refactor: move the config-hash helpers to internal/confighash

ServiceHash, NetworkHash and VolumeHash only serve Compose's own change
detection (the config-hash labels stamped on containers, networks and
volumes); they have no business being part of the exported API of
pkg/compose. Move them, with their tests, to internal/confighash.

The hashes are byte-for-byte unchanged (the golden values test moves with
the code, and `compose config --hash` prints the same output before and
after). The only dependency on the package they came from, a sorted-keys
helper, is replaced by slices.Sorted(maps.Keys(...)).

This removes exported symbols from the /v5 module: compose.ServiceHash,
compose.NetworkHash and compose.VolumeHash.

Part of #14396

Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>

Author: ndeloof

cmd/compose/config.go

@@ -36,6 +36,7 @@ import (
 	"go.yaml.in/yaml/v4"
 
 	"github.com/docker/compose/v5/cmd/formatter"
+	"github.com/docker/compose/v5/internal/confighash"
 	"github.com/docker/compose/v5/pkg/api"
 	"github.com/docker/compose/v5/pkg/compose"
 )
@@ -672,7 +673,7 @@ func runHash(ctx context.Context, dockerCli command.Cli, opts configOptions) err
 			return err
 		}
 
-		hash, err := compose.ServiceHash(s)
+		hash, err := confighash.ServiceHash(s)
 		if err != nil {
 			return err
 		}

pkg/compose/hash.go internal/confighash/hash.gopkg/compose/hash.go renamed to internal/confighash/hash.go

@@ -14,11 +14,19 @@
    limitations under the License.
 */
 
-package compose
+// Package confighash computes the configuration hashes that Compose stamps on
+// the containers, networks and volumes it creates, and compares against on
+// the next run to detect a configuration change.
+//
+// The hashes are persisted in labels of existing resources: the byte layout
+// they are computed from is frozen, any change recreates users' resources.
+package confighash
 
 import (
 	"bytes"
 	"encoding/json"
+	"maps"
+	"slices"
 
 	"github.com/compose-spec/compose-go/v2/types"
 	"github.com/opencontainers/go-digest"
@@ -212,7 +220,7 @@ func pinRootKeyOrder(raw []byte, order []string) ([]byte, error) {
 			delete(root, key)
 		}
 	}
-	for _, key := range sortedKeys(root) {
+	for _, key := range slices.Sorted(maps.Keys(root)) {
 		write(key, root[key])
 	}
 	buf.WriteByte('}')

pkg/compose/hash_test.go internal/confighash/hash_test.gopkg/compose/hash_test.go renamed to internal/confighash/hash_test.go

@@ -14,7 +14,7 @@
    limitations under the License.
 */
 
-package compose
+package confighash
 
 import (
 	"encoding/json"

pkg/compose/create.go

@@ -42,6 +42,7 @@ import (
 	"github.com/sirupsen/logrus"
 	cdi "tags.cncf.io/container-device-interface/pkg/parser"
 
+	"github.com/docker/compose/v5/internal/confighash"
 	"github.com/docker/compose/v5/pkg/api"
 )
 
@@ -305,7 +306,7 @@ func (s *composeService) getCreateConfigs(ctx context.Context,
 ) (createConfigs, error) {
 	labels := options.Labels
 	if !options.NoConfigHash {
-		hash, err := ServiceHash(service)
+		hash, err := confighash.ServiceHash(service)
 		if err != nil {
 			return createConfigs{}, err
 		}
@@ -1501,7 +1502,7 @@ func (s *composeService) createNetwork(ctx context.Context, n *types.NetworkConf
 			Options: n.Ipam.Options,
 		}
 	}
-	hash, err := NetworkHash(n)
+	hash, err := confighash.NetworkHash(n)
 	if err != nil {
 		return err
 	}
@@ -1590,7 +1591,7 @@ func (s *composeService) resolveExternalNetwork(ctx context.Context, n *types.Ne
 func (s *composeService) createVolume(ctx context.Context, volume types.VolumeConfig) error {
 	eventName := "Volume " + volume.Name
 	s.events.On(creatingEvent(eventName))
-	hash, err := VolumeHash(volume)
+	hash, err := confighash.VolumeHash(volume)
 	if err != nil {
 		return err
 	}

pkg/compose/dependency_wait_test.go

@@ -32,6 +32,7 @@ import (
 	"go.uber.org/mock/gomock"
 	"gotest.tools/v3/assert"
 
+	"github.com/docker/compose/v5/internal/confighash"
 	"github.com/docker/compose/v5/pkg/api"
 	"github.com/docker/compose/v5/pkg/mocks"
 )
@@ -76,7 +77,7 @@ func TestWaitDependencies(t *testing.T) {
 			},
 		}}
 
-		_, err := ServiceHash(project.Services["disabled"])
+		_, err := confighash.ServiceHash(project.Services["disabled"])
 		assert.NilError(t, err)
 
 		assert.NilError(t, tested.(*composeService).waitDependencies(

pkg/compose/reconcile.go

@@ -30,6 +30,7 @@ import (
 	mmount "github.com/moby/moby/api/types/mount"
 	"github.com/sirupsen/logrus"
 
+	"github.com/docker/compose/v5/internal/confighash"
 	"github.com/docker/compose/v5/pkg/api"
 )
 
@@ -255,7 +256,7 @@ func (r *reconciler) resolveObserved() {
 // recreation. Unlike volumes, recreating a network is not destructive, so no
 // user confirmation is required.
 //
-// Divergence is detected by comparing NetworkHash(desired) with the config-hash
+// Divergence is detected by comparing confighash.NetworkHash(desired) with the config-hash
 // persisted on the live network (observed.ConfigHash). A network with no
 // recorded hash (e.g. created by an older Compose or manually) is left
 // untouched: without a recorded hash there is no reliable way to tell
@@ -278,7 +279,7 @@ func (r *reconciler) reconcileNetworks() error {
 			r.planCreateNetwork(key, &desired, "not found")
 			continue
 		}
-		expected, err := NetworkHash(&desired)
+		expected, err := confighash.NetworkHash(&desired)
 		if err != nil {
 			return err
 		}
@@ -421,7 +422,7 @@ func (r *reconciler) planRecreateNetworks(keys []string) {
 // for volumes whose configuration has diverged from the live resource,
 // recreation — gated on user confirmation because it destroys the volume's data.
 //
-// Divergence is detected by comparing VolumeHash(desired) with the config-hash
+// Divergence is detected by comparing confighash.VolumeHash(desired) with the config-hash
 // persisted on the live volume (observed.ConfigHash). A volume with no recorded
 // hash (e.g. created by an older Compose) is left untouched: without a
 // recorded hash there is no reliable way to tell configuration drift apart
@@ -438,7 +439,7 @@ func (r *reconciler) reconcileVolumes() error {
 			r.planCreateVolume(key, &desired, "not found")
 			continue
 		}
-		expected, err := VolumeHash(desired)
+		expected, err := confighash.VolumeHash(desired)
 		if err != nil {
 			return err
 		}
@@ -1083,7 +1084,7 @@ func serviceHashWithResolvedRefs(service types.ServiceConfig, containers map[str
 	resolved := service
 	resolved.VolumesFrom = slices.Clone(service.VolumesFrom)
 	_ = resolveServiceReferences(&resolved, containers)
-	return ServiceHash(resolved)
+	return confighash.ServiceHash(resolved)
 }
 
 // hasNetworkMismatch checks if the container is not connected to all expected networks.

pkg/compose/reconcile_test.go

@@ -29,6 +29,7 @@ import (
 	logrustest "github.com/sirupsen/logrus/hooks/test"
 	"gotest.tools/v3/assert"
 
+	"github.com/docker/compose/v5/internal/confighash"
 	"github.com/docker/compose/v5/pkg/api"
 )
 
@@ -95,7 +96,7 @@ func TestReconcileNetworks_CreateMissing(t *testing.T) {
 
 func TestReconcileNetworks_ExistingMatch(t *testing.T) {
 	nw := types.NetworkConfig{Name: "myproject_frontend"}
-	hash, err := NetworkHash(&nw)
+	hash, err := confighash.NetworkHash(&nw)
 	assert.NilError(t, err)
 
 	project := &types.Project{
@@ -447,7 +448,7 @@ func TestReconcileVolumes_CreateMissing(t *testing.T) {
 
 func TestReconcileVolumes_ExistingMatch(t *testing.T) {
 	vol := types.VolumeConfig{Name: "myproject_data", Driver: "local"}
-	hash, err := VolumeHash(vol)
+	hash, err := confighash.VolumeHash(vol)
 	assert.NilError(t, err)
 
 	project := &types.Project{
@@ -2002,21 +2003,21 @@ func TestReconcileContainers_RegularDependsOn_NoCascade(t *testing.T) {
 
 func mustServiceHash(t *testing.T, svc types.ServiceConfig) string {
 	t.Helper()
-	h, err := ServiceHash(svc)
+	h, err := confighash.ServiceHash(svc)
 	assert.NilError(t, err)
 	return h
 }
 
 func mustVolumeHash(t *testing.T, vol types.VolumeConfig) string {
 	t.Helper()
-	h, err := VolumeHash(vol)
+	h, err := confighash.VolumeHash(vol)
 	assert.NilError(t, err)
 	return h
 }
 
 func mustNetworkHash(t *testing.T, nw types.NetworkConfig) string {
 	t.Helper()
-	h, err := NetworkHash(&nw)
+	h, err := confighash.NetworkHash(&nw)
 	assert.NilError(t, err)
 	return h
 }

pkg/compose/umask_test.go

@@ -21,6 +21,8 @@ import (
 
 	"github.com/compose-spec/compose-go/v2/types"
 	"gotest.tools/v3/assert"
+
+	"github.com/docker/compose/v5/internal/confighash"
 )
 
 func TestUmaskOption(t *testing.T) {
@@ -87,7 +89,7 @@ func TestGetCreateConfigsUmask(t *testing.T) {
 func TestServiceHashTracksUmask(t *testing.T) {
 	zero, mask := uint32(0), uint32(0o77)
 	hash := func(umask *uint32) string {
-		h, err := ServiceHash(types.ServiceConfig{Name: "app", ContainerSpec: types.ContainerSpec{Image: "alpine", Umask: umask}})
+		h, err := confighash.ServiceHash(types.ServiceConfig{Name: "app", ContainerSpec: types.ContainerSpec{Image: "alpine", Umask: umask}})
 		assert.NilError(t, err)
 		return h
 	}