update unsupported yq to yq-go

Author: sghosh23

bin/sync-k8s-secret-to-wire-secrets.sh

@@ -122,11 +122,11 @@ if command -v yq &> /dev/null; then
     echo "✓ Using yq for YAML manipulation"
     for yaml_path in "${YAML_PATHS[@]}"; do
         echo "  Updating: $yaml_path"
-        yq -y "$yaml_path = \"$SECRET_VALUE\"" "$YAML_FILE" > "$YAML_FILE.tmp" && mv "$YAML_FILE.tmp" "$YAML_FILE"
+        yq eval "$yaml_path = \"$SECRET_VALUE\"" "$YAML_FILE" > "$YAML_FILE.tmp" && mv "$YAML_FILE.tmp" "$YAML_FILE"
     done
 else
     echo "❌ ERROR: yq is required for this script"
-    echo "   Install yq: https://github.com/kislyuk/yq"
+    echo "   Install yq-go: https://github.com/mikefarah/yq"
     rm "$YAML_FILE.bak"
     exit 1
 fi
@@ -138,7 +138,7 @@ SUCCESS=true
 for yaml_path in "${YAML_PATHS[@]}"; do
     # Use yq to extract the actual value at the specific path
     if command -v yq &> /dev/null; then
-        EXTRACTED_VALUE=$(yq -r "$yaml_path" "$YAML_FILE" 2>/dev/null || echo "")
+        EXTRACTED_VALUE=$(yq eval "$yaml_path" "$YAML_FILE" 2>/dev/null || echo "")
         if [ "$EXTRACTED_VALUE" = "$SECRET_VALUE" ]; then
             echo "  ✓ $yaml_path: synced"
         else

bin/wiab-demo/offline_deploy_k8s.sh

@@ -65,7 +65,7 @@ process_values() {
       "$BASE_DIR/values/wire-server/values.yaml" > "$TEMP_DIR/wire-server-values.yaml"
 
   # fixing the turnStatic values
-  yq -i -Y ".brig.turnStatic.v2 = [\"turn:$HOST_IP:3478\", \"turn:$HOST_IP:3478?transport=tcp\"]" "$TEMP_DIR/wire-server-values.yaml"
+  yq eval -i ".brig.turnStatic.v2 = [\"turn:$HOST_IP:3478\", \"turn:$HOST_IP:3478?transport=tcp\"]" "$TEMP_DIR/wire-server-values.yaml"
 
   # Fixing the hosts in webapp team-settings and account-pages charts
   for chart in webapp team-settings account-pages; do
@@ -92,7 +92,7 @@ process_values() {
       "$BASE_DIR/values/sftd/values.yaml" > "$TEMP_DIR/sftd-values.yaml"
 
   # Creating coturn values and secrets
-  ZREST_SECRET=$(yq '.brig.secrets.turn.secret' "$BASE_DIR/values/wire-server/secrets.yaml" | tr -d '"')
+  ZREST_SECRET=$(yq eval '.brig.secrets.turn.secret' "$BASE_DIR/values/wire-server/secrets.yaml" | tr -d '"')
   cat >"$TEMP_DIR/coturn-secrets.yaml"<<EOF
 secrets:
   zrestSecrets:

changelog.d/3-deploy-builds/fix-chart-patching-broken-pipe

@@ -0,0 +1 @@
+Fixed: Chart patching script broken pipe error caused by set -euo pipefail interaction with non-zero return codes

changelog.d/3-deploy-builds/standardize-yq-version

@@ -0,0 +1 @@
+Changed: Standardized all scripts to use yq-go (v4+) for YAML processing, replacing deprecated python-yq. Updated syntax in offline deployment scripts (cd.sh, cd-with-retry.sh), build scripts (build_adminhost_containers.sh), demo deployment (offline_deploy_k8s.sh), secret sync utilities, and chart image extraction. This fixes CI build errors with helm template YAML parsing and ensures consistent, reliable YAML manipulation across the codebase.

offline/cd-with-retry.sh

@@ -136,7 +136,7 @@ eval "$(ssh-agent)"
 ssh-add - <<< "$ssh_private_key"
 
 terraform output -json static-inventory > inventory.json
-yq -y '.' inventory.json > inventory.yml
+yq eval -o=yaml '.' inventory.json > inventory.yml
 
 ssh -oStrictHostKeyChecking=accept-new -oConnectionAttempts=10 "root@$adminhost" tar xzv < "$ARTIFACTS_DIR/assets.tgz"
 

offline/cd.sh

@@ -24,7 +24,7 @@ eval `ssh-agent`
 ssh-add - <<< "$ssh_private_key"
 
 terraform output -json static-inventory > inventory.json
-yq -y '.' inventory.json > inventory.yml
+yq eval -o=yaml '.' inventory.json > inventory.yml
 
 ssh -oStrictHostKeyChecking=accept-new -oConnectionAttempts=10 "root@$adminhost" tar xzv < "$ARTIFACTS_DIR/assets.tgz"
 

offline/tasks/build_adminhost_containers.sh

@@ -40,7 +40,7 @@ INDEX_FILE="${OUTPUT_DIR}/containers-adminhost/index.txt"
 
 if [ "$ZAUTH" = true ]; then
   echo "Building zauth container image in ${OUTPUT_DIR} ..."
-  wire_version=$(helm show chart "${OUTPUT_DIR}"/charts/wire-server | yq -r .version)
+  wire_version=$(helm show chart "${OUTPUT_DIR}"/charts/wire-server | yq eval '.version' -)
   echo "quay.io/wire/zauth:$wire_version" | create-container-dump "${OUTPUT_DIR}"/containers-adminhost
   mv "${OUTPUT_DIR}/containers-adminhost/images.json" "${OUTPUT_DIR}"/versions/containers_adminhost_images.json
 fi

offline/tasks/patch-chart-images.sh

@@ -113,8 +113,7 @@ echo "Scanning and patching files..."
 # Process values.yaml files
 while IFS= read -r -d '' file; do
     file_count=$((file_count + 1))
-    patch_file "$file"
-    rc=$?
+    patch_file "$file" && rc=$? || rc=$?
     if [[ $rc -eq 0 ]]; then
         patched_count=$((patched_count + 1))
     elif [[ $rc -eq 2 ]]; then
@@ -125,8 +124,7 @@ done < <(find "$CHARTS_DIR" -name "values.yaml" -print0)
 # Process Chart.yaml files
 while IFS= read -r -d '' file; do
     file_count=$((file_count + 1))
-    patch_file "$file"
-    rc=$?
+    patch_file "$file" && rc=$? || rc=$?
     if [[ $rc -eq 0 ]]; then
         patched_count=$((patched_count + 1))
     elif [[ $rc -eq 2 ]]; then
@@ -137,8 +135,7 @@ done < <(find "$CHARTS_DIR" -name "Chart.yaml" -print0)
 # Process template files (for direct image references)
 while IFS= read -r -d '' file; do
     file_count=$((file_count + 1))
-    patch_file "$file"
-    rc=$?
+    patch_file "$file" && rc=$? || rc=$?
     if [[ $rc -eq 0 ]]; then
         patched_count=$((patched_count + 1))
     elif [[ $rc -eq 2 ]]; then