Versioning + extract-binaries-from-image future

[amandahla]

Description

Our release pipeline failed because it was tracking the "development" branch, where the extract-binaries-from-image task was recently removed. We initially attempted to fix this by pinning the pipeline to a specific commit, but this was unsuccessful. As a temporary workaround, we pointed the revision to the "production" branch. However, this does not guarantee stability, as tasks on the production branch could still change or break in the future.

Questions

• Is it possible to lock task versions using Git tags to ensure we are always running the exact same version of a pipeline task?
• What is the recommended task (s) for releasing binaries to GitHub?

Reference

extracted from our RPA

 pipeline:
    pipelineRef:
      resolver: git
      params:
        - name: url
          value: "https://github.com/konflux-ci/release-service-catalog.git"
        - name: revision
          value: production
        - name: pathInRepo
          value: "pipelines/managed/release-to-github/release-to-github.yaml"
    serviceAccountName: release-github-terraform-prod
    taskRunSpecs:
      - pipelineTaskName: extract-binaries-from-image
        stepSpecs:
          - name: create-trusted-artifact
            computeResources: &compute_resources
              limits:
                cpu: "2"
                memory: 2Gi
              requests:
                cpu: "2"
                memory: 2Gi
      - pipelineTaskName: populate-release-notes
        stepSpecs:
          - name: create-trusted-artifact
            computeResources: *compute_resources
      - pipelineTaskName: collect-gh-params
        stepSpecs:
          - name: use-trusted-artifact
            computeResources: *compute_resources
      - pipelineTaskName: populate-release-notes
        stepSpecs:
          - name: use-trusted-artifact
            computeResources: *compute_resources
          - name: create-trusted-artifact
            computeResources: *compute_resources
      - pipelineTaskName: check-data-keys
        stepSpecs:
          - name: use-trusted-artifact
            computeResources: *compute_resources
          - name: create-trusted-artifact
            computeResources: *compute_resources
      - pipelineTaskName: embargo-check
        stepSpecs:
          - name: use-trusted-artifact
            computeResources: *compute_resources
          - name: create-trusted-artifact
            computeResources: *compute_resources
      - pipelineTaskName: base64-encode-checksum
        stepSpecs:
          - name: use-trusted-artifact
            computeResources: *compute_resources
      - pipelineTaskName: sign-base64-blob
        stepSpecs:
          - name: use-trusted-artifact
            computeResources: *compute_resources
          - name: create-trusted-artifact
            computeResources: *compute_resources
      - pipelineTaskName: create-github-release
        stepSpecs:
          - name: use-trusted-artifact
            computeResources: *compute_resources
          - name: create-trusted-artifact
            computeResources: *compute_resources
      - pipelineTaskName: create-advisory
        stepSpecs:
          - name: use-trusted-artifact
            computeResources: *compute_resources
          - name: create-trusted-artifact
            computeResources: *compute_resources
      - pipelineTaskName: close-advisory-issues
        stepSpecs:
          - name: use-trusted-artifact
            computeResources: *compute_resources
          - name: create-trusted-artifact
            computeResources: *compute_resources

[johnbieren]

The task extract-binaries-from-image wasn't removed, it was renamed, see a9f205d.
As far as your questions:

Is it possible to lock task versions using Git tags to ensure we are always running the exact same version of a pipeline task?

No. The release-service operator changes as well, so there is no guarantee that any old pipelines will work with the current version of the operator. We only support development, staging, and production branches in release-service-catalog.

What is the recommended task (s) for releasing binaries to GitHub?

We don't have recommended tasks for releasing, only pipelines. The recommended pipeline is release-to-github

In general if you are releasing content, we'd recommend using production, not development, as that has the most testing and validation. I see from your RPA snippet that you are using production, which is good