ci(refactor-release): introduce release controller and swap triggers - #12872
Draft
DariuszPorowski wants to merge 6 commits into
Draft
DariuszPorowski wants to merge 6 commits into
DariuszPorowski wants to merge 6 commits into
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
DariuszPorowski
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
DariuszPorowski
added
the
pr:standard
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dp/goreleaser-sboms #12872 +/- ##
======================================================
Coverage ? 59.52%
======================================================
Files ? 772
Lines ? 45053
Branches ? 0
======================================================
Hits ? 26817
Misses ? 18236
Partials ? 0 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Functional Tests - upgrade-noncloud1 tests 0 ✅ 5m 4s ⏱️ For more details on these failures, see this check. Results for commit 56a5617. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
from
September 3, 2026 16:22
5b2ee48 to
12a1f75
Compare
Functional Tests - corerp-noncloud190 tests 188 ✅ 1h 3m 26s ⏱️ Results for commit 039c78a. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
2 times, most recently
from
September 9, 2026 20:47
039c78a to
ab64b70
Compare
6 tasks
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The release-path redesign remains draft with live App-tag triggering and release-cycle soak gates still unverified.
Pull request overview
Replaces the legacy versions.yaml release trigger with a source-bound, resumable release controller that validates immutable release plans and creates the Radius tag last.
Changes:
- Adds automatic, approval, and recovery controller entry points.
- Introduces schema-v2 plans, frozen sibling commits, and Deployment Engine provenance locking.
- Adds failure-injection tests and updates release documentation.
File summaries
| File | Description |
|---|---|
.github/ghalint.yaml |
Removes obsolete release-workflow exception. |
.github/scripts/capture-release-sibling-commits.sh |
Freezes sibling repository commits. |
.github/scripts/capture-release-sibling-commits_test.sh |
Tests sibling commit capture. |
.github/scripts/create-release-backport.sh |
Removes legacy workflow during metadata backports. |
.github/scripts/create-release-backport_test.sh |
Tests backport cleanup. |
.github/scripts/dispatch-release-controller.mjs |
Dispatches approved controller events. |
.github/scripts/dispatch-release-controller_test.mjs |
Tests dispatch validation. |
.github/scripts/monitor-remote-workflow.mjs |
Adds query-only and retry controls. |
.github/scripts/monitor-remote-workflow_test.mjs |
Tests updated remote-run reconciliation. |
.github/scripts/prepare-release.sh |
Generates schema-v2 committed plans. |
.github/scripts/prepare-release_test.sh |
Tests plan generation. |
.github/scripts/reconcile-release-controller-lock.mjs |
Persists Deployment Engine digest locks. |
.github/scripts/reconcile-release-controller-lock_test.mjs |
Tests immutable lock behavior. |
.github/scripts/release-controller-resume_test.sh |
Tests resumability after each stage. |
.github/scripts/release-controller_test.sh |
Verifies controller workflow contracts. |
.github/scripts/release-create-tag-and-branch.sh |
Adds non-mutating preflight mode. |
.github/scripts/release-create-tag-and-branch_test.sh |
Tests preflight reconciliation. |
.github/scripts/release-get-version_test.sh |
Removes legacy skip-path tests. |
.github/scripts/release-should-skip.sh |
Deletes obsolete branch-wait logic. |
.github/scripts/resolve-release-controller.mjs |
Resolves release and backport events. |
.github/scripts/resolve-release-controller_test.mjs |
Tests controller input resolution. |
.github/scripts/validate-release-controller-plan.sh |
Binds plans to exact release commits. |
.github/scripts/validate-release-controller-plan_test.sh |
Tests controller-plan validation. |
.github/scripts/validate-release-merge-group.sh |
Includes committed plans in merge validation. |
.github/scripts/validate-release-merge-group_test.sh |
Updates merge-group fixtures. |
.github/scripts/validate-release-plan.sh |
Validates schema-v2 plans and siblings. |
.github/scripts/validate-release-plan_test.sh |
Tests immutable plan validation. |
.github/scripts/verify-deployment-engine-image.sh |
Verifies image provenance and platforms. |
.github/scripts/verify-deployment-engine-image_test.sh |
Tests image verification. |
.github/scripts/verify-deployment-engine-tag.sh |
Verifies signed tag identity and target. |
.github/scripts/verify-deployment-engine-tag_test.sh |
Tests strengthened tag checks. |
.github/workflows/__changes.yml |
Removes deleted workflow classification. |
.github/workflows/__dispatch-release-controller.yaml |
Adds reusable secretless dispatcher. |
.github/workflows/__release-controller.yaml |
Implements staged release reconciliation. |
.github/workflows/approve-release.yaml |
Adds manual approval gateway. |
.github/workflows/prepare-release.yaml |
Captures and commits immutable plans. |
.github/workflows/release-controller.yaml |
Adds trusted controller entry workflow. |
.github/workflows/release.yaml |
Removes legacy release trigger. |
.github/workflows/resume-release.yaml |
Adds manual recovery gateway. |
build/test.mk |
Registers controller test suites. |
docs/contributing/contributing-releases/README.md |
Documents the new release process. |
Review details
- Files reviewed: 41/41 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
2 times, most recently
from
September 10, 2026 20:32
a3e0c72 to
6fce55a
Compare
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
2 times, most recently
from
September 10, 2026 20:56
14cbcaf to
3cad501
Compare
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
from
September 10, 2026 21:41
3cad501 to
ed55a86
Compare
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
from
September 10, 2026 21:47
ed55a86 to
3c6d49e
Compare
DariuszPorowski
removed this pull request from stack #13045
September 18, 2026 20:12
DariuszPorowski
added this pull request to stack #13056
September 18, 2026 20:12
Functional Tests - samples-noncloud3 tests 3 ✅ 1m 25s ⏱️ Results for commit 187adaa. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
from
September 18, 2026 20:32
9356431 to
187adaa
Compare
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
from
September 18, 2026 21:05
187adaa to
17507da
Compare
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
from
September 18, 2026 21:44
17507da to
e1afcd9
Compare
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
from
September 18, 2026 22:04
e1afcd9 to
5cfdebc
Compare
DariuszPorowski
removed this pull request from stack #13056
September 18, 2026 22:57
DariuszPorowski
added this pull request to stack #13058
September 18, 2026 23:00
DariuszPorowski
removed this pull request from stack #13058
September 18, 2026 23:05
DariuszPorowski
added this pull request to stack #13060
September 18, 2026 23:06
DariuszPorowski
removed this pull request from stack #13060
September 19, 2026 02:21
DariuszPorowski
added this pull request to stack #13063
September 19, 2026 02:21
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
from
September 19, 2026 02:30
5cfdebc to
d5f4f9f
Compare
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
…r workflow Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
…nd Deployment Engine token management Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
DariuszPorowski
force-pushed
the
dp/release-controller-trigger-swap
branch
from
September 19, 2026 03:47
d5f4f9f to
56a5617
Compare
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
DariuszPorowski
removed this pull request from stack #13063
September 21, 2026 16:26
DariuszPorowski
added this pull request to stack #13074
September 21, 2026 16:26
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Introduce the source-bound release controller and replace the legacy
versions.yamlpush trigger. Generated release PRs and metadata backports now resolve through one reusable controller; manual approval and recovery use secretless gateways into default-branch code.Release plans are committed as schema v2 with frozen sibling repository SHAs. The controller validates and preflights every destination, verifies the exact signed Deployment Engine tag and image provenance, persists its digest lock, reconciles sibling repositories, and creates the Radius tag last with the release App. Existing release branches remove their legacy workflow through the generated metadata backport.
This stacked PR depends on #12869.
Draft gates:
build-release.yamlin the repository.Reason for change
The previous workflow inferred release intent from any
versions.yamlpush, created the Radius tag before all prerequisites completed, and had no source-bound resume entry point. This implements the approved PR15 transaction and recovery model.Fixes #12813
How to test
make test-prepare-release test-release-controller test-release-plan test-release-backport test-release-tag-and-branch test-release-get-version test-monitor-remote-workflow test-release-cutover test-release-sbomswith pinned yq v4.53.3concurrency.queue: maxkey.File change summary
.github/workflows/{release-controller,approve-release,resume-release}.yaml, reusable controller workflows.github/workflows/release.yaml,.github/scripts/release-should-skip.sh.github/scripts/{prepare-release,validate-release-plan,validate-release-controller-plan,capture-release-sibling-commits}*.github/scripts/{monitor-remote-workflow,reconcile-release-controller-lock,verify-deployment-engine-*}*.github/scripts/{create-release-backport,release-create-tag-and-branch}*build/test.mkand controller fixturesdocs/contributing/contributing-releases/README.mdeng/design-notes/tools/2026-09-goreleaser-stack-review/pr-15-release-controller.md