ci(refactor-release): cut tag releases over to GoReleaser by DariuszPorowski · Pull Request #12828 · radius-project/radius

DariuszPorowski · 2026-08-26T04:02:27Z

Summary

Cut tag-triggered releases over to GoReleaser for CLI binaries, checksums, production Go images, and draft GitHub Release staging. Keep Helm, Bicep types, and retained non-Go/test images as gated stages, then promote mutable channel and latest aliases only from verified immutable outputs after every mandatory stage succeeds.

Make the release transaction resumable with source-bound draft locks, query-before-mutate reconciliation, bounded retries, complete-set image adoption, and content verification for existing CLI and Helm artifacts. Main builds now publish edge only.

This stacked PR depends on #12823.

Draft gate: Phase 7 has not yet observed the required full RC-plus-final cycle. Keep this PR in draft until that cycle completes with no unexplained parity differences. The first production GoReleaser release and installation verification remain tracked in #12819.

Observe one full RC-plus-final cycle with no unexplained parity differences.

Reason for change

The shadow phase established parity, but the production tag path still uses separate CLI, image, checksum, and release jobs with mutable recovery state. This cutover makes immutable full-version outputs the recovery source of truth and delays mutable aliases and release finalization until the complete publication set is verified.

Fixes #12819

How to test

make test-capture-release-image-digests test-release-cutover test-release-oci-artifacts test-release-parity-manifest test-prepare-release
make goreleaser-snapshot (built and verified all 22 CLI targets)
Validate workflows with actionlint.
Validate shell with ShellCheck and shfmt.
Run Markdown, 80-column, and whitespace checks.

Docker was unavailable locally, so container registry paths are covered by deterministic Docker fixtures. ORAS publication and the GoReleaser snapshot were exercised with the real tools.

File change summary

File	Summary of change
`.github/workflows/build-release.yaml`	Replace legacy tag publication with GoReleaser staging, retained-image and Helm/Bicep gates, digest finalization, alias promotion, and published-state reconciliation.
`.github/workflows/__build-{cli,helm-chart,images}.yaml`	Align reusable build outputs and image behavior with the cutover contract.
`.github/scripts/{ensure-draft-release,publish-draft-release,release-assets}.mjs`	Reconcile source-bound draft releases, lock assets, and final publication through retrying GitHub API operations.
`.github/scripts/{release-oci-artifacts,publish-helm-chart,normalize-release-checksums,capture-release-image-digests}.sh`	Publish and verify immutable OCI/Helm artifacts, normalize split checksums, capture complete image sets, and promote aliases safely.
`.github/scripts/*_test.{sh,mjs}`	Cover reruns, partial/conflicting state, source mismatches, retries, registry ambiguity, checksum normalization, Helm reuse, and workflow contracts.
`.github/scripts/{verify-goreleaser-shadow,verify-goreleaser-shadow_test}.sh`	Remove the superseded shadow-release verifier.
`.github/workflows/__publish-release.yaml`	Remove the superseded legacy GitHub Release publisher.
`.goreleaser.yaml`	Keep GoReleaser releases draft and prevent automatic `latest` mutation.
`build/{artifacts,docker,test}.mk`	Add cutover publication/test targets and remove single-use legacy targets.
`deploy/Chart/README.md`	Align Helm publication guidance with immutable release staging.
`docs/contributing/contributing-releases/README.md`	Document the GoReleaser-owned tag path, resumability model, and alias timing.
`eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-13-goreleaser-tag-cutover.md`	Review note for this layer: what changed in review, why, the value, and the impact

github-actions · 2026-08-28T16:36:54Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

.github/workflows/__publish-release.yaml

github-actions · 2026-08-28T16:37:54Z

Unit Tests

0 tests ±0 0 ✅ ±0 0s ⏱️ ±0s
0 suites ±0 0 💤 ±0
0 files ±0 0 ❌ ±0

Results for commit c41d6c0. ± Comparison against base commit b1295ef.

♻️ This comment has been updated with latest results.

codecov · 2026-08-28T17:13:58Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.79%. Comparing base (ee5e4d5) to head (ce6eb75).

Additional details and impacted files

@@                      Coverage Diff                      @@
##           dp/prepare-release-backports   #12828   +/-   ##
=============================================================
  Coverage                         59.79%   59.79%           
=============================================================
  Files                               777      777           
  Lines                             45906    45906           
=============================================================
  Hits                              27450    27450           
  Misses                            18456    18456

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-08-28T17:14:08Z

Functional Tests - upgrade-noncloud

1 tests 0 ✅ 5m 5s ⏱️
1 suites 0 💤
1 files 1 ❌

For more details on these failures, see this check.

Results for commit c41d6c0.

♻️ This comment has been updated with latest results.

github-actions · 2026-09-03T17:29:52Z

Functional Tests - corerp-noncloud

190 tests 188 ✅ 1h 12m 8s ⏱️
3 suites 2 💤
1 files 0 ❌

Results for commit 158a1a4.

♻️ This comment has been updated with latest results.

github-actions · 2026-09-09T18:43:50Z

Functional Tests - kubernetes-noncloud

17 tests ±0 16 ✅ - 1 14m 14s ⏱️ + 4m 10s
1 suites ±0 0 💤 ±0
1 files ±0 1 ❌ +1

For more details on these failures, see this check.

Results for commit c41d6c0. ± Comparison against base commit b1295ef.

♻️ This comment has been updated with latest results.

github-actions · 2026-09-09T21:35:38Z

Functional Tests - daprrp-noncloud

26 tests ±0 26 ✅ ±0 12m 33s ⏱️ - 1m 21s
1 suites ±0 0 💤 ±0
1 files ±0 0 ❌ ±0

Results for commit 7ec933b. ± Comparison against base commit c62309f.

♻️ This comment has been updated with latest results.

github-actions · 2026-09-11T04:26:37Z

Functional Tests - corerp-cloud

32 tests ±0 31 ✅ ±0 19m 24s ⏱️ - 2m 26s
2 suites ±0 1 💤 ±0
1 files ±0 0 ❌ ±0

Results for commit 03b039a. ± Comparison against base commit f72357b.

♻️ This comment has been updated with latest results.

Replace the tag-path CLI matrix, production image publisher, checksum loop, and GitHub Release job with one GoReleaser staging job. Keep Helm, Bicep types, and retained non-Go/test images as separate gated stages. Publish full-version images and CLI OCI artifacts first, lock their digests and source commit on the draft release, and promote channel and latest aliases only for stable releases after all mandatory stages pass. Main builds now publish edge only. Make every stage resumable: reconcile source-bound draft releases, content-verify existing CLI and Helm artifacts, adopt only complete image sets with matching OCI source labels, retry transient registry and API operations, and reject partial or conflicting immutable state. Remove the superseded shadow comparison and legacy release publisher. Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

capture-release-image-digests.sh rejected any partially published image set, so an interrupted GoReleaser push left the release stuck: every rerun failed on the same partial set, and the unclaimed-tag guard refused to proceed as well. Recovery meant deleting tags from GHCR by hand, which is exactly the half-published release this migration set out to remove. A partial set carries no durable lock, so nothing can have resolved those tags yet and staging may still overwrite them. Report absent, partial, and complete as distinct states, keep the strict all-or-nothing check for the post-staging capture that writes the lock, and run the unclaimed-tag assertion only when nothing exists yet. Require --state-output whenever --allow-absent is set, so tolerated absence is always reported to a caller that acts on it. Name absence confirmation separately from transient failure in the retry log, since a first release confirms every tag missing five times and read as a stack of failures. Make the tag-disappeared diagnostic reachable by propagating the not-found status out of cli_artifact_matches, and stage CLI artifacts through a subshell function so the directory change stays contained and the formatter stops fighting trailing padding. Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

… images Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

radius-functional-tests · 2026-09-17T21:13:19Z

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	`c41d6c0`
Unique ID	func010a1ff66a
Image tag	pr-func010a1ff66a

Dapr: 1.14.4
Azure KeyVault CSI driver: 1.4.2
Azure Workload identity webhook: 1.3.0
Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func010a1ff66a
Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func010a1ff66a
dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func010a1ff66a
controller test image location: ghcr.io/radius-project/dev/controller:pr-func010a1ff66a
ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func010a1ff66a
deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting ucp-cloud functional tests...
⌛ Starting corerp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded

DariuszPorowski mentioned this pull request Aug 26, 2026

Cut tag builds over to GoReleaser #12819

Open

6 tasks

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from ebbd4ee to ce28759 Compare August 26, 2026 04:07

DariuszPorowski self-assigned this Aug 26, 2026

DariuszPorowski added the pr:standard label Aug 26, 2026

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from 67ebbff to e54a4c5 Compare August 28, 2026 16:36

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from e54a4c5 to a8f7de9 Compare August 28, 2026 16:54

This was referenced Aug 28, 2026

feat(refactor-release): publish release SBOMs #12869

Draft

Generate release SBOMs #12818

Open

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from a8f7de9 to 13409c7 Compare August 28, 2026 20:07

DariuszPorowski changed the title ~~ci: cut tag releases over to GoReleaser~~ ci(refactor-release): cut tag releases over to GoReleaser Aug 28, 2026

DariuszPorowski mentioned this pull request Aug 29, 2026

ci(refactor-release): introduce release controller and swap triggers #12872

Draft

2 tasks

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from 13409c7 to cdeb44f Compare September 3, 2026 16:22

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from cdeb44f to 158a1a4 Compare September 9, 2026 17:41

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from 158a1a4 to 81376b7 Compare September 9, 2026 20:47

DariuszPorowski requested a balanced review from Copilot September 10, 2026 03:27

Copilot started reviewing on behalf of DariuszPorowski September 10, 2026 03:28 View session

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from e8540e4 to cbb56e8 Compare September 10, 2026 21:41

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch 2 times, most recently from 0df90df to fc9fe6f Compare September 10, 2026 21:57

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from fc9fe6f to e9aba62 Compare September 10, 2026 22:26

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from e9aba62 to 0f3bdcc Compare September 10, 2026 22:46

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from 0f3bdcc to 7ddfbef Compare September 11, 2026 04:01

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch 2 times, most recently from 1a9c42f to b227028 Compare September 12, 2026 15:51

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from b227028 to ce6eb75 Compare September 15, 2026 22:59

DariuszPorowski added 5 commits September 17, 2026 14:12

fix(ci): prevent release aliases from regressing

2e5f307

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

refactor(ci): remove the obsolete shadow image helper

9ce076c

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

feat(release): enhance GoReleaser verification for reruns with locked…

c41d6c0

… images Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

DariuszPorowski force-pushed the dp/goreleaser-tag-cutover branch from ce6eb75 to c41d6c0 Compare September 17, 2026 21:12

DariuszPorowski removed this pull request from stack #12738 September 17, 2026 21:54

DariuszPorowski added this pull request to stack #13045 September 17, 2026 21:56

Navigation Menu

ci(refactor-release): cut tag releases over to GoReleaser - #12828

ci(refactor-release): cut tag releases over to GoReleaser#12828
DariuszPorowski wants to merge 5 commits into
dp/prepare-release-backportsfrom
dp/goreleaser-tag-cutover

DariuszPorowski commented Aug 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

radius-functional-tests Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

DariuszPorowski commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Reason for change

How to test

File change summary

Uh oh!

github-actions Bot commented Aug 28, 2026

Dependency Review

Scanned Files

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unit Tests

Uh oh!

codecov Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Functional Tests - upgrade-noncloud

Uh oh!

github-actions Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Functional Tests - corerp-noncloud

Uh oh!

github-actions Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Functional Tests - kubernetes-noncloud

Uh oh!

github-actions Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Functional Tests - daprrp-noncloud

Uh oh!

github-actions Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Functional Tests - corerp-cloud

Uh oh!

radius-functional-tests Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Radius functional test overview

Test Status

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

DariuszPorowski commented Aug 26, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

codecov Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Sep 3, 2026 •

edited

Loading

github-actions Bot commented Sep 9, 2026 •

edited

Loading

github-actions Bot commented Sep 9, 2026 •

edited

Loading

github-actions Bot commented Sep 11, 2026 •

edited

Loading

radius-functional-tests Bot commented Sep 17, 2026 •

edited

Loading