build(refactor-release): shadow GoReleaser releases on tags - #12760
Draft
DariuszPorowski wants to merge 1 commit into
Draft
build(refactor-release): shadow GoReleaser releases on tags#12760DariuszPorowski wants to merge 1 commit into
DariuszPorowski wants to merge 1 commit into
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
DariuszPorowski
force-pushed
the
dp/goreleaser-shadow-release
branch
from
August 21, 2026 00:18
26a32d8 to
368b661
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Adds advisory GoReleaser shadow releases, digest capture, and parity verification while retaining the existing production release path.
Changes:
- Parameterizes GoReleaser publishing and release creation.
- Adds shadow workflows, verification scripts, tests, and Make targets.
- Documents the migration workflow.
- Failed parity runs currently do not produce the promised machine-readable report.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Summary |
|---|---|
docs/contributing/contributing-releases/README.md |
Documents advisory migration jobs. |
build/test.mk |
Includes new verification tests. |
build/artifacts.mk |
Adds shadow and digest targets. |
.goreleaser.yaml |
Parameterizes registries and SCM release behavior. |
.github/workflows/build-release.yaml |
Adds advisory shadow, digest, and parity jobs. |
.github/scripts/verify-goreleaser-snapshot.sh |
Validates the parameterized GoReleaser configuration. |
.github/scripts/verify-goreleaser-shadow.sh |
Verifies CLI and image parity; failed runs lack reports. |
.github/scripts/verify-goreleaser-shadow_test.sh |
Tests parity verification behavior. |
.github/scripts/image-payload-manifest.py |
Produces image payload manifests. |
.github/scripts/capture-release-image-digests.sh |
Captures immutable production image digests. |
.github/scripts/capture-release-image-digests_test.sh |
Tests digest capture. |
Suppressed comments (4)
.github/scripts/verify-goreleaser-shadow.sh:565
- These prefixes restrict the comparison to the Radius binary (and UCPD manifests), so
imageRuntimeFilesystem: "match"does not mean the per-platform filesystem matches: an extra runtime file or a different base-layer/package file is invisible. The Dockerfile text check only compares instructions and cannot prove the resolved base/image contents. Compare the exported filesystem, or make the excluded base-layer difference explicit in the parity contract and report.
printf '%s\n' "${name}"
if [[ "${name}" == "ucpd" ]]; then
printf '%s\n' "manifest"
fi
.github/scripts/verify-goreleaser-shadow.sh:505
- This projection intentionally discards
digest,size, andannotationsfrom unknown-platform descriptors, so a changed auxiliary manifest payload can pass as equal when its mediaType/platform/type stay constant. The baseline generator preserves those fields (.github/scripts/release-parity-manifest.sh:420-427); retain and compare them in both baseline and current projections before reporting auxiliary parity.
| select(.platform.os == "unknown")
| {
mediaType,
platform: platform_name(.platform),
type: (.annotations[
.github/scripts/verify-goreleaser-shadow.sh:704
normalize_imagepreserves each root manifest'smediaType, but this verification never compares it; only platforms, per-platform config, and auxiliary metadata are checked. An OCI index and a Docker manifest list could therefore be reported as parity despite different top-level image contracts. Compare the two normalized media types before continuing.
assert_json_equal "${shadow_config}" "${production_config}" \
"runtime image configuration for ${name}"
.github/workflows/build-release.yaml:347
- When
verify-goreleaser-shadow.shfinds a mismatch,failexits beforewrite_report, so thisalways()upload has no file—the only run where a machine-readable report is needed—andif-no-files-found: warnleaves only log text. Emit a failure report (for example, from an exit trap) or otherwise generate it before returning so advisory mismatches remain downloadable as documented.
if: always()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: goreleaser-shadow-parity-${{ github.sha }}
path: dist/goreleaser-shadow-parity.json
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| verify_contract "${baseline}" | ||
| verify_cli_artifacts "${cli_entries}" "${baseline}" | ||
| verify_images "${image_entries}" "${baseline}" | ||
| write_report "${baseline}" "${cli_entries}" "${image_entries}" |
Unit Tests 2 files 461 suites 8m 27s ⏱️ Results for commit 4c6612d. ♻️ This comment has been updated with latest results. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dp/edge-tags-deprecation #12760 +/- ##
===========================================================
Coverage ? 59.82%
===========================================================
Files ? 779
Lines ? 46058
Branches ? 0
===========================================================
Hits ? 27556
Misses ? 18502
Partials ? 0 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Functional Tests - upgrade-noncloud1 tests 0 ✅ 5m 7s ⏱️ For more details on these failures, see this check. Results for commit 4c6612d. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/goreleaser-shadow-release
branch
from
August 21, 2026 02:24
368b661 to
1f53cf6
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-shadow-release
branch
from
August 21, 2026 02:50
1f53cf6 to
8b90c54
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-shadow-release
branch
from
August 21, 2026 03:31
8b90c54 to
b4db810
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-shadow-release
branch
from
August 21, 2026 16:39
b4db810 to
3d96ff3
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-shadow-release
branch
from
August 24, 2026 15:25
3d96ff3 to
dc08516
Compare
This was referenced Aug 24, 2026
3 tasks
DariuszPorowski
marked this pull request as draft
August 28, 2026 16:00
DariuszPorowski
force-pushed
the
dp/goreleaser-shadow-release
branch
from
August 28, 2026 16:36
dc08516 to
22929e1
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-shadow-release
branch
from
August 28, 2026 16:54
22929e1 to
6fbc377
Compare
DariuszPorowski
changed the title
Run the canonical GoReleaser configuration beside the current tag release, publish candidate images only to the dev namespace, and suppress SCM release creation. Compare same-run CLI binaries and digest-locked image outputs across every platform, retaining an explicit parity report without affecting production release status. Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
DariuszPorowski
force-pushed
the
dp/goreleaser-shadow-release
branch
from
September 3, 2026 16:22
6fbc377 to
4c6612d
Compare
Functional Tests - corerp-noncloud190 tests 186 ✅ 1h 16m 12s ⏱️ For more details on these failures, see this check. Results for commit 4c6612d. |
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Run the canonical GoReleaser configuration beside the existing
v*tag release path without changing production authority:ghcr.io/radius-project/dev/${IMAGE}:${REL_VERSION}The shadow, digest-capture, and parity jobs are advisory (
continue-on-error) and are not included in the production build gate or summary.Reason for change
PR 7 of the GoReleaser release-lifecycle migration needs real tag builds to exercise GoReleaser against the production publisher for a complete RC-plus-final cycle before cutover. This exposes unexplained parity differences while the current release path remains authoritative and rollback is simply removal of the advisory jobs.
How to test
goreleaser checkmake test-capture-release-image-digests test-goreleaser-shadowmake goreleaser-snapshot GORELEASER_ARGS=--skip=dockermake build-rad-linux-amd64followed by byte comparison withdist/goreleaser/rad_linux_amd64_v1/radactionlint .github/workflows/build-release.yamlghalint runscoped tobuild-release.yamlzizmor --pedantic .github/workflows/build-release.yamlshellcheckandshfmt -dover the changed Bash scriptsLocal results: the complete GoReleaser snapshot built 21 targets and passed its parity verifier in 7m36s; the production and GoReleaser Linux amd64 CLI binaries had the identical SHA-256 digest
eee31e09e5889c42d320d613978c464aa412f3cb5f5a9b4cdbf881303c4e6ef6.The remaining exit criterion is observational: after merge, one full RC-plus-final cycle must complete with no unexplained parity differences.
File change summary
.goreleaser.yaml.github/workflows/build-release.yaml.github/scripts/verify-goreleaser-shadow*.sh.github/scripts/capture-release-image-digests*.sh.github/scripts/verify-goreleaser-snapshot.shbuild/artifacts.mk,build/test.mkdocs/contributing/contributing-releases/README.md