens and break the go build invocation. Update the
Dockerfile’s go build step that uses BUILD_TAGS to match the Makefile behavior
by passing the tags value in a way that preserves an empty or missing value, and
verify the related build arguments around the go build command keep -tags and
-ldflags from consuming each other.
In `@Dockerfile.distroless`:
- Line 31: The build command still expands BUILD_TAGS unquoted in the distroless
Dockerfile, so an empty or unset value can cause -tags to consume the following
-ldflags argument. Update the build step that uses BUILD_TAGS to quote the
expansion, matching the safer pattern already used in the Makefile, and apply
the same fix anywhere else in the Dockerfile distroless build flow that
references BUILD_TAGS.
In `@Makefile`:
- Around line 12-16: The BUILD_TAGS setup eagerly runs featuretags during
Makefile parsing because TAILSCALE_BUILD_TAGS and BUILD_TAGS are currently
simply expanded, so switch the related variables to recursive expansion in the
Makefile so the go run invocation only happens for the binary target. Also pin
tailscale.com/cmd/featuretags to a fixed release instead of `@latest`, and apply
the same deferred lookup and version pinning in the duplicated featuretags
command used by the nightly and release GitHub workflow files.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 2894cf88-09ab-464c-8084-207ff687402d
📒 Files selected for processing (7)
.github/workflows/nightly.yml.github/workflows/release.ymlDockerfileDockerfile.distrolessMakefilego.modinternal/controller/oidc_controller.go
scottmckendry
previously approved these changes
Jul 6, 2026
dosubot
Bot
added
size:M
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
Makefile (1)
104-119: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueExtract shared
--build-arglist to cut duplication (and satisfy checkmake).
dockeranddocker-distrolessrepeat identicalVERSION/COMMIT_HASH/BUILD_TIMESTAMP/BUILD_TAGSbuild-args, differing only in tag name and Dockerfile. Factoring these into a shared variable also bringsdocker-distroless's body under thecheckmake5-line limit.♻️ Proposed refactor
+DOCKER_BUILD_ARGS := --build-arg=VERSION=$(TAG_NAME) \ + --build-arg=COMMIT_HASH=$(COMMIT_HASH) \ + --build-arg=BUILD_TIMESTAMP=$(BUILD_TIMESTAMP) \ + --build-arg=BUILD_TAGS=$(BUILD_TAGS) + docker: - docker buildx build -t tinyauthapp/tinyauth:dev \ - --build-arg=VERSION=$(TAG_NAME) \ - --build-arg=COMMIT_HASH=$(COMMIT_HASH) \ - --build-arg=BUILD_TIMESTAMP=$(BUILD_TIMESTAMP) \ - --build-arg=BUILD_TAGS=$(BUILD_TAGS) \ - -f Dockerfile . + docker buildx build -t tinyauthapp/tinyauth:dev $(DOCKER_BUILD_ARGS) -f Dockerfile . # Docker image distroless docker-distroless: - docker buildx build -t tinyauthapp/tinyauth:dev-distroless \ - --build-arg=VERSION=$(TAG_NAME) \ - --build-arg=COMMIT_HASH=$(COMMIT_HASH) \ - --build-arg=BUILD_TIMESTAMP=$(BUILD_TIMESTAMP) \ - --build-arg=BUILD_TAGS=$(BUILD_TAGS) \ - -f Dockerfile.distroless . + docker buildx build -t tinyauthapp/tinyauth:dev-distroless $(DOCKER_BUILD_ARGS) -f Dockerfile.distroless .🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Makefile` around lines 104 - 119, The docker and docker-distroless targets duplicate the same set of build arguments, which also makes docker-distroless exceed the checkmake line limit. Extract the repeated VERSION, COMMIT_HASH, BUILD_TIMESTAMP, and BUILD_TAGS flags into a shared Makefile variable, then reuse it in both targets while keeping each target focused on its unique tag name and Dockerfile in the docker and docker-distroless rules.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@Makefile`:
- Around line 104-119: The docker and docker-distroless targets duplicate the
same set of build arguments, which also makes docker-distroless exceed the
checkmake line limit. Extract the repeated VERSION, COMMIT_HASH,
BUILD_TIMESTAMP, and BUILD_TAGS flags into a shared Makefile variable, then
reuse it in both targets while keeping each target focused on its unique tag
name and Dockerfile in the docker and docker-distroless rules.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 6e292f12-d7bc-44be-ad14-753e4365c177
📒 Files selected for processing (1)
Makefile
scottmckendry
approved these changes
Jul 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
BUILD_TAGSset and apply it to Go binary builds and Docker image builds.