feat(release): add build & publish to release tool #4308

radTuti · 2025-12-16T21:47:32Z

Description

This adds creating and publishing an operator version. It aligns the process for both a hashrelease operator version and a release operator version. For release operator version, it creates a github release if indicated.

For hashreleases, there is a new enhancement for creating a hashrelease by providing the calico and/or enterprise version in place of the versions file.

For PR reviewers

A note for code reviewers - all pull requests must have the following:

Milestone set according to targeted release.
Appropriate labels:
- kind/bug if this is a bugfix.
- kind/enhancement if this is a a new feature.
- enterprise if this PR applies to Calico Enterprise only.

also adjust how skip validation flag since validation is needed for github token

…poses

+ list images in debug mode

Copilot

Pull request overview

This PR introduces new build and publish commands to the operator release tooling, unifying the workflow for both release and hashrelease operator versions. It adds support for creating hashreleases by directly specifying Calico/Enterprise versions instead of requiring a versions file, and enables automatic GitHub release creation during the publish process.

Key Changes

Added build and publish commands that handle both release and hashrelease workflows with consistent patterns
Enhanced hashrelease creation to accept Calico/Enterprise versions directly via new flags (--calico-version, --enterprise-version, etc.)
Integrated GitHub release creation into the publish workflow with draft/prerelease support

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
`hack/release/build.go`	New build command implementing image building for releases and hashreleases with version/registry configuration
`hack/release/publish.go`	New publish command handling image publishing and optional GitHub release creation
`hack/release/public.go`	New github/public command for creating or updating GitHub releases independently
`hack/release/utils.go`	Added utility functions for handling trailing slashes, checking prerelease versions, and improved error messages
`hack/release/utils_test.go`	Added test coverage for new utility functions and updated existing tests with new function signatures
`hack/release/github.go`	Added GitHub release creation/update methods with draft and prerelease support
`hack/release/flags.go`	Added new flags for build/publish commands including registry, CRDs directories, and hashrelease-specific options
`hack/release/prep.go`	Updated to use new utility functions and added support for CRDs directory flags
`hack/release/from.go`	Updated error messages and modified to use new repository-aware config retrieval
`hack/release/releasenotes.go`	Added validation for GitHub token and improved output messaging
`hack/release/main.go`	Registered new build, publish, and public commands
`hack/release/README.md`	Added comprehensive documentation for new commands with usage examples
`RELEASING.md`	Updated release process documentation to reflect new tooling workflow
`Makefile`	Simplified release targets to use new CLI commands
`go.mod`/`go.sum`	Added google/go-containerregistry dependency for image registry interactions
`.semaphore/release.yml`	Updated pipeline name to "Operator Release"
`.semaphore/push_images.yml`	Renamed block from "Push Images / Maybe Release" to "Push Images"
`cmd/main.go`	Updated code comment reference to new build.go location

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

hack/release/publish.go

hack/release/from.go

hack/release/build.go

hack/release/utils_test.go

hack/release/from.go

hack/release/build.go

hack/release/publish.go

hack/release/build.go

hack/release/publish.go

hack/release/utils.go

danudey · 2025-12-19T17:34:09Z

Attempted to do a build, got some error messaging:

INFO[0000] Building Operator                             arches="[amd64 arm64 ppc64le s390x]" release=true version=v1.42.0
ERROR[0000] make[1]: Entering directory '/home/dan/source/tigera/operator-master'
make var-require REQUIRED_VARS=VERSION-GIT_VERSION FAIL_NOT_SET=true
make[2]: Entering directory '/home/dan/source/tigera/operator-master'
make[2]: 'var-require' is up to date.
make[2]: Leaving directory '/home/dan/source/tigera/operator-master'
make[1]: Leaving directory '/home/dan/source/tigera/operator-master'  arches="[amd64 arm64 ppc64le s390x]" release=true version=v1.42.0
FATAL[0000] Error running command                         error="building Operator: exit status 2: Makefile:573: *** Attempt to build v1.42.0 from v1.42.0-0.dev-19-ga28a5204246a.  Stop."
make: *** [Makefile:567: release] Error 1

There's no indication of why this is a problem or what to do about it.

Running it again, I now see a different error for some reason:

FATAL[0000] Error running command                         error="building Operator: exit status 2: + uname -m\n+ bash -c 'if [[ \"x86_64\" == \"x86_64\" ]]; then echo amd64; else uname -m; fi'\n+ uname -s\n+ tr A-Z a-z\n+ uname -m\n+ uname -m\n+ echo /home/dan/.local/share/go\n+ cut -d: -f1\n+ id -u dan\n+ echo /home/dan/.local/share/go\n+ cut -d: -f1\n+ find ./pkg -name '*.go'\n+ find ./api -name '*.go'\n+ find ./internal/ -name '*.go'\n+ find ./test -name '*.go'\n+ git describe --tags --dirty --always --abbrev=12\n+ find ./hack/release -type f\n+ find ./hack/gen-versions -type f\n+ ./install-git-hooks\n+ echo '\"'\n+ make var-require REQUIRED_VARS=VERSION-GIT_VERSION FAIL_NOT_SET=true\n+ uname -m\n+ bash -c 'if [[ \"x86_64\" == \"x86_64\" ]]; then echo amd64; else uname -m; fi'\n+ uname -s\n+ tr A-Z a-z\n+ uname -m\n+ uname -m\n+ echo /home/dan/.local/share/go\n+ cut -d: -f1\n+ id -u dan\n+ echo /home/dan/.local/share/go\n+ cut -d: -f1\n+ find ./pkg -name '*.go'\n+ find ./api -name '*.go'\n+ find ./internal/ -name '*.go'\n+ find ./test -name '*.go'\n+ git describe --tags --dirty --always --abbrev=12\n+ find ./hack/release -type f\n+ find ./hack/gen-versions -type f\n+ ./install-git-hooks\n+ echo '\"'\n+ git describe --tags --dirty --always --abbrev=12\n+ git describe --tags --dirty --always --abbrev=12\nMakefile:573: *** Attempt to build v1.42.1 from v1.42.0-0.dev-19-ga28a5204246a.  Stop."

The "error message concatenated with a bunch of literal '\n'" is nearly impossible to read; is it possible to clean these errors up and print them in a more readable way?

radTuti · 2025-12-29T19:12:35Z

Attempted to do a build, got some error messaging

@danudey what did you run for the build. Also did you follow the readme?

From the logs you included, it seems like you are trying to do a release build on a git hash with no tag. The second go around switched to using v1.42.1 (from v1.42.0) and not sure what you did to get more info in the error. For non-release build, either the --hashrelease flag must be passed or the env var HASHRELEASE=true must be set.

Both attempt have this:

Makefile:573: *** Attempt to build v1.42.1 from v1.42.0-0.dev-19-ga28a5204246a.  Stop.

This indicated that the failure is coming from the Makefile at line 573 which is a check that has existed in the repo since the release process was established.

also attempted to improve error description when running commands.

radTuti · 2025-12-29T20:35:49Z

The "error message concatenated with a bunch of literal '\n'" is nearly impossible to read; is it possible to clean these errors up and print them in a more readable way?

I have updated the logrus text formatter to disable quote which should stop newlines from being escaped. However I find readablity is based on personal preferences; while I have made some adjustment in this PR, I think any further changes should be added outside of this PR.

danudey · 2026-01-06T21:52:52Z

Also did you follow the readme?

Nope, I definitely did not. That said, the readme tells you what commands there are, but it would be nice if it also had sections for "how to publish a hashrelease" (e.g. the steps to get all the correct information, check out calico/calient, etc), "how to publish a release" (what parameters need to be provided, etc.). As an example, it doesn't seem to say anywhere that a tag needs to exist ahead of time, nor does the error message indicate that. I know that that problem is in the Makefile right now, but if we're updating how the release process works then at least updating that error message would be a nice QoL fix - either be more specific about the error or direct the user to the release tool readme.

danudey · 2026-01-06T21:31:55Z

hack/release/main.go

 		Version: version,
 		Commands: []*cli.Command{


Suggested change

Version: version,

Commands: []*cli.Command{

Version: version,

EnableShellCompletion: true,

Commands: []*cli.Command{

danudey · 2026-01-06T21:42:44Z

hack/release/build.go

+
+	// Build the Operator and verify the build
+	buildLog.Info("Building Operator")
+	if out, err := makeInDir(repoRootDir, "release-build", buildEnv...); err != nil {


I think it would be beneficial to add slightly more detail to the process, even without debug. For example, it might be a good idea to have makeInDir log what it's running even if it's as simple as "Running make release-build...".

My thinking is that a lot of these targets can take a long time to run, so knowing what step it's on (or what command to run to duplicate the step) could be very beneficial). I know that if debug logging is enabled then commands get logged in runCommandInDir, but a lot of other output gets logged also, and we don't necessarily want to log every command we run; just adding unconditional logging of args to makeInDir could ease debugging in future.

danudey · 2026-01-06T21:53:46Z

hack/release/README.md

+  [--calico-version <calico version> | --calico-versions <path to calico version file> |--enterprise-version <enterprise version> | --enterprise-versions <path to enterprise version file>]
+```
+
+#### Examples


The readme has examples that show creating a build/hashrelease/etc with a Calico version or a Calico Enterprise version. Can both be used? e.g. if I wanted to create a hashrelease which included both the latest Calico and Calient? I'm not sure if this is something we'd ever want, but would it work?

It is likely not going to be done but it is possible. Will add an example for that.

danudey · 2026-01-06T21:55:33Z

hack/release/README.md

-  > [!NOTE]
-  > At least one of Calico or Calico Enterprise version must be specified.
+  > [!IMPORTANT]
+  > One of Calico or Calico Enterprise version must be specified.


Only one? Or at least one? The phrasing here implies one xor the other, but we've had enough double-releases recently that I would assume I can specify both?

danudey · 2026-01-06T21:59:52Z

hack/release/github.go

 	noteData, err := r.collectReleaseNotes(ctx, useLocal)
 	if err != nil {
-		return fmt.Errorf("error collecting release notes: %s", err)
+		return fmt.Errorf("collecting release notes: %s", err)


Will this process still error if we successfully fetch from Github but there are no PRs with release-note-required (i.e. there are no release notes to include)? If not, do we include a note like that in our output?

Also while I'm thinking about it, I have no idea if it's feasible but I wish our release note generation would highlight which new version an Operator release is supporting, e.g. an automatic "This version of Operator is being released to support Calico v3.31.4". Wishlist.

danudey · 2026-01-06T22:04:13Z

hack/release/github.go

+		logrus.Warnf("GitHub release already exists, update manually: %s", got.GetHTMLURL())
+		return ErrGitHubReleaseExists
+	}


Is it possible to include some kind of tags in the release notes so that we can find and update an existing release's (or a draft release's) release notes?

 ## Bug fixes * foo * bar 

The example I'm thinking is we generate a release with its release notes and someone wants to fix/update the release note in their PR; it would be nice to be able to kick off the release tool again to say "Go update the release notes for this release and/or show me the diff".

Not necessary for now, but a thought.

This addresses most of the review feedback given. Release notes related feedback will be handled in a separate PR

radTuti added 13 commits December 12, 2025 10:24

feat: add release build command

a2d81d9

feat: add release publish command

2061cfb

fix: update github token flag

d0c6550

also adjust how skip validation flag since validation is needed for github token

feat(release): add creating github releases

ba27391

fix: incorrect spelling and format

7659a01

fix: update development and testing flags

5e42543

fix: updates to allow building and publishing release for testing pur…

a5d0839

…poses

docs: update docs and pipeline names

c76f504

fix: add setting if github release is latest or not

dede09d

fix: update make target for release

a7e2fce

fix: update warning logged for build

02afc3e

feat: verify image being built

4d66d54

+ list images in debug mode

feat: add command for publishing github releases

891b0b9

radTuti requested review from a team and Copilot December 16, 2025 21:47

radTuti requested a review from a team as a code owner December 16, 2025 21:47

radTuti added release-note-not-required docs-not-required labels Dec 16, 2025

marvin-tigera added this to the v1.41.0 milestone Dec 16, 2025

Copilot started reviewing on behalf of radTuti December 16, 2025 21:47 View session

Copilot AI reviewed Dec 16, 2025

View reviewed changes

radTuti changed the title ~~feat(release):~~ feat(release): add build & publish to release tool Dec 16, 2025

radTuti added 4 commits December 16, 2025 15:02

Merge remote-tracking branch 'upstream/master' into de-3868-build-op

eb47a96

fix: update based on review and fix tests

7c2e59e

Merge remote-tracking branch 'upstream/master' into de-3868-build-op

99036db

ci: fix condition for running release tooling jobs

a28a520

radTuti added 2 commits December 29, 2025 11:13

Merge remote-tracking branch 'upstream/master' into de-3868-build-op

5e9eb3d

fix: check versions for release in tool before calling make

771dc40

also attempted to improve error description when running commands.

radTuti added 4 commits December 29, 2025 12:03

docs: improved comments for build & publish related fns

ab35db0

chore: update go mod

a1b07b7

style: update formatting for logging

29079b1

style: update error messages

90245a1

danudey approved these changes Jan 6, 2026

View reviewed changes

radTuti added 2 commits January 13, 2026 17:30

Merge remote-tracking branch 'upstream/master' into de-3868-build-op

c6e543f

fix: update documentation & flags + improve validations

f37c8e4

This addresses most of the review feedback given. Release notes related feedback will be handled in a separate PR

feat(release): add build & publish to release tool #4308

Are you sure you want to change the base?

feat(release): add build & publish to release tool #4308

Uh oh!

Conversation

radTuti commented Dec 16, 2025

Description

For PR reviewers

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

danudey commented Dec 19, 2025

Uh oh!

radTuti commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

radTuti commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

danudey commented Jan 6, 2026

Uh oh!

danudey Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

danudey Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

danudey Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

radTuti Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

danudey Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

danudey Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

danudey Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

radTuti commented Dec 29, 2025 •

edited

Loading

radTuti commented Dec 29, 2025 •

edited

Loading