Publish a family feed¶

To have go-core-currency check that a release requires the latest release of each family core it depends on, write a family feed and point the component's feed input at it. A feed lists each family's core module; which modules are members is read from go.mod, so you never list them.

1. Write the feed¶

One entry per family whose core is a Go module:

{
  "schema_version": 1,
  "families": [
    {
      "name": "storage",
      "ecosystem": "go",
      "core": { "module": "example.com/acme/storage" }
    }
  ]
}

core.module is the core's root module path, exactly as its go.mod writes it after module. The full format is on Family feed; check yours against the JSON Schema with any validator:

npx --yes ajv-cli validate -s family-feed-v1.schema.json -d families.json

2a. One repository: commit it¶

If only one repository reads the feed, commit it and give the path:

include:
  - component: gitlab.com/phpboyscout/cicd/go-core-currency@<version>
    inputs:
      feed: .gitlab/families.json

2b. Several repositories: host it¶

When the members live in separate repositories, host one feed they all read. Any plain HTTPS URL that answers a GET without a credential works. GitLab Pages is the shortest route: in the repository that owns the list, publish the file from public/:

pages:
  stage: deploy
  script:
    - mkdir -p public && cp families.json public/
  artifacts:
    paths: [public]
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

Then give each member the URL:

      feed: https://acme.gitlab.io/catalogue/families.json

The Pages site must be readable without signing in (Settings → General → Visibility → Pages: Everyone), even if the repository itself is private.

3. Check it from outside CI¶

curl -fsS -A "go-core-currency (phpboyscout/cicd)" https://acme.gitlab.io/catalogue/families.json | python3 -m json.tool

If that works and a plain python3 -c 'import urllib.request; urllib.request.urlopen("…")' is refused with 403, a bot filter in front of the site is blocking stock HTTP clients. The job is unaffected, because it sends the name above, but other readers of your feed will not be.

4. Turn it into a gate¶

The job only warns until you ask it to block:

      mode: enforce

Do this once a few release merge requests have shown it warning only where a core really was behind.