Skip to content

feat(release): add pre-release support#639

Merged
mchmarny merged 5 commits into
mainfrom
feat/prerelease-support
Apr 22, 2026
Merged

feat(release): add pre-release support#639
mchmarny merged 5 commits into
mainfrom
feat/prerelease-support

Conversation

@mchmarny

Copy link
Copy Markdown
Member

Summary

Add pre-release support (RC/beta) to the release process with two-phase bump workflow and gated consumer-facing artifacts.

Motivation / Context

Pre-release tags (e.g., v1.2.4-rc1) currently update Homebrew, push :latest container tags, deploy to Cloud Run, and publish site docs — leaking untested artifacts to end users. Additionally, there is no way to review release notes before a tag is pushed.

Fixes: #638
Related: N/A

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update
  • Refactoring (no functional changes)
  • Build/CI/tooling

Component(s) Affected

  • CLI (cmd/aicr, pkg/cli)
  • API server (cmd/aicrd, pkg/api, pkg/server)
  • Recipe engine / data (pkg/recipe)
  • Bundlers (pkg/bundler, pkg/component/*)
  • Collectors / snapshotter (pkg/collector, pkg/snapshotter)
  • Validator (pkg/validator)
  • Core libraries (pkg/errors, pkg/k8s)
  • Docs/examples (docs/, examples/)
  • Other: CI workflows, GoReleaser config, release tooling

Implementation Notes

tools/bump rewrite:

  • New subcommands: prepare, finalize, abort for two-phase releases
  • New bump types: rc and beta with auto-incrementing suffixes (v1.2.4-rc1v1.2.4-rc2)
  • Existing one-shot major/minor/patch behavior preserved
  • .release-pending state file tracks version between prepare/finalize (gitignored)

Pre-release detection (on-tag.yaml):

  • New detect job checks tag for semver pre-release suffix (hyphen)
  • Gated on is_prerelease == 'false': Homebrew push, :latest image tags (ko + validator manifests), Cloud Run deploy, site docs
  • NOT gated (runs for all tags): tests, build, attestation, vuln scan, Slack notification
  • Dependency chain reordered: publish depends on release-check (not deploy), deploy runs after publish

GoReleaser (.goreleaser.yaml):

  • skip_upload uses .Prerelease template to skip Homebrew for pre-releases
  • ko tags conditionally exclude latest for pre-releases
Consumer Stable Pre-release
Full pipeline (test/build/attest) Yes Yes
GitHub Release Published Published (marked pre-release)
Install script Serves latest Unaffected (/releases/latest excludes pre-releases)
Homebrew tap Updated Skipped
Container :latest Updated Skipped
Cloud Run deploy Deployed Skipped
Site docs Published Skipped
Slack notification "stable" "pre-release"

Testing

make qualify   # pre-existing failures in pkg/trust (sandbox), pkg/bundler/deployer/helm, pkg/collector/os — confirmed on main
goreleaser check --config .goreleaser.yaml   # valid
yamllint .github/workflows/on-tag.yaml       # 0 errors
bash -n tools/bump                           # syntax OK
tools/bump                                   # usage output verified

Pre-existing test failures confirmed on clean main (not introduced by this PR).

Risk Assessment

  • Low — Isolated change, well-tested, easy to revert

Rollout notes: Fully backwards compatible. Existing make bump-patch/minor/major targets work identically. New targets (bump-prepare, bump-finalize, bump-rc, bump-beta) are additive. Pre-release gating only activates for tags containing a hyphen.

Checklist

  • Tests pass locally (make test with -race)
  • Linter passes (make lint)
  • I did not skip/disable tests to make CI green
  • I added/updated tests for new functionality
  • I updated docs if user-facing behavior changed
  • Changes follow existing patterns in the codebase
  • Commits are cryptographically signed (git commit -S) — GPG signing info

Add two-phase release workflow: bump-prepare generates changelog for
review, bump-finalize commits/tags/pushes. Add rc and beta one-shot
bump types with auto-incrementing suffixes.
Use GoReleaser .Prerelease template to conditionally skip Homebrew
formula updates and :latest ko image tags when releasing rc/beta tags.
Add detect job that checks for semver pre-release suffix in tags.
Gate deploy, site docs, and :latest validator manifests on stable
releases only. Slack notifications fire for both with release type
indicator. Full build/test/attest pipeline runs for all tags.
@github-actions

github-actions Bot commented Apr 22, 2026

Copy link
Copy Markdown
Contributor

Coverage Report ✅

Metric Value
Coverage 74.5%
Threshold 70%
Status Pass
Coverage Badge
![Coverage](https://img.shields.io/badge/coverage-74.5%25-green)

No Go source files changed in this PR.

@coderabbitai

This comment was marked as resolved.

coderabbitai[bot]

This comment was marked as resolved.

@lockwobr lockwobr left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtg to me

@mchmarny mchmarny enabled auto-merge (squash) April 22, 2026 17:44
@mchmarny mchmarny added this to the v0.12 milestone Apr 22, 2026
@mchmarny mchmarny merged commit 16d670d into main Apr 22, 2026
38 of 39 checks passed
@mchmarny mchmarny deleted the feat/prerelease-support branch April 22, 2026 17:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add pre-release support to release process

2 participants