ci(refactor-release): cut tag releases over to GoReleaser - #12828
Draft
DariuszPorowski wants to merge 5 commits into
Draft
ci(refactor-release): cut tag releases over to GoReleaser#12828DariuszPorowski wants to merge 5 commits into
DariuszPorowski wants to merge 5 commits into
Conversation
6 tasks
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
August 26, 2026 04:07
ebbd4ee to
ce28759
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
August 28, 2026 16:36
67ebbff to
e54a4c5
Compare
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned Files
|
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
August 28, 2026 16:54
e54a4c5 to
a8f7de9
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dp/prepare-release-backports #12828 +/- ##
=============================================================
Coverage 59.77% 59.77%
=============================================================
Files 778 778
Lines 45916 45916
=============================================================
Hits 27446 27446
Misses 18470 18470 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Functional Tests - upgrade-noncloud1 tests ±0 0 ✅ ±0 5m 5s ⏱️ ±0s For more details on these failures, see this check. Results for commit 03b039a. ± Comparison against base commit f72357b. ♻️ This comment has been updated with latest results. |
This was referenced Aug 28, 2026
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
August 28, 2026 20:07
a8f7de9 to
13409c7
Compare
DariuszPorowski
changed the title
2 tasks
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
September 3, 2026 16:22
13409c7 to
cdeb44f
Compare
Functional Tests - corerp-noncloud190 tests 188 ✅ 1h 12m 8s ⏱️ Results for commit 158a1a4. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
September 9, 2026 17:41
cdeb44f to
158a1a4
Compare
Functional Tests - kubernetes-noncloud23 tests ±0 22 ✅ - 1 17m 45s ⏱️ + 9m 3s For more details on these failures, see this check. Results for commit 03b039a. ± Comparison against base commit f72357b. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
September 9, 2026 20:47
158a1a4 to
81376b7
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Mixed registry failures can be misclassified as confirmed absence, allowing an immutable image tag to be overwritten.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Migrates tag releases to a resumable, digest-verified GoReleaser pipeline, while main builds publish only edge.
Changes:
- Adds immutable release staging, locking, verification, and alias promotion.
- Adds reconciliation scripts and comprehensive release tests.
- Removes legacy release and shadow-parity paths; updates documentation.
File summaries
| File | Description |
|---|---|
.cspellignore |
Allows new terminology. |
.github/scripts/capture-release-image-digests.sh |
Captures and verifies image digests. |
.github/scripts/capture-release-image-digests_test.sh |
Tests digest capture and recovery states. |
.github/scripts/ensure-draft-release.mjs |
Reconciles draft releases. |
.github/scripts/ensure-draft-release_test.mjs |
Tests draft reconciliation. |
.github/scripts/image-payload-manifest/main.go |
Removes obsolete parity helper. |
.github/scripts/normalize-release-checksums.sh |
Normalizes CLI checksums. |
.github/scripts/normalize-release-checksums_test.sh |
Tests checksum normalization. |
.github/scripts/prepare-release_test.sh |
Updates prepared-notes assertions. |
.github/scripts/publish-draft-release.mjs |
Publishes drafts and selects aliases. |
.github/scripts/publish-draft-release_test.mjs |
Tests publication and alias policy. |
.github/scripts/publish-helm-chart.sh |
Reconciles immutable Helm publication. |
.github/scripts/publish-helm-chart_test.sh |
Tests Helm publication recovery. |
.github/scripts/release-assets.mjs |
Manages and verifies release assets. |
.github/scripts/release-assets_test.mjs |
Tests asset reconciliation. |
.github/scripts/release-cutover_test.sh |
Validates cutover workflow contracts. |
.github/scripts/release-oci-artifacts.sh |
Stages and promotes OCI artifacts. |
.github/scripts/release-oci-artifacts_test.sh |
Tests OCI staging and promotion. |
.github/scripts/release-parity-manifest.sh |
Permits release lock assets. |
.github/scripts/release-parity-manifest_test.sh |
Tests lock-asset handling. |
.github/scripts/verify-goreleaser-shadow.sh |
Removes shadow verifier. |
.github/scripts/verify-goreleaser-shadow_test.sh |
Removes shadow-verifier tests. |
.github/scripts/verify-goreleaser-snapshot.sh |
Verifies final release configuration. |
.github/workflows/__build-cli.yaml |
Publishes CLI edge artifacts. |
.github/workflows/__build-helm-chart.yaml |
Uses resumable Helm publishing. |
.github/workflows/__build-images.yaml |
Publishes images only as edge. |
.github/workflows/__publish-release.yaml |
Removes legacy release publisher. |
.github/workflows/build-release.yaml |
Implements the new release transaction. |
.goreleaser.yaml |
Keeps releases draft and avoids latest. |
build/artifacts.mk |
Adds release staging and promotion targets. |
build/docker.mk |
Removes legacy image retagging. |
build/test.mk |
Registers cutover tests. |
deploy/Chart/README.md |
Documents stable latest semantics. |
docs/contributing/contributing-releases/README.md |
Documents the new release workflow. |
Review details
- Files reviewed: 34/34 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # A single missing read is never trusted: the registry must report the | ||
| # tag missing on every attempt before it counts as absent. | ||
| case "${error,,}" in | ||
| *"manifest unknown"* | *"not found"* | *404*) missing=true ;; |
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
2 times, most recently
from
September 10, 2026 20:32
7ec933b to
e5db9b5
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
2 times, most recently
from
September 10, 2026 20:56
0bd875c to
e8540e4
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
September 10, 2026 21:41
e8540e4 to
cbb56e8
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
2 times, most recently
from
September 10, 2026 21:57
0df90df to
fc9fe6f
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
September 10, 2026 22:26
fc9fe6f to
e9aba62
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
September 10, 2026 22:46
e9aba62 to
0f3bdcc
Compare
Replace the tag-path CLI matrix, production image publisher, checksum loop, and GitHub Release job with one GoReleaser staging job. Keep Helm, Bicep types, and retained non-Go/test images as separate gated stages. Publish full-version images and CLI OCI artifacts first, lock their digests and source commit on the draft release, and promote channel and latest aliases only for stable releases after all mandatory stages pass. Main builds now publish edge only. Make every stage resumable: reconcile source-bound draft releases, content-verify existing CLI and Helm artifacts, adopt only complete image sets with matching OCI source labels, retry transient registry and API operations, and reject partial or conflicting immutable state. Remove the superseded shadow comparison and legacy release publisher. Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
capture-release-image-digests.sh rejected any partially published image set, so an interrupted GoReleaser push left the release stuck: every rerun failed on the same partial set, and the unclaimed-tag guard refused to proceed as well. Recovery meant deleting tags from GHCR by hand, which is exactly the half-published release this migration set out to remove. A partial set carries no durable lock, so nothing can have resolved those tags yet and staging may still overwrite them. Report absent, partial, and complete as distinct states, keep the strict all-or-nothing check for the post-staging capture that writes the lock, and run the unclaimed-tag assertion only when nothing exists yet. Require --state-output whenever --allow-absent is set, so tolerated absence is always reported to a caller that acts on it. Name absence confirmation separately from transient failure in the retry log, since a first release confirms every tag missing five times and read as a stack of failures. Make the tag-disappeared diagnostic reachable by propagating the not-found status out of cli_artifact_matches, and stage CLI artifacts through a subshell function so the directory change stays contained and the formatter stops fighting trailing padding. Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
DariuszPorowski
force-pushed
the
dp/goreleaser-tag-cutover
branch
from
September 11, 2026 04:01
0f3bdcc to
7ddfbef
Compare
… images Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cut tag-triggered releases over to GoReleaser for CLI binaries, checksums, production Go images, and draft GitHub Release staging. Keep Helm, Bicep types, and retained non-Go/test images as gated stages, then promote mutable channel and
latestaliases only from verified immutable outputs after every mandatory stage succeeds.Make the release transaction resumable with source-bound draft locks, query-before-mutate reconciliation, bounded retries, complete-set image adoption, and content verification for existing CLI and Helm artifacts. Main builds now publish
edgeonly.This stacked PR depends on #12823.
Draft gate: Phase 7 has not yet observed the required full RC-plus-final cycle. Keep this PR in draft until that cycle completes with no unexplained parity differences. The first production GoReleaser release and installation verification remain tracked in #12819.
Reason for change
The shadow phase established parity, but the production tag path still uses separate CLI, image, checksum, and release jobs with mutable recovery state. This cutover makes immutable full-version outputs the recovery source of truth and delays mutable aliases and release finalization until the complete publication set is verified.
Fixes #12819
How to test
make test-capture-release-image-digests test-release-cutover test-release-oci-artifacts test-release-parity-manifest test-prepare-releasemake goreleaser-snapshot(built and verified all 22 CLI targets)actionlint.shfmt.Docker was unavailable locally, so container registry paths are covered by deterministic Docker fixtures. ORAS publication and the GoReleaser snapshot were exercised with the real tools.
File change summary
.github/workflows/build-release.yaml.github/workflows/__build-{cli,helm-chart,images}.yaml.github/scripts/{ensure-draft-release,publish-draft-release,release-assets}.mjs.github/scripts/{release-oci-artifacts,publish-helm-chart,normalize-release-checksums,capture-release-image-digests}.sh.github/scripts/*_test.{sh,mjs}.github/scripts/{verify-goreleaser-shadow,verify-goreleaser-shadow_test}.sh.github/workflows/__publish-release.yaml.goreleaser.yamllatestmutation.build/{artifacts,docker,test}.mkdeploy/Chart/README.mddocs/contributing/contributing-releases/README.mdeng/design-notes/tools/2026-09-goreleaser-stack-review/pr-13-goreleaser-tag-cutover.md