Harden and simplify the release workflow (#4908)

thardeck · web-flow · commit bbfea7657f58 · 2026-03-31T15:40:18.000+02:00
* Always use the Go version specified in the go.mod

so the release is always built with the exact Go version specified in
go.mod.

* Drop packages:write permission

No images are pushed to GitHub Container Registry (ghcr.io).

* Get rid of Fossa scan during release

it is already executed for every relevant push action.

* Prepare Docker environment step should be obsolete

with GoReleaser Docker v2 engine.

* Improve release.yml readability

* Prepare GoReleaser for immutable releases

by using a draft gh release until the last step.

* Pin GoReleaser version to v2.14.3

* Pin tonistiigi/binfmt to a specific version

docker/setup-qemu-action defaults to tonistiigi/binfmt:latest, which
is a floating Docker Hub tag regardless of the action being SHA-pinned.
Pin to an explicit version tag and digest to prevent an attacker from
pushing a new :latest image between runs.

* Get rid of the manual release trigger

because it does not make sense with immutable releases. We have to use
forks to not pollute the repo with immutable testing tags.

* Replace in-release tests with CI check on tagged commit

Instead of re-running unit and integration tests inside the release
workflow, query the CI workflow result for the pr of the commit the
tag points to.

Hotfix commits are pushed directly to a branch without a PR.
When no merged PR is found for the tagged commit, verify the
CI workflow runs on that commit instead.

Hotfix branches follow the pattern *-hotfix-*. CI must run
on push so that the release workflow can verify the commit.

Release branches require PRs, making the push trigger there
redundant, so getting rid of it.

Reading PR and Commit CI results requires permissions pull-requests and
checks.

* Skip known-hosts check on push events

GITHUB_BASE_REF is empty on push events; the script exits
with a usage error. The known-hosts check is only meaningful
in a PR context where a base branch is defined. Also quote
the variable to satisfy shellcheck SC2086.

* Remove Rancher code freeze verification in release workflow

because we should be still able to release and if required, it should
be done inside of the release-against-rancher action.
diff --git a/.github/workflows/check-changes.yml b/.github/workflows/check-changes.yml
@@ -2,6 +2,9 @@ name: Check for unallowed changes
 
 on:
   pull_request:
+  push:
+    branches:
+    - '*-hotfix-*'
 
 env:
   MAIN_BRANCH: origin/main
@@ -33,4 +36,5 @@ jobs:
         run: ./.github/scripts/check-for-auto-generated-changes.sh
       -
         name: known-hosts
-        run: ./.github/scripts/check-for-known-hosts-changes.sh $GITHUB_BASE_REF
+        if: github.event_name == 'pull_request'
+        run: ./.github/scripts/check-for-known-hosts-changes.sh "$GITHUB_BASE_REF"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
   push:
     branches:
-    - 'release/*'
+    - '*-hotfix-*'
 
 env:
   GOARCH: amd64
diff --git a/.github/workflows/e2e-ci.yml b/.github/workflows/e2e-ci.yml
@@ -5,7 +5,7 @@ on:
   pull_request:
   push:
     branches:
-    - 'release/*'
+    - '*-hotfix-*'
 
 env:
   GOARCH: amd64
diff --git a/.github/workflows/e2e-multicluster-ci.yml b/.github/workflows/e2e-multicluster-ci.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
   push:
     branches:
-    - 'release/*'
+    - '*-hotfix-*'
 
 env:
   GOARCH: amd64
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -5,27 +5,17 @@ on:
   push:
     tags:
       - v**
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to release (e.g., v0.15.0-alpha.7)'
-        required: true
-        type: string
-      skip_tests:
-        description: 'Skip tests (for faster testing of release process)'
-        required: false
-        type: boolean
-        default: false
 
 permissions:
   contents: write
-  packages: write
   id-token: write # this is important, it's how we authenticate with Vault
+  pull-requests: read
+  checks: read
 
 env:
   GOARCH: amd64
   CGO_ENABLED: 0
-  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+  RELEASE_TAG: ${{ github.ref_name }}
 
 jobs:
   build-fleet:
@@ -41,99 +31,56 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Verify Rancher is not in code freeze (alpha/beta only)
+      - name: Verify CI passed on tagged commit
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          set -x
-          FLEET_VERSION="${RELEASE_TAG#v}"
-
-          if [[ ! "${FLEET_VERSION}" =~ (alpha|beta) ]]; then
-            echo "Skipping code freeze check for non-alpha/beta release"
-            exit 0
-          fi
-
-          FLEET_MINOR=$(echo "${FLEET_VERSION}" | cut -d'.' -f2)
-          RANCHER_VERSION="2.$((FLEET_MINOR - 1))"
-
-          if ! DOCKERFILE_CONTENT=$(curl -sf "https://raw.githubusercontent.com/rancher/rancher/release/v${RANCHER_VERSION}/package/Dockerfile"); then
-            echo "Release branch release/v${RANCHER_VERSION} not found, assuming main branch which can not be in code freeze"
-            exit 0
-          fi
-          CHART_DEFAULT_BRANCH=$(echo "${DOCKERFILE_CONTENT}" | grep "ARG CHART_DEFAULT_BRANCH=" | cut -d'=' -f2)
-
-          if [[ "${CHART_DEFAULT_BRANCH}" != "dev-v${RANCHER_VERSION}" ]]; then
-            echo "ERROR: CHART_DEFAULT_BRANCH does not match the expected dev branch!"
-            exit 1
-          fi
+          set -euo pipefail
+          COMMIT_SHA=$(git rev-list -n 1 "$RELEASE_TAG")
+          echo "Verifying CI checks for ${RELEASE_TAG} (${COMMIT_SHA})"
+
+          PR_NUMBER=$(gh api \
+            "repos/${{ github.repository }}/commits/${COMMIT_SHA}/pulls" \
+            --jq '[.[] | select(.merged_at != null)] | first | .number // empty')
+
+          if [[ -n "${PR_NUMBER:-}" ]]; then
+            echo "Found PR #${PR_NUMBER}, verifying required checks..."
+            gh pr checks "${PR_NUMBER}" \
+              --repo "${{ github.repository }}" \
+              --required
+          else
+            echo "No merged PR found (hotfix), verifying all commit checks..."
+            ISSUES=$(gh api \
+              "repos/${{ github.repository }}/commits/${COMMIT_SHA}/check-runs" \
+              --jq 'if .total_count == 0 then "no CI checks found" else ([.check_runs[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped")) | .name] | join(", ")) end')
 
-          LATEST_RANCHER_RELEASE=$(curl -sf "https://api.github.com/repos/rancher/rancher/releases" | jq -r "[.[] | select(.tag_name | startswith(\"v${RANCHER_VERSION}.\"))] | first | .tag_name")
-          if [ -z "${LATEST_RANCHER_RELEASE}" ]; then
-            echo "No Rancher ${RANCHER_VERSION}.x release found, assuming pre-release state"
-            exit 0
-          fi
+            if [[ -n "${ISSUES}" ]]; then
+              echo "ERROR: ${ISSUES}"
+              exit 1
+            fi
 
-          if [[ "${LATEST_RANCHER_RELEASE}" =~ -rc ]]; then
-            echo "ERROR: Latest Rancher ${RANCHER_VERSION}.x release is an RC (${LATEST_RANCHER_RELEASE}), indicating code freeze!"
-            exit 1
+            echo "✓ All checks passed for ${RELEASE_TAG} (${COMMIT_SHA})"
           fi
 
       - name: Set up Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: 'go.mod'
-          check-latest: true
-
-      - name: "Read Vault Secrets"
-        uses: rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6 # v3
-        with:
-          secrets: |
-            secret/data/github/repo/${{ github.repository }}/fossa/credential token | FOSSA_API_KEY
-
-      - name: Run FOSSA scan
-        if: ${{ !inputs.skip_tests }}
-        uses: fossas/fossa-action@c414b9ad82eaad041e47a7cf62a4f02411f427a0 # v1.8.0
-        with:
-          api-key: ${{ env.FOSSA_API_KEY }}
-
-      - name: Run FOSSA tests
-        if: ${{ !inputs.skip_tests }}
-        uses: fossas/fossa-action@c414b9ad82eaad041e47a7cf62a4f02411f427a0 # v1.8.0
-        with:
-          api-key: ${{ env.FOSSA_API_KEY }}
-          run-tests: false
-
-      - name: Install Ginkgo CLI
-        if: ${{ !inputs.skip_tests }}
-        run: go install github.com/onsi/ginkgo/v2/ginkgo
-
-      - name: Check for code changes
-        if: ${{ !inputs.skip_tests }}
-        continue-on-error: ${{ contains(github.ref, 'rc') }}
-        run: |
-          ./.github/scripts/check-for-auto-generated-changes.sh
-          go mod verify
-
-      - name: Run unit tests
-        if: ${{ !inputs.skip_tests }}
-        continue-on-error: ${{ contains(github.ref, 'rc') }}
-        run: go list ./... | grep -v -e /e2e -e /integrationtests -e /benchmarks | xargs go test -cover -tags=test
-
-      - name: Run integration tests
-        if: ${{ !inputs.skip_tests }}
-        continue-on-error: ${{ contains(github.ref, 'rc') }}
-        env:
-          SETUP_ENVTEST_VER: v0.0.0-20250218120612-6f6111124902
-          ENVTEST_K8S_VERSION: 1.35
-        run: ./.github/scripts/run-integration-tests.sh
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        with:
+          # renovate: datasource=docker depName=tonistiigi/binfmt extractVersion=^qemu-v(?<version>.+)$
+          image: tonistiigi/binfmt:qemu-v10.2.1-65@sha256:d3b963f787999e6c0219a48dba02978769286ff61a5f4d26245cb6a6e5567ea3
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
-      - uses: rancherlabs/slsactl/actions/install-slsactl@3dc09f73d4b3a03fbb87eff19ed0262c231d8757 # v0.1.22
+
+      - name: Install Slsactl
+        uses: rancherlabs/slsactl/actions/install-slsactl@3dc09f73d4b3a03fbb87eff19ed0262c231d8757 # v0.1.22
         with:
           version: v0.1.22
 
@@ -148,11 +95,6 @@ jobs:
             secret/data/github/repo/${{ github.repository }}/rancher-prime-stg-registry/credentials registry | STAGE_REGISTRY ;
             secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
 
-      - name: Prepare Docker environment to support sbom/provenance parameters
-        run: |
-          sudo bash -c 'echo "{\"features\": {\"containerd-snapshotter\": true}}" > /etc/docker/daemon.json'
-          sudo systemctl restart docker
-
       - name: Log into Docker Container registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         if: ${{ env.IS_HOTFIX == 'false' }}
@@ -172,8 +114,8 @@ jobs:
         id: goreleaser
         with:
           distribution: goreleaser
-          version: '~> v2'
-          args: release --clean --verbose
+          version: v2.14.3
+          args: release --clean --draft --verbose
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GORELEASER_CURRENT_TAG: ${{ env.RELEASE_TAG }}
@@ -317,3 +259,9 @@ jobs:
 
           git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git"
           git push origin "$charts_branch"
+
+      - name: Publish Release
+        if: ${{ env.IS_HOTFIX == 'false' }}
+        run: gh release edit "${RELEASE_TAG}" --draft=false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
