Azure / Azure/bicep

Add Bicep version requirements to bicepconfig.json to ensure build reproducibility

Open
#12,290 12 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

If you're looking to ensure reproducible builds, it's important to make sure you're using a consistent version of tools locally and on build systems.

As a user, I should able to set something like the following in my bicepconfig:
```json
{
"bicepVersion": "v0.22.6"
}
```

1. If I'm using AzureCLI then the expectation is that the install process will be able to read this file and install the correct version - meaning that my CI & CD systems (as well as developers working locally) will get the exact same validation and produce the exact same JSON output.
1. If I use Bicep CLI manually, then the `build` command should fail to compile if a strict requirement has been added to the bicepconfig.

It would also be useful to support some sort of wildcard syntax (e.g. `v0.*.*` -> any release where the major version is 0, or `v0.22.*` -> any release where the major & minor versions are 0 & 22).

This is somewhat related to #12202 - basically the end goal is that for users who want it, the Bicep build is 100% reproducible (including same warnings/errors).

Other notes:
* Suggestion from @alex-frankel. If we allow users to specify a "minimum version" for compatibility, we can use this for validation - e.g. blocking functions or behavioral changes that were introduced after the minimum version.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the proposed bicepconfig.json bicepVersion setting and the related #12202 discussion. Trace how Azure CLI installation and the Bicep CLI build command currently handle configuration, then define and test the version, wildcard, and minimum-version behavior needed for reproducible builds.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
build-system, cli, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.