chore: Enhance cli release workflow by morri-son · Pull Request #1755 · open-component-model/open-component-model

morri-son · 2026-02-10T21:12:59Z

What this PR does / why we need it

Implements a unified CLI release workflow with environment-gated promotion. RC and final release happen in a single workflow run, separated by a 14-day wait timer and required approval.

Key Changes

Single Workflow Run: RC creation and final promotion in one execution
Environment Gate: cli/release environment with 14-day wait + reviewer approval
Simplified Attestations: Direct verification via gh attestation verify (no bundle exports)
Consistent Changelogs: git-cliff for RC, copy body to final release notes
Central JS script release-versioning.js and unit tests for all release related versioning calculations

Documentation

See RELEASE_PROCESS.md for the complete release manager guide.

Skarlso · 2026-02-13T11:45:08Z

Make sure to run these from time to time because:

➜ node export-attestations.test.js
file:///Users/skarlso/goprojects/sap/open-component-model/.github/scripts/export-attestations.test.js:9
import { parsePatterns, findAssets, bundleNameForAsset, sha256File } from "./export-attestations.js";
                                    ^^^^^^^^^^^^^^^^^^
SyntaxError: The requested module './export-attestations.js' does not provide an export named 'bundleNameForAsset'
    at #asyncInstantiate (node:internal/modules/esm/module_job:302:21)
    at async ModuleJob.run (node:internal/modules/esm/module_job:405:5)
    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:654:26)
    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:101:5)

Node.js v25.2.1

matthiasbruns · 2026-02-13T13:36:27Z

I have created a doc along the multiple changes. WDYT? Is it useful to place it along the workflow files or under .github/docs ?

technical-deep-dive-github-release-workflows.md

I would - do it in this PR that we can review it as well :)

Skarlso · 2026-02-16T08:58:16Z

So, I'm not sure how this is working, but there are several errors in the Javascripts... For example, once again, if I'm trying to run the test I'm getting import errors because certain things aren't exported:

➜ node export-attestations.test.js
file:///Users/skarlso/goprojects/sap/open-component-model/.github/scripts/export-attestations.test.js:9
import { parsePatterns, findAssets, bundleNameForAsset, sha256File } from "./export-attestations.js";
                                    ^^^^^^^^^^^^^^^^^^
SyntaxError: The requested module './export-attestations.js' does not provide an export named 'bundleNameForAsset'
    at #asyncInstantiate (node:internal/modules/esm/module_job:302:21)
    at async ModuleJob.run (node:internal/modules/esm/module_job:405:5)
    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:654:26)
    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:101:5)

Node.js v25.2.1

bundleNameForAsset is a private function (no export keyword) in export-attestations.js
parsePatterns, findAssets, and sha256File are defined in attestation-utils.js and only imported by
export-attestations.js — they're not re-exported
IMAGE_TAG is not checked. It could be empty, then things break.
IMAGE_REF is never actually used.

I took a look at the attestation, I think we have a problem I didn't think about. The Attestation you download then upload if I understand correctly. This means you download it from the RC and the attestation will contain things like v2.0.0-rc which will be confusing for any consumer. Could you check that please to make sure the attestation is actually for the latest release and not the RC?

Skarlso · 2026-02-16T09:37:49Z

Here are some more things we'll discuss:

validate_final is just a test, this shouldn't be an entire separate job, it's a step. it's comparing two strings.
You are passing around the changelog base64 between jobs is fragile and hits GitHub's ~1MB output limit on large changelogs
There are too many javascript files right now. We have 9 JS files to maintain for what is
essentially: "find latest tag, bump number, download/verify attestations." The version computation could be a 20-lines. The attestation export/verify wraps gh attestation download/verify with file renaming. This definitely needs to be smaller. I like that we are testing everything, but still.
compute-rc-version.js switch/case with fall-through — The version computation logic (lines 125–158) uses switch(true) with intentional fall-through between cases. That's a footgun waiting to fire.
cancel-in-progress: true. Are we sure this is really what we want?
If tag_final succeeds but promote_image or release_final fails, you have an orphaned final tag with no release. We don't have anything in place to clean this up.
There is a lot of duplication going on in here. Especially around the attestation and the test files.
export-attestations.js and verify-attestations.js both import parsePatterns and findAssets from different places. The export test imports them from export-attestations.js, the verify test imports them from
verify-attestations.js but they live in attestation-utils.js.

Actually, verify-attestations.js imports from ./attestation-utils.js but the test file imports parsePatterns, findAssets, and sha256File from ./verify-attestations.js which doesn't re-export them. Probably that's why the test is broken?
Both test files duplicate the exact same parsePatterns and findAssets test cases. That's test code you maintain twice.

Not sure what's going on there. :D
9. Export and verify could be one thing. They are one thing after all. :)
10. resolve-latest-rc.js and compute-rc-version.js. I really really feel these are doing the same thing. It's super difficult to explain why both exist. 🤔

And that's about it.

morri-son · 2026-02-16T11:30:02Z

@Skarlso, thx for the feedback! I'll look into all of it. Also discussed with @jakobmoellerdev about soley relying on GH's attestation endpoint and API, so I will remove all attestation download, persist as asset, use that for verify. Will also check where to merge existing scripts.

One thing I need to add is a gate after the RC, so that promote needs a 4-eyes-principle.

Skarlso

Overall, I think this is now pretty okay.

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

Skarlso

Let's try this out then. :)

…nor releases. Keep v0.X in examples. On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

Co-authored-by: Frederic Wilhelm <fre.wilhelm@gmail.com> Signed-off-by: Gerald Morrison <67469729+morri-son@users.noreply.github.com>

…nent-model into enhance-cli-release On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

frewilhelm

Let's get this merged :)

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>  #### What this PR does / why we need it This PR improves the existing workflow that builds, tests and publishes the OCM controller and introduces a new workflow that creates releases for the controller. **build workflow:** - add on workflow_call trigger to be able to call from release workflow - remove duplicate build in different steps and replace with buidling just one multi-arch image and extract and reformat single-arch image for later use in e2e (`kind load`). Since ORAS cannot handle the correct format, skopeo is used for exactly that purpose. All other steps keep using ORAS. - Attestate all published artifacts - add floating tag "main" on push to main - Pushes to branches `releases/v*' don't publish images/charts, but only do E2E tests - Trigger "workflow_dispatch" that allows to publish/charts if OCI tests are required **release workflow:** - Align with release workflow for cli as much as possible (#1755) - Call build workflow (build, e2e) - build and publish docker image only once and promote from RC to final release - Repackage and re-attest Helm Chart for Final release - add floating tags - "latest" for highest release (including pre-releases) - "stable" for highest final release  ## Summary by CodeRabbit * **New Features** * Introduced a two-phase release process (Release Candidate and Final Release) with automated tag management, artifact promotion, and provenance attestation. * Added OCI image digest support to Helm charts for enhanced image reference flexibility. * Implemented automated changelog generation and release notes publishing. * **Chores** * Updated default controller image versions from "latest" to "0.0.0-main". * Expanded build and release workflows with multi-stage architecture including build, testing, publishing, and conformance stages.  --------- Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com> Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>  #### What this PR does / why we need it This PR improves the existing workflow that builds, tests and publishes the OCM controller and introduces a new workflow that creates releases for the controller. **build workflow:** - add on workflow_call trigger to be able to call from release workflow - remove duplicate build in different steps and replace with buidling just one multi-arch image and extract and reformat single-arch image for later use in e2e (`kind load`). Since ORAS cannot handle the correct format, skopeo is used for exactly that purpose. All other steps keep using ORAS. - Attestate all published artifacts - add floating tag "main" on push to main - Pushes to branches `releases/v*' don't publish images/charts, but only do E2E tests - Trigger "workflow_dispatch" that allows to publish/charts if OCI tests are required **release workflow:** - Align with release workflow for cli as much as possible (open-component-model#1755) - Call build workflow (build, e2e) - build and publish docker image only once and promote from RC to final release - Repackage and re-attest Helm Chart for Final release - add floating tags - "latest" for highest release (including pre-releases) - "stable" for highest final release  ## Summary by CodeRabbit * **New Features** * Introduced a two-phase release process (Release Candidate and Final Release) with automated tag management, artifact promotion, and provenance attestation. * Added OCI image digest support to Helm charts for enhanced image reference flexibility. * Implemented automated changelog generation and release notes publishing. * **Chores** * Updated default controller image versions from "latest" to "0.0.0-main". * Expanded build and release workflows with multi-stage architecture including build, testing, publishing, and conformance stages.  --------- Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com> Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>  #### What this PR does / why we need it This PR improves the existing workflow that builds, tests and publishes the OCM controller and introduces a new workflow that creates releases for the controller. **build workflow:** - add on workflow_call trigger to be able to call from release workflow - remove duplicate build in different steps and replace with buidling just one multi-arch image and extract and reformat single-arch image for later use in e2e (`kind load`). Since ORAS cannot handle the correct format, skopeo is used for exactly that purpose. All other steps keep using ORAS. - Attestate all published artifacts - add floating tag "main" on push to main - Pushes to branches `releases/v*' don't publish images/charts, but only do E2E tests - Trigger "workflow_dispatch" that allows to publish/charts if OCI tests are required **release workflow:** - Align with release workflow for cli as much as possible (open-component-model#1755) - Call build workflow (build, e2e) - build and publish docker image only once and promote from RC to final release - Repackage and re-attest Helm Chart for Final release - add floating tags - "latest" for highest release (including pre-releases) - "stable" for highest final release  ## Summary by CodeRabbit * **New Features** * Introduced a two-phase release process (Release Candidate and Final Release) with automated tag management, artifact promotion, and provenance attestation. * Added OCI image digest support to Helm charts for enhanced image reference flexibility. * Implemented automated changelog generation and release notes publishing. * **Chores** * Updated default controller image versions from "latest" to "0.0.0-main". * Expanded build and release workflows with multi-stage architecture including build, testing, publishing, and conformance stages.  --------- Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com> Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

morri-son added the kind/chore chore, maintenance, etc. label Feb 10, 2026

github-actions Bot added component/github-actions Changes on GitHub Actions or within `.github/` directory size/m Medium size/l Large labels Feb 10, 2026

morri-son closed this Feb 11, 2026

morri-son deleted the enhance-cli-release branch February 11, 2026 16:47

morri-son restored the enhance-cli-release branch February 11, 2026 17:07

morri-son reopened this Feb 11, 2026

morri-son force-pushed the enhance-cli-release branch from e5ee22f to d573e21 Compare February 11, 2026 20:52

morri-son linked an issue Feb 12, 2026 that may be closed by this pull request

Create GitHub action for release process for CLI open-component-model/ocm-project#852

Closed

6 tasks

morri-son force-pushed the enhance-cli-release branch from d573e21 to b783d94 Compare February 12, 2026 11:44

morri-son force-pushed the enhance-cli-release branch 5 times, most recently from 57fa398 to ec58bc3 Compare February 13, 2026 12:55

morri-son marked this pull request as ready for review February 13, 2026 12:57

morri-son requested a review from a team as a code owner February 13, 2026 12:57

morri-son force-pushed the enhance-cli-release branch from b58cbb0 to 40b8488 Compare February 13, 2026 14:02

Skarlso reviewed Feb 16, 2026

View reviewed changes

Comment thread .github/scripts/resolve-latest-rc.js Outdated

Skarlso mentioned this pull request Feb 16, 2026

chore(docs): Add doc for release process #1763

Closed

morri-son linked an issue Feb 16, 2026 that may be closed by this pull request

Create Documentation for new Release process open-component-model/ocm-project#853

Closed

2 tasks

morri-son force-pushed the enhance-cli-release branch from dca554f to aa87f18 Compare February 16, 2026 14:26

Skarlso requested changes Feb 16, 2026

View reviewed changes

Comment thread .github/workflows/cli-release.yml

morri-son requested a review from Skarlso February 16, 2026 16:08

Skarlso reviewed Feb 24, 2026

View reviewed changes

morri-son requested review from Skarlso and matthiasbruns February 24, 2026 12:51

piotrjanik reviewed Feb 24, 2026

View reviewed changes

Comment thread .github/scripts/release-versioning.js Outdated

Comment thread .github/scripts/release-versioning.js

morrison-sap and others added 3 commits February 24, 2026 16:02

break in case releases are empty

dd96d1f

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

correct artifact names and remove component name

66908a6

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

Merge branch 'main' into enhance-cli-release

df09340

Skarlso previously approved these changes Feb 25, 2026

View reviewed changes

Merge branch 'main' into enhance-cli-release

97bb2e0

piotrjanik previously approved these changes Feb 25, 2026

View reviewed changes

Merge branch 'main' into enhance-cli-release

2fd14ca

frewilhelm reviewed Feb 26, 2026

View reviewed changes

morrison-sap and others added 2 commits February 26, 2026 09:56

use X.Z as general version scheme, mention that we start with only mi…

60d9fdd

…nor releases. Keep v0.X in examples. On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

Update RELEASE_PROCESS.md

d03a5e3

Co-authored-by: Frederic Wilhelm <fre.wilhelm@gmail.com> Signed-off-by: Gerald Morrison <67469729+morri-son@users.noreply.github.com>

morri-son dismissed stale reviews from Skarlso and piotrjanik via d03a5e3 February 26, 2026 13:54

morri-son and others added 4 commits February 26, 2026 14:57

Update RELEASE_PROCESS.md

94c26db

Co-authored-by: Frederic Wilhelm <fre.wilhelm@gmail.com> Signed-off-by: Gerald Morrison <67469729+morri-son@users.noreply.github.com>

Merge branch 'enhance-cli-release' of github.com:morri-son/open-compo…

6a77736

…nent-model into enhance-cli-release On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

intergrate feedback

8650524

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

integrate feedback

931596f

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

Skarlso approved these changes Feb 27, 2026

View reviewed changes

frewilhelm approved these changes Feb 27, 2026

View reviewed changes

Merge branch 'main' into enhance-cli-release

333df51

jakobmoellerdev enabled auto-merge (squash) February 27, 2026 12:17

jakobmoellerdev merged commit ef97eee into open-component-model:main Feb 27, 2026
19 checks passed

morri-son deleted the enhance-cli-release branch February 27, 2026 12:56

morri-son mentioned this pull request Mar 5, 2026

chore: Workflow for controller release #1900

Merged

Conversation

morri-son commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it

Key Changes

Documentation

Uh oh!

Skarlso commented Feb 13, 2026

Uh oh!

matthiasbruns commented Feb 13, 2026

Uh oh!

Skarlso commented Feb 16, 2026

Uh oh!

Uh oh!

Skarlso commented Feb 16, 2026

Uh oh!

morri-son commented Feb 16, 2026

Uh oh!

Uh oh!

Skarlso left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Skarlso left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

frewilhelm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

morri-son commented Feb 10, 2026 •

edited

Loading