From 5c37af260261891dc9a1368ce6a756130085425c Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Thu, 9 Jul 2026 10:06:17 -0700 Subject: [PATCH 01/14] rc: Split branch prep into two pull requests The branch preparation commits end up with hundreds of thousands of lines of deletions across the workflows and CLI removal steps, which can be hard to review through the GitHub UI due to the sheer scale of the changes. None of these are particularly interesting for deep review, so it's easier if we split the file cleanup steps out from the workflow modifications. Document the branch name creation and how to create separate commits for the cleanup commits. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index 9e065fd..fbd50ca 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -122,6 +122,7 @@ assignees: '' - [ ] Protect the new stable branch with GitHub Settings [here](https://github.com/cilium/cilium/settings/branches) - Use the settings of the previous stable branch and main as sane defaults - [ ] On the `vX.Y` branch, prepare for stable release development: + - `git checkout -b pr/prep-vX.Y upstream/vX.Y - [ ] Update GitHub workflows for stable branch triggers: - Replace references to `main` branch with `X.Y` in the workflows. - `sed -i 's/- \(ft\/\)\?main/- \1vX.Y/g' .github/workflows/*` @@ -164,6 +165,7 @@ assignees: '' - `grep -R bpf-next- .github/workflows/` - Commit the state up until now before the next step, so that it's easier to compare the diff vs. the previous stable release. + - `git commit -sam 'Prepare vX.Y stable branch'` - Copy-paste the `.github` directory from the previous stable branch and manually check the diff between the files from the current stable branch and modify the workflows to match the target stable branch. See @@ -182,6 +184,11 @@ assignees: '' for the previous stable branch. - Update the preparation commit as needed. - `git reset --hard` + - [ ] Push a PR with those changes: + - `gh pr create -B vX.Y` + - [ ] Create a new PR for preparing file deletions. This PR is separate + from the one above to simplify review. + - `git checkout -b pr/prep-vX.Y-cleanup` - [ ] Remove any GitHub configuration from the stable branch that is only relevant for the main branch (Read the following before running this step). @@ -218,9 +225,11 @@ assignees: '' - `make -C Documentation update-cmdref` - `go mod vendor && go mod tidy` - `git commit -sam "Remove cilium-cli in preparation for stable maintenance"` - - [ ] Push a PR with those changes: - - `gh pr create -B vX.Y` - - [ ] Merge the stable branch PR + - [ ] Push a PR with those changes, against the PR prepared earlier: + - `gh pr create -B pr/prep-vX.Y` + - [ ] Get each PR reviewed. + - [ ] Merge the CLI PR into the branch prep branch. + - [ ] Merge the branch prep branch PR into the vX.Y branch. - [ ] Remove the `dont-merge/wait-until-release` label from [Blocked PRs]. - [ ] Announce on Slack #development channel that the stable branch is created and developers must use `release-note/X.Y` labels in order to From 0e05513f28308d1446d49d11abdbd4f7ec56d0f7 Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Thu, 9 Jul 2026 10:08:24 -0700 Subject: [PATCH 02/14] rc: Simplify instructions The unnecessary GitHub workflows are deleted in a later step, delete that note earlier in the instructions. Other steps can be combined for easier execution during the creation of the branch. While we're at it, indent some text to format it correctly. No functional changes to the instructions in this commit. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index fbd50ca..3c3c130 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -158,7 +158,6 @@ assignees: '' - `sed -i '/^\//,$d' CODEOWNERS` - `grep -v '#' ../cilium-X.Y-1/CODEOWNERS >> CODEOWNERS` - `make -C Documentation update-codeowners` - - Delete unnecessary GitHub configurations from the stable branch - Replace references to `bpf-next-*` lvh images in workflows with the newest LTS kernel from [quay.io](https://quay.io/repository/lvh-images/kind?tab=tags&tag=latest). If there is no newer LTS, delete the corresponding matrix entries. @@ -197,9 +196,11 @@ assignees: '' - `git rm .github/workflows/lint-codeowners.yaml` - `git rm .github/workflows/release.yaml` - `git rm .github/workflows/renovate*` + - `git rm .github/workflows/*perf*` + - `git rm .github/workflows/*scale*` - [ ] Remove workflows that are exclusively triggered by `schedule`, - `issue_comment` or `pull_request_target` triggers, as they do not run - on stable branches. + `issue_comment` or `pull_request_target` triggers, as they do not run + on stable branches. ``` for f in .github/workflows/*yaml; do @@ -208,10 +209,6 @@ assignees: '' fi; done ``` - - Remove scale and perf tests, as these are not maintained on stable - branches: - - `git rm .github/workflows/*perf*` - - `git rm .github/workflows/*scale*` - [ ] Commit the workflow changes - `git commit -sam ".github: Simplify configuration for stable branch"` - [ ] Remove the cilium-cli changes from the stable branch. This may take From 73b36daf30539095582f0e10bd736947593a73a1 Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Thu, 9 Jul 2026 10:10:19 -0700 Subject: [PATCH 03/14] rc: Ignore simple changes in diff review Many of the changes to workflows consist of a simple branch substitution from the previous stable branch to the current stable branch. Ignore these using `git diff --ignore-matching-lines`. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index 3c3c130..840fed7 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -174,7 +174,7 @@ assignees: '' - `git diff --stat` - Ignore all stable branch changes under the `.github/actions` directory. `git checkout .github/actions` - - `git diff` + - `git diff --ignore-matching-lines '(X.Y-1|X.Y)'` - Yes this step is horribly painful. It's unrealistic for us to make reasonable decisions here when scanning thousands of lines of random CI changes for the past six months. Suggestions welcome: please From d34c2e8b0aa2b56809358169c63c0d5aeeaccbd3 Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Thu, 9 Jul 2026 15:09:38 -0700 Subject: [PATCH 04/14] rc: Add explicit editor step to update GHA The previous step just greps for affected files, this adds an explicit prompt for the release manager to open the files and make changes. The expected pattern is to find every instance of the previous stable branch, and then add the new stable branch as another item in those target lists. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index 840fed7..f705f8d 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -108,6 +108,7 @@ assignees: '' branch `X.Y-1`, and update those to include the new stable `X.Y` version as well. - `git grep "X.Y-1" .github/` + - `$EDITOR $(git grep -l "X.Y-1" .github/)` - [ ] Ensure that the `CustomResourceDefinitionSchemaVersion` uses a new minor schema version compared to the new `X.Y` release. - `git grep 'CustomResourceDefinitionSchemaVersion =' -- pkg/` - `echo "X.Y+1.0-dev" > VERSION` From 46760b890d5aee038486a8b32fadc400cc9244c8 Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Thu, 9 Jul 2026 15:11:04 -0700 Subject: [PATCH 05/14] rc: Explicitly check out main branch version This makes the step clear for when to create the custom branch, and gives it a consistent name that can be potentially referred to later in the instructions. The instructions do not currently refer to this branch name. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index f705f8d..776ab3d 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -99,9 +99,11 @@ assignees: '' skopeo logout ``` - - [ ] On the main branch, create a PR with a change in the `VERSION` file to - start the next development cycle as well as creating the necessary GH - workflows (renovate configuration, etc. + - [ ] From this new branch, create a new branch which will be submitted into + `main` in order to begin the development cycle for the next release. + - `git checkout -b pr/vX.Y+1-dev` + - [ ] Create commits that update the `VERSION` and other necessary GitHub + workflows changes for the new stable branch (renovate configuration, etc. see [24143732b616](https://github.com/cilium/cilium/commit/24143732b616bb6cd308564b0be33f13fc5613e6) for reference): - [ ] Check for any other .github workflow references to the current stable From f3f227cfab8230046f46b63ec605613a7af924e0 Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Thu, 9 Jul 2026 18:12:44 -0700 Subject: [PATCH 06/14] rc: Fix CI image build workflow Add instructions to prepare the CI image build workflow for the stable branch, according to the way that it's currently expected to work. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index 776ab3d..a341df0 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -165,6 +165,11 @@ assignees: '' newest LTS kernel from [quay.io](https://quay.io/repository/lvh-images/kind?tab=tags&tag=latest). If there is no newer LTS, delete the corresponding matrix entries. - `grep -R bpf-next- .github/workflows/` + - Move the image build workflow to a path based on the current branch. + Update the triggers for image builds to remove the `pull_request_target` trigger. + - `git mv .github/workflows/build-images-ci{,-vX.Y}.yaml` + - `sed -i '/pull_request_target:$/,/push:$/{ /push/!d }' .github/workflows/build-images-ci-vX.Y.yaml` + - `sed -i '/pull_request_target:$/,/workflow_.*$/{ /workflow_/!d }' .github/workflows/build-images-base.yaml` - Commit the state up until now before the next step, so that it's easier to compare the diff vs. the previous stable release. - `git commit -sam 'Prepare vX.Y stable branch'` From d1f910f6d83f8f70396d28053f2c9dcf2ab45b6a Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Fri, 10 Jul 2026 09:13:38 -0700 Subject: [PATCH 07/14] rc: Block CI changes during feature freeze During the v1.20 stable branch preparation, we encountered constant issues where the stable branch PR fell out of date (and conflicted) compared to the workflows on main. Therefore I think it's better for us to grant only case-by-case exception to feature freeze for CI work rather than a general exemption, in order to more closely coordinate with the release managers. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index a341df0..2324eac 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -67,7 +67,6 @@ assignees: '' General exemptions to feature freeze: - Bug fixes - - Testing enhancements - Documentation enhancements - [ ] Mark all PRs that are not granted an exception with the GitHub label @@ -357,7 +356,7 @@ Thank you for the testing and contributing to the previous pre-releases. There a [active versions]: https://readthedocs.org/projects/cilium/versions/?version_filter=vX.Y.Z-rc.W [Charts Workflow]: https://github.com/cilium/charts/actions/workflows/validate-cilium-chart.yaml [Cilium charts]: https://github.com/cilium/charts -[Review feature PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+base%3Amain+is%3Apr+-label%3Arelease-note%2Fbug+-label%3Arelease-note%2Fci+-author%3Aapp%2Fcilium-renovate+-label%3Adont-merge%2Fwait-until-release+-label%3Adont-merge%2Fpreview-only+-label%3Aarea%2Fdocumentation+-label%3Acilium-cli-exclusive+-label%3Arelease-blocker%2FX.Y +[Review feature PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+base%3Amain+is%3Apr+-label%3Arelease-note%2Fbug+-author%3Aapp%2Fcilium-renovate+-label%3Adont-merge%2Fwait-until-release+-label%3Adont-merge%2Fpreview-only+-label%3Aarea%2Fdocumentation+-label%3Acilium-cli-exclusive+-label%3Arelease-blocker%2FX.Y [Renovate PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+is%3Apr+author%3Aapp%2Fcilium-renovate+base%3Amain [Blocked PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+is%3Apr+label%3Adont-merge%2Fwait-until-release+base%3Amain [dependency dashboard]: https://github.com/cilium/cilium/issues/33550 From d6e30bc4edb6519e9476c69b45926274cfaffedd Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Fri, 10 Jul 2026 15:02:58 -0700 Subject: [PATCH 08/14] rc: Fix skopeo logout in embedded script The logout would fail with fatal error: please provide a registry to log out from Fix it by specifying the registry to log out from, similar to the login. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index 2324eac..c0763cd 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -96,7 +96,7 @@ assignees: '' skopeo copy -a docker://quay.io/cilium/$repo-ci:$COMMIT docker://quay.io/cilium/$repo-ci:vX.Y; done - skopeo logout + skopeo logout quay.io ``` - [ ] From this new branch, create a new branch which will be submitted into `main` in order to begin the development cycle for the next release. From 7410fd367e0f486471118a1dfc06f30875232717 Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Mon, 13 Jul 2026 15:47:17 -0700 Subject: [PATCH 09/14] rc: Fix Ariane CI dependencies during branching Ariane was refusing to trigger CI builds because of a missing dependency, which is specified in the Ariane config on the branch. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index c0763cd..903d7ab 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -130,6 +130,7 @@ assignees: '' - `sed -i 's/- \(ft\/\)\?main/- \1vX.Y/g' .github/workflows/*` - `sed -i 's/\(renovate\/\)main/\1vX.Y/g' .github/workflows/*` - `sed -i 's/- v\[0-9\]+\.\[0-9\]+/- vX.Y/g' .github/workflows/build-images-releases.yaml` + - `sed -i 's/\(build-images-ci\)/\1-vX.Y/g' $(git grep -l build-images-ci .github/ariane-config.yaml)` - Double-check if there are any other new references to `main` in the workflows, and update them as needed. - `git grep 'main' .github/workflows/` From 12f02468a026ca3d5c1d3021c034f1e33ad97630 Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Mon, 13 Jul 2026 19:57:01 -0700 Subject: [PATCH 10/14] rc: Add steps to label needs-backport at branch When the branch is actually created, there may be various PRs in flight that need their labels updated to ensure that fixes land into the stable branch as expected. We can proactively apply these labels to reduce the likelihood that we inadvertently miss some fixes in the final release. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index 903d7ab..bf67cdb 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -121,6 +121,14 @@ assignees: '' - [ ] Sync the `vX.Y` branch up to the commit before preparing for the `X.Y+1` development cycle. - `git fetch upstream && git checkout vX.Y && git merge --ff-only upstream/main~1 && git log -5` - `git push upstream vX.Y` + - [ ] Check for any merged PRs with `needs-backport/X.Y` label set, and + remove the label. Sometimes contributors get confused around this time + whether a PR needs backporting or not, and they may prematurely set the + label. + - [ ] Check PRs with `release-note/bug` and `needs-backport/X.Y-1` label and + add the `needs-backport/X.Y` label to them. + - [ ] Check any open PRs with `release-blocker/X.Y` label and add the + `needs-backport/X.Y` label to them. - [ ] Protect the new stable branch with GitHub Settings [here](https://github.com/cilium/cilium/settings/branches) - Use the settings of the previous stable branch and main as sane defaults - [ ] On the `vX.Y` branch, prepare for stable release development: From 22bcd39b9edbffb63beed514577f383319a1ea1f Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Tue, 14 Jul 2026 15:49:09 -0700 Subject: [PATCH 11/14] rc: Update upgrade notes at branch create This pattern ensures that both 'main' and the next stable release have a consistent view of the "upgrade-current.md" release notes file, which means that it is easier to backport changes to these notes that happen after the stable branch creation. At the same time, developers can begin documenting new functionality in the newly created "upgrade-next.md" file, keeping those release notes separate from the ones in the stable release. A subsequent step could remove the "upgrade-current.md" file from main, or alternatively we can just keep it there for the whole following development cycle and only move it around at the next branch creation. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index bf67cdb..13145a4 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -101,6 +101,11 @@ assignees: '' - [ ] From this new branch, create a new branch which will be submitted into `main` in order to begin the development cycle for the next release. - `git checkout -b pr/vX.Y+1-dev` + - [ ] Create a commit to update the release notes in preparation for the + upcoming stable and main branch development. + - `git mv Documentation/operations/upgrade-{next,current}.rst` + - `git cp Documentation/operations/upgrade-{template.rst.tmpl,next.inc}` + - `git commit -sam "Prepare for vX.Y branch"` - [ ] Create commits that update the `VERSION` and other necessary GitHub workflows changes for the new stable branch (renovate configuration, etc. see [24143732b616](https://github.com/cilium/cilium/commit/24143732b616bb6cd308564b0be33f13fc5613e6) @@ -156,6 +161,9 @@ assignees: '' - `vim $(git grep -l CustomResourceDefinitionSchemaVersion)` - Remove `stable.txt` file - `git rm stable.txt` + - Remove upgrade notes for the next release + - `git rm Documentation/operations/upgrade-next.inc` + - `sed -i '/upgrade-next/d' Documentation/operations/upgrade-notes.inc` - Adjust `./.github/maintainers-little-helper.yaml` to set labels based on the new stable branch version. See [5b4934284d](https://github.com/cilium/cilium/commit/5b4934284dd525399aacec17c137811df9cf0f8b) for reference. From 8c978155c850651574821e852532dc757ab6a15e Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Wed, 22 Jul 2026 09:34:28 -0700 Subject: [PATCH 12/14] rc: Add instruction to update CI scrapers During branch setup we should also update the code that scrapes the stable branches for CI workflow results. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index 13145a4..bd9313a 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -251,6 +251,11 @@ assignees: '' - [ ] Get each PR reviewed. - [ ] Merge the CLI PR into the branch prep branch. - [ ] Merge the branch prep branch PR into the vX.Y branch. + - [ ] Submit a PR to https://github.com/isovalent/corgi to start scraping + test results into the CI dashboard for the new branch. + - `git clone https://github.com/isovalent/corgi` + - `git grep vX.Y-1` + - Manually edit the files with matches. - [ ] Remove the `dont-merge/wait-until-release` label from [Blocked PRs]. - [ ] Announce on Slack #development channel that the stable branch is created and developers must use `release-note/X.Y` labels in order to From af94e970e3d8f8849d34c6402fb29b6ea26266ba Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Fri, 24 Jul 2026 15:16:37 -0700 Subject: [PATCH 13/14] Remove roadmap checklist item in RC process This is taken care of in the feature (minor) release process. Signed-off-by: Joe Stringer --- .github/templates/release_template_rc_branch.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/templates/release_template_rc_branch.md b/.github/templates/release_template_rc_branch.md index bd9313a..ed15056 100644 --- a/.github/templates/release_template_rc_branch.md +++ b/.github/templates/release_template_rc_branch.md @@ -342,9 +342,6 @@ assignees: '' - [ ] Announce the release in #general on Slack (do not use [@]channel). See below for templates. - [ ] Prepare post-release changes to main branch using `../release/internal/bump-readme.sh`. -- [ ] Update the upgrade guide and [roadmap](https://github.com/cilium/cilium/blob/main/Documentation/community/roadmap.rst) - for any features that changed status. Usually do it after the RC1, once the - stability of features is known. --- Text template for the first RC: From ec056e5da77cea04ddc79a013c8808db8601584e Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Wed, 26 Aug 2026 09:07:09 -0700 Subject: [PATCH 14/14] testdata: Update RC instructions per latest text Generated via 'make generate-golden'. Signed-off-by: Joe Stringer --- .../release_template_rc_branch.md.golden | 72 +++++++++++++------ 1 file changed, 52 insertions(+), 20 deletions(-) diff --git a/testdata/checklist/release_template_rc_branch.md.golden b/testdata/checklist/release_template_rc_branch.md.golden index 888d645..714f0ba 100644 --- a/testdata/checklist/release_template_rc_branch.md.golden +++ b/testdata/checklist/release_template_rc_branch.md.golden @@ -67,7 +67,6 @@ assignees: '' General exemptions to feature freeze: - Bug fixes - - Testing enhancements - Documentation enhancements - [ ] Mark all PRs that are not granted an exception with the GitHub label @@ -97,17 +96,25 @@ assignees: '' skopeo copy -a docker://quay.io/cilium/$repo-ci:$COMMIT docker://quay.io/cilium/$repo-ci:v1.10; done - skopeo logout + skopeo logout quay.io ``` - - [ ] On the main branch, create a PR with a change in the `VERSION` file to - start the next development cycle as well as creating the necessary GH - workflows (renovate configuration, etc. + - [ ] From this new branch, create a new branch which will be submitted into + `main` in order to begin the development cycle for the next release. + - `git checkout -b pr/v1.11-dev` + - [ ] Create a commit to update the release notes in preparation for the + upcoming stable and main branch development. + - `git mv Documentation/operations/upgrade-{next,current}.rst` + - `git cp Documentation/operations/upgrade-{template.rst.tmpl,next.inc}` + - `git commit -sam "Prepare for v1.10 branch"` + - [ ] Create commits that update the `VERSION` and other necessary GitHub + workflows changes for the new stable branch (renovate configuration, etc. see [24143732b616](https://github.com/cilium/cilium/commit/24143732b616bb6cd308564b0be33f13fc5613e6) for reference): - [ ] Check for any other .github workflow references to the current stable branch `1.9`, and update those to include the new stable `1.10` version as well. - `git grep "1.9" .github/` + - `$EDITOR $(git grep -l "1.9" .github/)` - [ ] Ensure that the `CustomResourceDefinitionSchemaVersion` uses a new minor schema version compared to the new `1.10` release. - `git grep 'CustomResourceDefinitionSchemaVersion =' -- pkg/` - `echo "1.11.0-dev" > VERSION` @@ -119,14 +126,24 @@ assignees: '' - [ ] Sync the `v1.10` branch up to the commit before preparing for the `1.11` development cycle. - `git fetch upstream && git checkout v1.10 && git merge --ff-only upstream/main~1 && git log -5` - `git push upstream v1.10` + - [ ] Check for any merged PRs with `needs-backport/1.10` label set, and + remove the label. Sometimes contributors get confused around this time + whether a PR needs backporting or not, and they may prematurely set the + label. + - [ ] Check PRs with `release-note/bug` and `needs-backport/1.9` label and + add the `needs-backport/1.10` label to them. + - [ ] Check any open PRs with `release-blocker/1.10` label and add the + `needs-backport/1.10` label to them. - [ ] Protect the new stable branch with GitHub Settings [here](https://github.com/cilium/cilium/settings/branches) - Use the settings of the previous stable branch and main as sane defaults - [ ] On the `v1.10` branch, prepare for stable release development: + - `git checkout -b pr/prep-v1.10 upstream/v1.10 - [ ] Update GitHub workflows for stable branch triggers: - Replace references to `main` branch with `1.10` in the workflows. - `sed -i 's/- \(ft\/\)\?main/- \1v1.10/g' .github/workflows/*` - `sed -i 's/\(renovate\/\)main/\1v1.10/g' .github/workflows/*` - `sed -i 's/- v\[0-9\]+\.\[0-9\]+/- v1.10/g' .github/workflows/build-images-releases.yaml` + - `sed -i 's/\(build-images-ci\)/\1-v1.10/g' $(git grep -l build-images-ci .github/ariane-config.yaml)` - Double-check if there are any other new references to `main` in the workflows, and update them as needed. - `git grep 'main' .github/workflows/` @@ -144,6 +161,9 @@ assignees: '' - `vim $(git grep -l CustomResourceDefinitionSchemaVersion)` - Remove `stable.txt` file - `git rm stable.txt` + - Remove upgrade notes for the next release + - `git rm Documentation/operations/upgrade-next.inc` + - `sed -i '/upgrade-next/d' Documentation/operations/upgrade-notes.inc` - Adjust `./.github/maintainers-little-helper.yaml` to set labels based on the new stable branch version. See [5b4934284d](https://github.com/cilium/cilium/commit/5b4934284dd525399aacec17c137811df9cf0f8b) for reference. @@ -157,13 +177,18 @@ assignees: '' - `sed -i '/^\//,$d' CODEOWNERS` - `grep -v '#' ../cilium-1.9/CODEOWNERS >> CODEOWNERS` - `make -C Documentation update-codeowners` - - Delete unnecessary GitHub configurations from the stable branch - Replace references to `bpf-next-*` lvh images in workflows with the newest LTS kernel from [quay.io](https://quay.io/repository/lvh-images/kind?tab=tags&tag=latest). If there is no newer LTS, delete the corresponding matrix entries. - `grep -R bpf-next- .github/workflows/` + - Move the image build workflow to a path based on the current branch. + Update the triggers for image builds to remove the `pull_request_target` trigger. + - `git mv .github/workflows/build-images-ci{,-v1.10}.yaml` + - `sed -i '/pull_request_target:$/,/push:$/{ /push/!d }' .github/workflows/build-images-ci-v1.10.yaml` + - `sed -i '/pull_request_target:$/,/workflow_.*$/{ /workflow_/!d }' .github/workflows/build-images-base.yaml` - Commit the state up until now before the next step, so that it's easier to compare the diff vs. the previous stable release. + - `git commit -sam 'Prepare v1.10 stable branch'` - Copy-paste the `.github` directory from the previous stable branch and manually check the diff between the files from the current stable branch and modify the workflows to match the target stable branch. See @@ -173,7 +198,7 @@ assignees: '' - `git diff --stat` - Ignore all stable branch changes under the `.github/actions` directory. `git checkout .github/actions` - - `git diff` + - `git diff --ignore-matching-lines '(1.9|1.10)'` - Yes this step is horribly painful. It's unrealistic for us to make reasonable decisions here when scanning thousands of lines of random CI changes for the past six months. Suggestions welcome: please @@ -182,6 +207,11 @@ assignees: '' for the previous stable branch. - Update the preparation commit as needed. - `git reset --hard` + - [ ] Push a PR with those changes: + - `gh pr create -B v1.10` + - [ ] Create a new PR for preparing file deletions. This PR is separate + from the one above to simplify review. + - `git checkout -b pr/prep-v1.10-cleanup` - [ ] Remove any GitHub configuration from the stable branch that is only relevant for the main branch (Read the following before running this step). @@ -190,9 +220,11 @@ assignees: '' - `git rm .github/workflows/lint-codeowners.yaml` - `git rm .github/workflows/release.yaml` - `git rm .github/workflows/renovate*` + - `git rm .github/workflows/*perf*` + - `git rm .github/workflows/*scale*` - [ ] Remove workflows that are exclusively triggered by `schedule`, - `issue_comment` or `pull_request_target` triggers, as they do not run - on stable branches. + `issue_comment` or `pull_request_target` triggers, as they do not run + on stable branches. ``` for f in .github/workflows/*yaml; do @@ -201,10 +233,6 @@ assignees: '' fi; done ``` - - Remove scale and perf tests, as these are not maintained on stable - branches: - - `git rm .github/workflows/*perf*` - - `git rm .github/workflows/*scale*` - [ ] Commit the workflow changes - `git commit -sam ".github: Simplify configuration for stable branch"` - [ ] Remove the cilium-cli changes from the stable branch. This may take @@ -218,9 +246,16 @@ assignees: '' - `make -C Documentation update-cmdref` - `go mod vendor && go mod tidy` - `git commit -sam "Remove cilium-cli in preparation for stable maintenance"` - - [ ] Push a PR with those changes: - - `gh pr create -B v1.10` - - [ ] Merge the stable branch PR + - [ ] Push a PR with those changes, against the PR prepared earlier: + - `gh pr create -B pr/prep-v1.10` + - [ ] Get each PR reviewed. + - [ ] Merge the CLI PR into the branch prep branch. + - [ ] Merge the branch prep branch PR into the v1.10 branch. + - [ ] Submit a PR to https://github.com/isovalent/corgi to start scraping + test results into the CI dashboard for the new branch. + - `git clone https://github.com/isovalent/corgi` + - `git grep v1.9` + - Manually edit the files with matches. - [ ] Remove the `dont-merge/wait-until-release` label from [Blocked PRs]. - [ ] Announce on Slack #development channel that the stable branch is created and developers must use `release-note/1.10` labels in order to @@ -307,9 +342,6 @@ assignees: '' - [ ] Announce the release in #general on Slack (do not use [@]channel). See below for templates. - [ ] Prepare post-release changes to main branch using `../release/internal/bump-readme.sh`. -- [ ] Update the upgrade guide and [roadmap](https://github.com/cilium/cilium/blob/main/Documentation/community/roadmap.rst) - for any features that changed status. Usually do it after the RC1, once the - stability of features is known. --- Text template for the first RC: @@ -343,7 +375,7 @@ Thank you for the testing and contributing to the previous pre-releases. There a [active versions]: https://readthedocs.org/projects/cilium/versions/?version_filter=v1.10.0-pre.0 [Charts Workflow]: https://github.com/cilium/charts/actions/workflows/validate-cilium-chart.yaml [Cilium charts]: https://github.com/cilium/charts -[Review feature PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+base%3Amain+is%3Apr+-label%3Arelease-note%2Fbug+-label%3Arelease-note%2Fci+-author%3Aapp%2Fcilium-renovate+-label%3Adont-merge%2Fwait-until-release+-label%3Adont-merge%2Fpreview-only+-label%3Aarea%2Fdocumentation+-label%3Acilium-cli-exclusive+-label%3Arelease-blocker%2F1.10 +[Review feature PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+base%3Amain+is%3Apr+-label%3Arelease-note%2Fbug+-author%3Aapp%2Fcilium-renovate+-label%3Adont-merge%2Fwait-until-release+-label%3Adont-merge%2Fpreview-only+-label%3Aarea%2Fdocumentation+-label%3Acilium-cli-exclusive+-label%3Arelease-blocker%2F1.10 [Renovate PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+is%3Apr+author%3Aapp%2Fcilium-renovate+base%3Amain [Blocked PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+is%3Apr+label%3Adont-merge%2Fwait-until-release+base%3Amain [dependency dashboard]: https://github.com/cilium/cilium/issues/33550