myasnikovdaniil 9f5550abdd fix(release): publish rewritten packages during RC promotion (#3795) ...

## What this PR does

Fixes #3477.

- Publishes a new packages OCI candidate after rewriting RC image tags
to stable tags.
- Pins the candidate digest in the stable installer without rebuilding
container images.
- Verifies the candidate against the prospective merge and original RC
artifact before creating stable names.
- Refuses promotion when the target maintenance branch lacks the
candidate-aware pipeline.
- Protects candidates referenced by open release PRs from retention
cleanup.
- Leaves already published v1.6.0 and v1.6.1 unchanged.

### Screenshots

Not applicable.

### Downstream repositories

- [x] No downstream repository is affected by this change
- [ ] [cozystack/website](https://github.com/cozystack/website) -
follow-up:
- [ ]
[cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack)
- follow-up:
- [ ]
[cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
- follow-up:
- [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up:
- [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up:
- [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) -
follow-up:
- [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -
follow-up:
- [ ]
[cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- follow-up:
- [ ]
[cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
- follow-up:
- [ ] [cozystack/examples](https://github.com/cozystack/examples) -
follow-up:

### Testing

- `bats --no-tempdir-cleanup hack/promote-packages-artifact_test.bats
hack/verify-promoted-packages_test.bats
hack/promote-packages-contract.bats
hack/promotion-retention-contract.bats`
- `actionlint .github/workflows/promote-rc.yaml
.github/workflows/pull-requests.yaml
.github/workflows/pull-requests-release.yaml
.github/workflows/retention.yaml`
- `sh -n hack/promote-packages-artifact.sh
hack/verify-promoted-packages.sh`
- `git diff --check origin/main...HEAD`

### Release note

```release-note
fix(release): publish the rewritten stable packages artifact when promoting a release candidate
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Release candidates now use temporary, immutable package artifacts
verified before stable publication.
- Stable promotions validate package contents, installer references,
container digests, and release metadata before tagging.
- Temporary promotion artifacts are retained while needed and cleaned up
after expiration.

- **Bug Fixes**
- Improved handling of release labels, fork pull requests, and promotion
pull requests.
  - Added end-to-end verification before release promotion.
- Prevented invalid, ambiguous, or untrusted package references from
being promoted.

- **Documentation**
- Updated release and promotion guidance for candidate verification,
digest pinning, and transactional promotion.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-08-17 12:52:19 +05:00

..

e2e-apps

test(e2e): poll users-Job DESIRED_USERS_JSON for target email, not just Job existence

2026-07-15 15:31:45 +03:00

e2e-chainsaw

test(e2e): run tenant workers on one vCPU with CPU headroom above it

2026-08-17 03:09:04 +03:00

lib

docs(release): name all four sourcers of the image-ref enumeration

2026-08-14 18:37:59 +05:00

testdata

test(release): scope the trim pin to the parse step, fix two stale references

2026-07-27 14:03:49 +05:00

admin-kubeconfig-invariant.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

app-cleanup-hooks_test.bats

fix(apps): make the post-delete cleanup hooks report failure

2026-08-12 18:43:02 +03:00

bats-no-exit-trap.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

boilerplate.go.txt

Introduce cozystack-controller (#560)

2025-01-09 12:24:51 +01:00

build-matrix_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

build-matrix.sh

fix(build): force full image rebuild on root Go source changes

2026-06-25 10:21:05 +05:00

buildkitd.toml

ci(build): route PR base-image pulls through mirror.gcr.io

2026-06-24 23:17:25 +03:00

capture-dataplane.bats

test(e2e): capture host-netns address attribution and a healthy-pod reference

2026-08-09 14:42:19 +03:00

capture-previous-logs.bats

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

cdi_golden_image_create.sh

[vm-default-images] Added new optional package

2026-04-14 19:59:19 +05:00

changelog-preserve.sh

ci(release): execute the release-changelog logic in tests, not just grep it

2026-07-24 11:34:17 +05:00

check-applicationdefinition-crd-ordering.bats

fix(platform): make *-rd sources depend on cozystack-engine

2026-06-24 22:43:56 +03:00

check-gpu-operator-variants.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-gpu-recording-rules.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-host-runtime.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-host-runtime.sh

fix(hack): wrap du in 'timeout 5s' to prevent preflight stall

2026-04-11 17:07:35 +03:00

check-kafka-rd-schema.bats

test(kafka): assert scalar boolean tls.enabled type in rd-schema check

2026-05-27 16:21:46 +03:00

check-kafka-rd-secrets.bats

test(kafka): add cluster-ca-cert checks to kafka-rd secrets bats test

2026-05-27 11:16:41 +03:00

check-migrations-target.sh

refactor(hack): replace ls|grep with pure-bash glob (shellcheck SC2010)

2026-07-14 13:08:54 +03:00

check-optional-repos.sh

Rename cozypkg to cozyhr

2025-12-25 16:54:22 +01:00

check-rd-presets.sh

fix(hack): tighten resourcesPreset enum check

2026-05-12 03:04:48 +03:00

cilium-leak-healer_test.bats

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

cni-plugins-staging-contract.bats

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

codeowners-invariant.bats

test(codeowners): guard the coverage invariant with a unit check

2026-08-10 10:30:30 +02:00

collect-images.sh

[dx] Refactor collect-images functionality

2025-07-03 14:26:56 +03:00

common-envs_test.bats

test(hack): cover the default (non-export) build path (#3262)

2026-07-29 17:47:28 +05:00

common-envs.mk

fix(ci): gate release tags/pushes off under OCI_EXPORT_DIR (defense-in-depth)

2026-07-29 17:47:28 +05:00

cozyreport-summary.sh

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

cozyreport-talos.bats

fix(e2e): bound every remaining read in the report collector

2026-08-07 14:38:29 +03:00

cozyreport.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

cozyreport.sh

fix(e2e): bound every remaining read in the report collector

2026-08-07 14:38:29 +03:00

cozystack-controller-secret-rbac.bats

test(cozystack-controller): guard the Secret grant by effective permission

2026-08-12 18:37:09 +03:00

cozystack-version-stamp.bats

test(platform): enforce go-forward version stamps route through the helper

2026-06-24 15:32:52 +03:00

cozytest-capture-gate.bats

fix(tests): report a data-plane capture cut short by its backstop

2026-08-08 17:08:54 +03:00

cozytest.sh

docs(tests): correct five stale claims in the e2e capture tooling (#3662)

2026-08-09 04:08:35 +03:00

dcgm-default-counters.csv

fix(gpu-operator): pin upstream behavior changes; correct DLS licensing example

2026-04-30 14:52:56 +03:00

download-dashboards.sh

Add monitoring for NATs

2026-02-17 22:54:12 +01:00

downstream-trigger-map.bats

docs(agents): add downstream repository checklist to the PR template

2026-07-14 17:07:47 +03:00

e2e-capture-dataplane.sh

test(e2e): capture host-netns address attribution and a healthy-pod reference

2026-08-09 14:42:19 +03:00

e2e-capture-previous-logs.sh

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

e2e-cilium-endpoint-leak-healer.sh

fix(e2e): stop the sandbox cluster CIDR overlapping the pod range

2026-08-11 02:31:27 +03:00

e2e-cilium-leak-healer.yaml

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

e2e-ghcr-mirror.yaml

test(e2e): warm the ghcr.io mirror before the tenant suites need it

2026-08-14 11:08:49 +03:00

e2e-install-cozystack.bats

test(e2e): warm the ghcr.io mirror before the tenant suites need it

2026-08-14 11:08:49 +03:00

e2e-post-install-prep.sh

fix(e2e): budget each linstor wait separately in post-install-prep

2026-08-10 00:10:53 +03:00

e2e-prepare-cluster.bats

fix(e2e): stop the sandbox cluster CIDR overlapping the pod range

2026-08-11 02:31:27 +03:00

e2e-prepull-images.sh

test(e2e): pre-pull platform images via staged-busybox DaemonSet

2026-05-25 11:56:30 +05:00

e2e-talos-image-cache.yaml

test(e2e): make the talos image cache reachable by tenant workers (#3254)

2026-07-09 18:21:07 +05:00

e2e-test-openapi.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

etcd-probe_test.bats

test(etcd): stop losing the metrics probe's output to the attach race

2026-07-19 20:16:01 +03:00

gate-concurrency-contract.bats

fix(ci): put every label guard in lockstep, forks included

2026-08-14 18:37:57 +05:00

ghcr-mirror_test.bats

test(e2e): warm the ghcr.io mirror before the tenant suites need it

2026-08-14 11:08:49 +03:00

helm-unit-tests.bats

fix(hack): fail when a chart runs no Helm unit test suites

2026-08-12 18:45:22 +03:00

helm-unit-tests.sh

fix(hack): fail when a chart runs no Helm unit test suites

2026-08-12 18:45:22 +03:00

image-pin-consistency.bats

fix(backupstrategy-controller): give chBackupClientImage a producer

2026-07-21 23:15:46 +05:00

issue-triage-contract.bats

feat(ci): auto-apply triage labels to issues

2026-08-12 16:35:36 +03:00

kubernetes-md0-migration.bats

test(platform): cover migration 47 fail-closed contract

2026-06-30 12:08:18 +05:00

kubernetes-pre-delete-hook.bats

fix(apps/kubernetes): report the pre-delete cleanup outcome honestly

2026-08-07 06:49:56 +03:00

md-no-hardwrap.bats

feat(agents): add md-no-hardwrap hook enforcing the prose rule

2026-07-14 14:37:52 +03:00

migrate-to-version-1.0.sh

Fixed packages name conversion in migration script

2026-03-03 19:10:39 +05:00

migration-50-etcd-adopt.bats

feat(platform): make the etcd-adoption skip-backup hatch reachable

2026-07-20 11:29:09 +05:00

migration-seaweedfs-db-adopt.bats

test(seaweedfs): run the db-adopt migrations in the shell they ship with

2026-07-20 15:40:49 +05:00

monitoring-pvc-backfill-migration.bats

test(monitoring): reproduce the real vmselect cache PVC name in the backfill test

2026-07-08 22:27:42 +03:00

multus-install-cni-plugins.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

nightly-mirror_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

nightly-mirror.sh

fix(nightly): rewrite an image host that is the whole scalar value

2026-07-28 18:07:34 +02:00

overlay-main-images_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

overlay-main-images.sh

fix(ci): preserve a PR's own edits to non-rebuilt package image refs

2026-06-30 16:56:33 +03:00

package-mk-phony.bats

test(hack): cover the .PHONY declarations this tree relies on

2026-08-14 01:25:34 +03:00

package.mk

fix(hack): declare the shared package targets phony

2026-08-12 18:42:58 +03:00

parse-rc-tag.sh

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

pod-label-census_test.bats

fix(e2e): select catch pod logs by the nested release instance label

2026-08-05 16:46:50 +03:00

post-install-prep.bats

fix(e2e): budget each linstor wait separately in post-install-prep

2026-08-10 00:10:53 +03:00

pre-checks.sh

Fix osx grep have no -P flag (#438)

2024-10-21 11:59:56 +02:00

promote-gate-contract.bats

docs(hack): fix a wrong claim about grep-error propagation in two contract tests

2026-08-10 12:08:02 +03:00

promote-packages-artifact_test.bats

fix(release): preflight the rc tree's own pin before publishing

2026-08-14 18:37:58 +05:00

promote-packages-artifact.sh

fix(release): preflight the rc tree's own pin before publishing

2026-08-14 18:37:58 +05:00

promote-packages-contract.bats

test(release): pin every requiredBaseFiles entry, not just the list

2026-08-14 18:37:59 +05:00

promote-retag_test.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

promote-retag.sh

fix(release): prove a stable tag is absent before copying over it

2026-07-27 13:56:45 +05:00

promote-rewrite-tags_test.bats

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

promote-rewrite-tags.sh

test(ci): make the image-ref guards see split-host and unparseable files

2026-07-21 21:08:15 +05:00

promotion-retention-contract.bats

fix(release): stop a failed org package listing from exiting green

2026-08-14 18:37:59 +05:00

release-changelog-behaviour.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

release-changelog-contract.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

release-freeze-contract.bats

docs(hack): fix a wrong claim about grep-error propagation in two contract tests (#3620)

2026-08-11 19:40:01 +05:00

remediation-guard.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

run-kubernetes-cpu-throttle_test.bats

test(e2e): split the tenant worker CPU time across QEMU threads

2026-08-16 05:17:16 +03:00

run-kubernetes-drain_test.bats

test(e2e): fix post-merge seams the conflict markers missed

2026-07-08 18:06:22 +05:00

run-kubernetes-network-counters_test.bats

test(e2e): measure tenant worker CPU as a rate, and the sandbox nodes under it

2026-08-15 10:19:19 +03:00

run-kubernetes-node-join_test.bats

test(e2e): split the tenant worker CPU time across QEMU threads

2026-08-16 05:17:16 +03:00

run-kubernetes-sandbox-cpu-time_test.bats

test(e2e): measure tenant worker CPU as a rate, and the sandbox nodes under it

2026-08-15 10:19:19 +03:00

run-kubernetes-schedulable_test.bats

fix(e2e): bound the tenant failure diagnostics per read and as a phase

2026-08-09 02:51:06 +03:00

run-kubernetes-serial-console_test.bats

test(e2e): time the guest console capture and baseline it on a green run

2026-08-15 23:33:33 +03:00

run-kubernetes-talos-diagnostics_test.bats

fix(e2e): capture both ends of the worker byte path on node-join failure

2026-08-14 14:34:37 +03:00

run-kubernetes-talos-spec_test.bats

fix(e2e): wire the ghcr.io mirror into the tenant install and node-join flow

2026-08-09 16:17:44 +03:00

run-kubernetes-thread-cpu_test.bats

test(e2e): split the tenant worker CPU time across QEMU threads

2026-08-16 05:17:16 +03:00

sandbox-cidr-disjoint.bats

fix(e2e): stop the sandbox cluster CIDR overlapping the pod range

2026-08-11 02:31:27 +03:00

sandbox-runner-headroom.bats

fix(ci): give the nightly e2e runner headroom over its guest vCPUs

2026-08-15 02:41:19 +03:00

seaweedfs-guard-parity.bats

fix(seaweedfs): stop the naming guard guessing which volume generation holds the data

2026-07-20 15:40:48 +05:00

seaweedfs-naming-audit.bats

fix(seaweedfs): read the chart name first-match, fail the fake on unmodelled calls

2026-07-27 13:52:59 +05:00

seaweedfs-naming-audit.sh

fix(seaweedfs): read the chart name first-match, fail the fake on unmodelled calls

2026-07-27 13:52:59 +05:00

select-changelog-source.sh

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

select-e2e_test.bats

fix(ci): decide E2E coverage per changed path

2026-08-09 22:24:37 +03:00

select-e2e.sh

feat(clickhouse): let the backup sidecar trust a private S3 CA, unblocking the backup e2e round-trip (#3385)

2026-08-10 21:17:47 +04:00

select-install_test.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

select-install.sh

test(e2e): fold the clickhouse backup Tests into the app's own suite

2026-07-30 16:04:03 +04:00

talos-image-cache_test.bats

test(e2e): pin that an unanswered mirror lookup is not a mirror absence

2026-08-09 13:31:54 +03:00

talos-reconcile-heredoc_test.bats

fix(kubernetes): escape tenant values in the worker reconcile heredoc

2026-08-09 16:17:26 +03:00

tenant-pre-delete-hook.bats

fix(tenant): bound the pre-delete cleanup waits and the hook Job

2026-08-07 14:38:06 +03:00

update-codegen.sh

feat(cozystack-controller): extract application CA into a key-free tenant Secret

2026-07-21 23:59:48 +03:00

update-crd.sh

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

upload-assets.sh

[docs] Added openapi generation tool

2026-03-25 15:57:25 +05:00

upload-releasenotes.sh

Add AI-agent for changelogs generation

2025-11-26 20:18:43 +01:00

validate-changelog.sh

ci(release): fix second-round review findings

2026-07-24 11:34:17 +05:00

verify-promoted-packages_test.bats

test(release): cover the verifier's rc-reference scan guard

2026-08-14 18:37:59 +05:00

verify-promoted-packages.sh

docs(release): say what the gates actually guarantee

2026-08-14 18:37:58 +05:00