Repository navigation
fix(release)!: require gated promotion of external channel tags - #13333
Merged
Merged
Conversation
Recover draft locks on every staging attempt and enforce the complete verification and approval graph at the tagged source. Stage source-bound external artifacts under full versions and promote their channel aliases only after verification, preserving external edge tags and image digests. Update GoReleaser, regression coverage and the operator runbook, and remove the completed implementation plan and review notes. BREAKING CHANGE: Direct Deployment Engine mirror requests for stable X.Y tags are rejected. Deploy the coordinated publisher and sender changes before enabling this release pipeline. Existing unannotated Bicep channel aliases require a reviewed migration. Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
the
pr:waiting-for-review
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
DariuszPorowski
added
the
pr:important
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Cross-repository rollout requires human validation, and the unresolved alias-promotion contract gap needs correction.
1 open issue
What changed in this PR
Strengthens Radius release recovery and defers external channel promotion until verification and approval complete.
Changes:
- Recover persisted locks and enforce the publication dependency graph.
- Stage external artifacts under full-version references and promote verified digests.
- Expand regression coverage, update GoReleaser and the runbook, and remove completed planning notes.
| File | Description |
|---|---|
eng/design-notes/tools/2026-09-goreleaser-stack-review/README.md |
Removes review index. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-18-release-final-cleanup.md |
Removes cleanup review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-17-helm-immutable-image-tags.md |
Removes Helm review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-16-release-publication-gate.md |
Removes publication-gate review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-15-release-controller.md |
Removes controller review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-14-goreleaser-sboms.md |
Removes SBOM review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-13-goreleaser-tag-cutover.md |
Removes cutover review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-12-prepare-release-backports.md |
Removes preparation review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-11-dotted-rc-identifiers.md |
Removes RC identifier review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-10-release-identifier-correlation.md |
Removes dispatch review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-09-tag-reconciliation.md |
Removes reconciliation review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-08-title-check-required.md |
Removes required-title-check review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-07-goreleaser-shadow.md |
Removes shadow-release review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-06-edge-tags.md |
Removes edge-tag review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-05-split-build-workflows.md |
Removes workflow-split review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-04-git-cliff-changelog.md |
Removes changelog review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-03-conventional-commit-title.md |
Removes advisory-title-check review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-02-goreleaser-snapshot.md |
Removes snapshot review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-01-parity-manifest.md |
Removes parity review notes. |
eng/design-notes/tools/2026-09-goreleaser-stack-review/follow-up-plan.md |
Removes follow-up plan. |
eng/design-notes/tools/2026-03-goreleaser-release-lifecycle-implementation-plan.md |
Removes implementation plan. |
docs/contributing/contributing-releases/README.md |
Documents rollout, gates, and recovery. |
build/tools.yaml |
Pins GoReleaser v2.18.3. |
build/tools.generated.mk |
Updates generated tool metadata. |
build/test.mk |
Includes Bicep promotion tests. |
build/build.mk |
Allows immutable Bicep extension tags. |
.github/workflows/publish-de-image.yaml |
Separates source/destination tags and rejects channel writes. |
.github/workflows/build-release.yaml |
Recovers locks and gates external promotion. |
.github/workflows/__release-controller.yaml |
Passes provenance and rejects immutable conflicts. |
.github/workflows/__build-helm-chart.yaml |
Consumes full-version dashboard images. |
.github/workflows/__build-bicep-types.yaml |
Stages and awaits planned AWS types. |
.github/scripts/verify-release-publication.sh |
Includes external images in verification locks. |
.github/scripts/verify-release-manifest.mjs |
Checks external sources and immutable references. |
.github/scripts/verify-release-manifest_test.mjs |
Covers provenance and reference conflicts. |
.github/scripts/verify-release-build-contract.sh |
Validates publication gates and ordering. |
.github/scripts/verify-release-build-contract_test.sh |
Covers missing and weakened gates. |
.github/scripts/validate-release-controller-plan.sh |
Separates Deployment Engine source/destination tags. |
.github/scripts/validate-release-controller-plan_test.sh |
Covers tag selection across release types. |
.github/scripts/release-parity-manifest.sh |
Observes immutable staged Bicep references. |
.github/scripts/release-parity-manifest_test.sh |
Checks staged reference selection. |
.github/scripts/release-oci-artifacts.sh |
Verifies and promotes external image locks. |
.github/scripts/release-oci-artifacts_test.sh |
Covers provenance and preserved edge aliases. |
.github/scripts/release-cutover_test.sh |
Covers recovery and immutable Bicep configuration. |
.github/scripts/release-controller_test.sh |
Covers immutable mirror destinations. |
.github/scripts/release-assets_test.mjs |
Covers persisted-lock recovery. |
.github/scripts/promote-bicep-types.mjs |
Dispatches digest-bound Bicep promotions. |
.github/scripts/promote-bicep-types_test.mjs |
Covers promotion validation and failure propagation. |
Review effort: Balanced
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #13333 +/- ##
==========================================
- Coverage 60.27% 60.27% -0.01%
==========================================
Files 748 748
Lines 44255 44255
==========================================
- Hits 26676 26675 -1
- Misses 17579 17580 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
github-actions
Bot
added
pr:waiting-for-author
The release source contract only checked that the stable alias step existed and was ordered. A disabled or failure-tolerant step could still publish the GitHub Release without promoting image and CLI aliases. Require the same promotion condition and fail-closed handling as the Bicep promotion step, and add rejection fixtures for removal, disabling, and continue-on-error. Also correct the cross-repository rollout order in the release runbook and remove a design-note fragment that referenced the deleted implementation plan. Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
pr:waiting-for-review
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
brooke-hamilton
approved these changes
Oct 20, 2026
brooke-hamilton
left a comment
brooke-hamilton
left a comment
Member
There was a problem hiding this comment.
Reviewed d09dfe0; no actionable findings. Focused offline Node tests and shell syntax checks passed. Shell regression tests were blocked by missing jq/yq; live publication, registry permissions, and the coordinated release cycle were not exercised.
github-actions
Bot
added
pr:ready-for-queue
github-actions
Bot
removed
the
pr:ready-for-queue
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Complete the GoReleaser release lifecycle's recovery and publication guarantees:
absent.mainby chore(tools): bump versions #13338.Coordinated companion changes:
-rc.Ntags.Rollout order: merge and deploy the publisher first, then this PR and the dashboard PR in either order, and the Deployment Engine sender last; each step sends inputs that only the previous one accepts. The current Deployment Engine sender rejects dotted RC tags, so #684 is required before the first
vX.Y.Z-rc.Nrelease. Create no Radius or Deployment Engine release tag until all four are deployed.Reason for change
The release-readiness review found that read-only preflight credentials could hide an existing draft and bypass lock downloads, the source compatibility check accepted the historical pre-gate pipeline, and external publishers still moved mutable channel references before verification. These gaps could rebuild staged outputs or expose an unverified patch through existing channel consumers.
Breaking automation change: direct Deployment Engine mirror requests targeting stable
X.Yaliases are rejected. The approved finalizer owns channel promotion; mirror callers use a full-version destination plus a separate source tag. Existing Bicep channels without comparable source/version annotations require a separately reviewed migration, not blind overwrite or edits to old immutable artifacts. A new stable channel needs no legacy bootstrap.N/A
How to test
Use a Linux checkout with Bash, Node.js, and the Go version from
go.mod. The following exercises local fixtures, not live release publication:Expected: matching source/digest locks are reused; missing gates, disabled or failure-tolerant promotion steps, conflicting immutable artifacts, optional/skipped checks, and premature channel writes are rejected. The external-image tests preserve a dashboard manifest's digest and leave its independently owned
latesttag unchanged. The Bicep promotion tests reject unverified/RC manifests and stop immediately on publisher failure.Verify the actual release image build receives the immutable extension tag without building or publishing an image:
Expected: the
generate-bicepconfig.shcommand receives0.61.2, not0.61. The cutover fixtures also verify that edge still resolves extensions throughlatest.Validation performed:
make test-release-controller test-release-cutover test-release-publication test-release-oci-artifacts test-release-parity-manifestmake test-monitor-remote-workflow test-release-sbomsbash .github/scripts/verify-release-build-contract_test.shif: false, andcontinue-on-errorrejections.bash .github/scripts/release-cutover_test.shnode --test .github/scripts/verify-release-manifest_test.mjs .github/scripts/promote-bicep-types_test.mjsgoreleaser checkmarkdownlint-cli2 --config .github/linters/.markdownlint-cli2.yamlon the runbook and design notecspell --config .github/linters/.cspell.ymlon the runbook and design noteshellcheckon changed shell scriptsgit diff --checkChanged YAML/JavaScript passed the repository Prettier configuration. Actionlint passed with only its unsupported
queuekey excluded; that key is supported by GitHub and already used by the release workflows.No live release, registry publication, cloud deployment, or cross-version installation rehearsal was performed. Those remain the operator rollout gate described in the runbook; a green local fixture suite is not production sign-off.
File change summary
.github/scripts/promote-bicep-types.mjs.github/scripts/promote-bicep-types_test.mjs.github/scripts/release-assets_test.mjs.github/scripts/release-controller_test.sh.github/scripts/release-cutover_test.sh.github/scripts/release-oci-artifacts.sh.github/scripts/release-oci-artifacts_test.sh.github/scripts/release-parity-manifest.sh.github/scripts/release-parity-manifest_test.sh.github/scripts/validate-release-controller-plan.sh.github/scripts/validate-release-controller-plan_test.sh.github/scripts/verify-release-build-contract.sh.github/scripts/verify-release-build-contract_test.sh.github/scripts/verify-release-manifest.mjs.github/scripts/verify-release-manifest_test.mjs.github/scripts/verify-release-publication.sh.github/workflows/__build-bicep-types.yaml.github/workflows/__build-helm-chart.yaml.github/workflows/__release-controller.yaml.github/workflows/build-release.yaml.github/workflows/publish-de-image.yamlbuild/build.mkbuild/test.mkdocs/contributing/contributing-releases/README.mdeng/design-notes/tools/2026-03-goreleaser-release-lifecycle.mdeng/design-notes/tools/2026-03-goreleaser-release-lifecycle-implementation-plan.mdeng/design-notes/tools/2026-09-goreleaser-stack-review/(20 Markdown files)