Require ko:// prefix on all references

[mattmoor]

Deprecate and eliminate the use of unqualified references (e.g. no ko://).

The initial heuristic-based approach was a bit too clever, and led to a lot of undesirable failure modes, which are really confusing to new users. With this change we will start to warn whenever we publish an image for an unprefixed import path, and stop building them in a coming release.

Dropping the heuristic approach will also speed up builds because the heuristic has gotten more expensive with the adoption of go modules.

The plan:

1. Whenever we build an import path without ko:// emit a warning linking to this issue.
2. Cut a 0.5 release
3. Drop the warning and stop supporting ko://

To suppress this warning

Prefix the import path with ko://, e.g.

  image: ko://github.com/google/ko/cmd/ko

---

UPDATED to improve the main issue body. Original below. 👇
@imjasonh added support for ko:// prefixed references a while ago, and I feel like there's been fairly steady adoption of this as projects have matured and folks have been bitten by the old guard heuristics (😬 mea culpa).

I propose we start to emit warnings when we are fed references that ARE supported references, but that don't use ko:// and cut a new release.

cc @jonjohnsonjr @dprotaso

[n3wscott]

I am +1 inside of yaml, but publish should still take a path without ko://.

This will speed up some of the path searching too if you can skip over non-ko:// strings.

[vaikas]

Anything that prevents the container image that we're trying to launch being something like github.com/vaikas/dump would be great imho.

[mattmoor]

While we are at it, let's deprecate :root as the default base and switch to :nonroot.

[mattmoor]

I'm going to try to knock these off this morning. I'll open a proper issue for the base outlining things so I can include it in the deprecation notice.