Automate the multi-module release with release-all.sh

[tsuzu]

Refs #5866

Summary

• Add releasing/release-all.sh to run the full kyaml → cmd/config → api → kustomize release sequence in one invocation, matching the one-command flow requested in Release automation #5866 (koba1t's follow-up). A release no longer requires 4 sequential PRs for the intermediate pin updates; the whole cycle lives on a single release-vX.Y.Z branch and lands as one "Release vX.Y.Z" PR at the end.
• Rework gorepomod release to require an explicit --release-branch, and share one branch across all four module releases (release-v{major}.{minor}.{patch}) instead of the previous per-module release-{module}-{minor} naming.
• Rewrite releasing/README.md to lead with the scripted flow; the manual step-by-step runbook is preserved under a <details> fallback for major releases or ad-hoc use.
• BREAKING CHANGE: gorepomod release now requires the --release-branch <branch> flag. Manual invocations in releasing/README.md are updated accordingly.

Out of scope of this PR

The umbrella issue #5866 has more steps than this PR covers. Left manual / for follow-up:

• Publish Official Docker Image: still done via the k8s.io PR flow described in releasing/README.md
• Update kustomize-in-kubectl: still done via hack/update-kustomize.sh in kubernetes/kubernetes
• GitHub Actions-driven trigger: this PR delivers the "one script" variant; wiring it into a workflow can follow as a separate change
• Major releases: release-all.sh supports patch|minor only; use the manual flow

Question for reviewers

The release workflow leaves 4 GitHub Releases (kyaml, cmd/config, api, kustomize) in draft state, and the postflight message tells the release engineer to review and undraft them. Would you rather:

• (a) keep the manual undraft as a review gate (current behavior), or
• (b) have release-all.sh also undraft the 4 releases automatically once each workflow completes?

[kubernetes-prow]

This PR has multiple commits, and the default merge method is: merge.
You can request commits to be squashed using the label: tide/merge-method-squash

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[kubernetes-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tsuzu
Once this PR has been reviewed and has the lgtm label, please assign varshaprasad96 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tsuzu]

End-to-end test (with --do-it, on my fork)

I ran the full cycle end-to-end against tsuzu/kustomize and confirmed it drives all four module releases plus the final PR in one invocation. The release completed successfully.

How the run reached the fork

sigs.k8s.io/kustomize resolves via go-import meta redirect to github.com/kubernetes-sigs/kustomize, so gorepomod pin (which invokes go mod tidy) would try to fetch the freshly pushed tag from upstream and fail. I worked around that with a local wrapper (not part of this PR) that, for the duration of the run:

• creates a sandboxed GIT_CONFIG_GLOBAL with url.<my-fork>.insteadOf https://github.com/kubernetes-sigs/kustomize so git operations reach the fork
• exports GOPROXY=direct GOSUMDB=off so go mod bypasses the proxy/sumdb and resolves modules via git directly
• removes the upstream remote so gorepomod's DetermineRemoteToUse picks origin
• puts a fake make on PATH that no-ops verify-kustomize-repo (so the e2e finishes in seconds instead of ~15 min)

In a real release from kubernetes-sigs/kustomize none of this shimming is needed — tags are pushed to the canonical repo and go mod resolves them normally.

Full script output

=== START 2026-07-09T03:44:30+09:00 ===
=== fork: tsuzu/kustomize ===
=== base: master ===
=== bumps: module=patch kustomize=patch ===

[release-all.sh] base branch: master
[release-all.sh] release branch: release-v5.8.7
[release-all.sh] remote: origin
[release-all.sh] GitHub repo: tsuzu/kustomize
[release-all.sh] module bump: patch -> v0.22.5
[release-all.sh] kustomize bump: patch -> v5.8.7
[release-all.sh] + git checkout master
Switched to branch 'master'
Your branch is up to date with 'origin/master'.
[release-all.sh] + git fetch origin master
From https://github.com/tsuzu/kustomize
 * branch                master     -> FETCH_HEAD
[release-all.sh] + git merge --ff-only origin/master
Already up to date.
[release-all.sh] + make IS_LOCAL=true verify-kustomize-repo
(test wrapper) skipping verify-kustomize-repo
[release-all.sh] + go tool gorepomod release kyaml patch --release-branch release-v5.8.7 --doIt --local
Releasing kyaml, stepping from v0.22.4 to v0.22.5
  assuring a clean workspace
    [x] /opt/homebrew/bin/git status
  fetching remote
    [x] /opt/homebrew/bin/git fetch origin
  assuring a clean workspace
    [x] /opt/homebrew/bin/git status
  looking for branch on remote
    [x] /opt/homebrew/bin/git branch -r
  creating branch
    [x] /opt/homebrew/bin/git checkout -B release-v5.8.7 origin/master
  merging from remote
    [x] /opt/homebrew/bin/git merge --ff-only origin/master
  pushing branch to remote
    [x] /opt/homebrew/bin/git push -f origin release-v5.8.7
  creating local release tag
    [x] /opt/homebrew/bin/git tag -a -m "Release kyaml/v0.22.5 on branch release-v5.8.7" kyaml/v0.22.5
  pushing tag to remote
    [x] /opt/homebrew/bin/git push origin kyaml/v0.22.5
[release-all.sh] + go tool gorepomod pin kyaml v0.22.5 --doIt --local
[release-all.sh] + git commit -am Update kyaml to v0.22.5
[release-v5.8.7 6b48e7da0] Update kyaml to v0.22.5
 64 files changed, 96 insertions(+), 96 deletions(-)
[release-all.sh] + git push origin release-v5.8.7
To https://github.com/tsuzu/kustomize.git
   71909da60..6b48e7da0  release-v5.8.7 -> release-v5.8.7
[release-all.sh] + make IS_LOCAL=true verify-kustomize-repo
(test wrapper) skipping verify-kustomize-repo
[release-all.sh] + go tool gorepomod release cmd/config patch --release-branch release-v5.8.7 --doIt --local
Releasing cmd/config, stepping from v0.22.4 to v0.22.5
  assuring a clean workspace
    [x] /opt/homebrew/bin/git status
  fetching remote
    [x] /opt/homebrew/bin/git fetch origin
  assuring a clean workspace
    [x] /opt/homebrew/bin/git status
  looking for branch on remote
    [x] /opt/homebrew/bin/git branch -r
  checking out branch
    [x] /opt/homebrew/bin/git checkout release-v5.8.7
  merging from remote
    [x] /opt/homebrew/bin/git merge --ff-only origin/master
  pushing branch to remote
    [x] /opt/homebrew/bin/git push -f origin release-v5.8.7
  creating local release tag
    [x] /opt/homebrew/bin/git tag -a -m "Release cmd/config/v0.22.5 on branch release-v5.8.7" cmd/config/v0.22.5
  pushing tag to remote
    [x] /opt/homebrew/bin/git push origin cmd/config/v0.22.5
[release-all.sh] + go tool gorepomod pin cmd/config v0.22.5 --doIt --local
[release-all.sh] + git commit -am Update cmd/config to v0.22.5
[release-v5.8.7 cdcbe91f9] Update cmd/config to v0.22.5
 2 files changed, 3 insertions(+), 3 deletions(-)
[release-all.sh] + git push origin release-v5.8.7
To https://github.com/tsuzu/kustomize.git
   6b48e7da0..cdcbe91f9  release-v5.8.7 -> release-v5.8.7
[release-all.sh] + make IS_LOCAL=true verify-kustomize-repo
(test wrapper) skipping verify-kustomize-repo
[release-all.sh] + go tool gorepomod release api patch --release-branch release-v5.8.7 --doIt --local
Releasing api, stepping from v0.22.4 to v0.22.5
  ... (same structure) ...
  pushing tag to remote
    [x] /opt/homebrew/bin/git push origin api/v0.22.5
[release-all.sh] + go tool gorepomod pin api v0.22.5 --doIt --local
[release-all.sh] + git commit -am Update api to v0.22.5
[release-v5.8.7 ec5f51ac0] Update api to v0.22.5
 60 files changed, 90 insertions(+), 90 deletions(-)
[release-all.sh] + git push origin release-v5.8.7
[release-all.sh] + make IS_LOCAL=true verify-kustomize-repo
(test wrapper) skipping verify-kustomize-repo
[release-all.sh] + go tool gorepomod release kustomize patch --release-branch release-v5.8.7 --doIt --local
Releasing kustomize, stepping from v5.8.6 to v5.8.7
  ... (same structure) ...
  pushing tag to remote
    [x] /opt/homebrew/bin/git push origin kustomize/v5.8.7
[release-all.sh] + go tool gorepomod unpin api --doIt --local
[release-all.sh] + go tool gorepomod unpin cmd/config --doIt --local
[release-all.sh] + go tool gorepomod unpin kyaml --doIt --local
[release-all.sh] + sed -i.bak s/LATEST_RELEASE=.*/LATEST_RELEASE=v5.8.7/ Makefile
[release-all.sh] + rm -f Makefile.bak
[release-all.sh] + git commit -am Back to development mode after v5.8.7
[release-v5.8.7 10aff28ef] Back to development mode after v5.8.7
 65 files changed, 127 insertions(+), 127 deletions(-)
[release-all.sh] + git push origin release-v5.8.7
https://github.com/tsuzu/kustomize/pull/8
[release-all.sh] release branch automation completed
[release-all.sh] waiting for release workflow run for kyaml/v0.22.5
[release-all.sh] waiting for release workflow run for cmd/config/v0.22.5
[release-all.sh] waiting for release workflow run for api/v0.22.5
[release-all.sh] waiting for release workflow run for kustomize/v5.8.7

Next steps:
  PR: https://github.com/tsuzu/kustomize/pull/8

  Watch release workflows:
    kyaml/v0.22.5:      https://github.com/tsuzu/kustomize/actions/runs/28967213996
    cmd/config/v0.22.5: https://github.com/tsuzu/kustomize/actions/runs/28967223710
    api/v0.22.5:        https://github.com/tsuzu/kustomize/actions/runs/28967231646
    kustomize/v5.8.7:   https://github.com/tsuzu/kustomize/actions/runs/28967242646

  After the workflows finish, open the releases page and undraft the
  4 drafts (kyaml/v0.22.5, cmd/config/v0.22.5, api/v0.22.5, kustomize/v5.8.7):
    https://github.com/tsuzu/kustomize/releases

=== END 2026-07-09T03:45:27+09:00 rc=0 ===