Skip to content

feat(release): step control flags for hashrelease and release build/publish#12615

Open
radTuti wants to merge 5 commits intoprojectcalico:masterfrom
radTuti:encore-p1-unified-flags
Open

feat(release): step control flags for hashrelease and release build/publish#12615
radTuti wants to merge 5 commits intoprojectcalico:masterfrom
radTuti:encore-p1-unified-flags

Conversation

@radTuti
Copy link
Copy Markdown
Contributor

@radTuti radTuti commented Apr 24, 2026

Adds a unified set of step-control flags to hashrelease build/publish and release build/publish so operators can skip individual build/publish steps (manifests, OCP bundle, helm charts, helm index, binaries, windows archive, images, tarball) from the CLI or via env vars. Every flag is honored at its actual build site in the Manager rather than being validated and ignored, and post-build reformatters tolerate skipped artifacts.

Also tightens flag parity between hashrelease and release (shared productFlags, consistent BUILD_*/PUBLISH_* and RELEASE_* env var prefixes, removal of a dead --helm-index on hashrelease publish, and a missing --skip-branch-check on release build).

Default-on bool flags now use cli.BoolWithInverseFlag, so users can write --no-images instead of --images=false. The development --skip-* flags are renamed to positive defaults: --validate, --validate-branch, --image-scan; the old SKIP_* env vars are dropped. Builders for images, archive-images, helm-charts, helm-index, windows-archive, and operator take per-command env var lists from buildStepFlags / publishStepFlags so build vs publish can disagree (e.g. BUILD_CONTAINER_IMAGES vs PUBLISH_IMAGES); legacy aliases like ARCHIVE_IMAGES, UPDATE_HELM_INDEX, and PUBLISH_GIT_TAG are listed first in Sources so existing CI configs keep winning precedence. New gates --e2e-binaries and --release-notes are added to hashrelease build. Cross-flag invariants are enforced via flag Action callbacks on the prerequisite flag (so they fire when the user toggles only the prerequisite). The duplicate archive-images runtime guard is dropped now that urfave/cli v3.8.0 runs Action reliably for env-set flags (urfave/cli#2221). release/cmd/flags_test.go covers the cross-flag Actions.

Release note:

None

@radTuti radTuti requested a review from a team as a code owner April 24, 2026 18:49
@marvin-tigera marvin-tigera added this to the Calico v3.33.0 milestone Apr 24, 2026
@marvin-tigera marvin-tigera added release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Apr 24, 2026
@radTuti radTuti added release-note-not-required Change has no user-facing impact docs-not-required Docs not required for this change labels Apr 24, 2026
@marvin-tigera marvin-tigera removed release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Apr 24, 2026
@radTuti radTuti requested a review from a team April 24, 2026 21:15
radTuti added 5 commits April 24, 2026 21:35
Adds per-step control flags that gate logical release steps in build
and publish commands. Factory flag pattern allows context-appropriate
defaults and env vars per command.

Mirror of calico-private changes (OSS subset).
- Gate updateHelmChartIndex on r.helmIndex instead of r.helmCharts
- Gate buildReleaseTar on r.tarball (was unconditional)
- Limit publishStepFlags to publish-only concerns, using envPublish*
  sources so PUBLISH_IMAGES / PUBLISH_CHARTS are honored again
- Narrow OCP-bundle precheck to hashrelease, where --manifests
  actually gates the manifest copy step
- Rename --operator env source to RELEASE_OPERATOR for consistency
  with other RELEASE_* step control vars
- Switch hashreleasePublishFlags to productFlags and drop dead gitFlags
- Register skipBranchCheckFlag on releaseBuildFlags; pass
  WithValidate / WithReleaseBranchValidation unconditionally in the
  release build action, matching hashrelease build
- Drop skipValidationFlag from releasePublishFlags (unreferenced)
Previously most step-control flags only gated the collect-to-upload-dir
step; the underlying build steps ran unconditionally, so setting --X=false
did not save build time and the artifact still landed in the release
tarball. Make each flag honest at the build site:

- BuildHelm: gate chart build on --helm-charts; gate index build on
  --helm-index. Skipping charts implicitly skips the index.
- buildBinaries: early-return on --binaries=false, independent of the
  existing --images fast-path.
- buildOCPBundle: gate on --ocp-bundle.
- Hashrelease windows targets in Build(): gate on --windows-archive.
- buildReleaseTar: gate the manifests copy on --manifests and the
  binaries copy on --binaries (previously both unconditional).

Refactor the hashrelease manifests/OCP dependency into a single
buildManifests step. Manifests regen and OCP build now live together
under one deferred resetManifests at Build() scope so downstream
consumers (collectManifests, buildReleaseTar) still see the regenerated
pinned manifests. resetManifests is self-guarded on r.manifests so it
becomes a no-op when nothing was regenerated.

Remove --helm-index from hashrelease publish: PublishRelease for
hashrelease routes through publishToHashreleaseServer and never hits
updateHelmChartIndex.

Teach ReformatHashrelease to tolerate missing artifacts: the post-build
reformatter hardcoded copies of calico-windows-*.zip, ocp.tgz, and
per-chart tarballs. When step-control flags skip any of those artifacts
the copy failed with open ... no such file or directory. Introduce a
copyIfExists helper that skips (with an info log) when the source is
missing so the reformatter follows the same honor-the-flags discipline
as the build steps above.
[DE-4116]

- Default-on bool flags use cli.BoolWithInverseFlag (--no-foo form).
- Skip-* flags renamed to positive: --validate, --validate-branch,
  --image-scan. Old SKIP_* env vars dropped.
- Builders (images, archive-images, helm-charts, helm-index,
  windows-archive, operator) take env-var lists per command. Legacy
  aliases (ARCHIVE_IMAGES, UPDATE_HELM_INDEX, PUBLISH_GIT_TAG) listed
  first so existing CI wins precedence.
- New hashrelease build gates: --e2e-binaries, --release-notes.
- Cross-flag invariants on the prerequisite flag's Action.
- Drop redundant archive-images runtime guard (urfave/cli v3.8.0 runs
  Action for env-set flags -- urfave/cli#2221).
- Add release/cmd/flags_test.go.
@radTuti radTuti force-pushed the encore-p1-unified-flags branch from 48a3385 to 5023b54 Compare April 25, 2026 04:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docs-not-required Docs not required for this change release-note-not-required Change has no user-facing impact

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants