Automate the multi-module release with release-all.sh by tsuzu · Pull Request #6183 · kubernetes-sigs/kustomize

tsuzu · 2026-07-08T18:31:36Z

Summary

Add releasing/release-all.sh to run the full kyaml → cmd/config → api → kustomize release sequence in one invocation, matching the one-command flow requested in Release automation #5866 (koba1t's follow-up). A release no longer requires 4 sequential PRs for the intermediate pin updates; the whole cycle lives on a single release-vX.Y.Z branch and lands as one "Release vX.Y.Z" PR at the end.
Rework gorepomod release to require an explicit --release-branch, and share one branch across all four module releases (release-v{major}.{minor}.{patch}) instead of the previous per-module release-{module}-{minor} naming.
Rewrite releasing/README.md to lead with the scripted flow; the manual step-by-step runbook is preserved under a <details> fallback for major releases or ad-hoc use.
BREAKING CHANGE: gorepomod release now requires the --release-branch <branch> flag. Manual invocations in releasing/README.md are updated accordingly.

Out of scope of this PR

The umbrella issue #5866 has more steps than this PR covers. Left manual / for follow-up:

Publish Official Docker Image: still done via the k8s.io PR flow described in releasing/README.md
Update kustomize-in-kubectl: still done via hack/update-kustomize.sh in kubernetes/kubernetes
GitHub Actions-driven trigger: this PR delivers the "one script" variant; wiring it into a workflow can follow as a separate change
Major releases: release-all.sh supports patch|minor only; use the manual flow

Question for reviewers

The release workflow leaves 4 GitHub Releases (kyaml, cmd/config, api, kustomize) in draft state, and the postflight message tells the release engineer to review and undraft them. Would you rather:

(a) keep the manual undraft as a review gate (current behavior), or
(b) have release-all.sh also undraft the 4 releases automatically once each workflow completes?

Special notes for reviewers

This PR was written in part with the assistance of generative AI.

kubernetes-prow · 2026-07-08T18:31:39Z

This PR has multiple commits, and the default merge method is: merge.
You can request commits to be squashed using the label: tide/merge-method-squash

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

kubernetes-prow · 2026-07-08T18:31:39Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

tsuzu · 2026-07-08T18:50:30Z

End-to-end test (with `--do-it`, on my fork)

I ran the full cycle end-to-end against tsuzu/kustomize and confirmed it drives all four module releases plus the final PR in one invocation. The release completed successfully.

How the run reached the fork

sigs.k8s.io/kustomize resolves via go-import meta redirect to github.com/kubernetes-sigs/kustomize, so gorepomod pin (which invokes go mod tidy) would try to fetch the freshly pushed tag from upstream and fail. I worked around that with a local wrapper (not part of this PR) that, for the duration of the run:

creates a sandboxed GIT_CONFIG_GLOBAL with url.<my-fork>.insteadOf https://github.com/kubernetes-sigs/kustomize so git operations reach the fork
exports GOPROXY=direct GOSUMDB=off so go mod bypasses the proxy/sumdb and resolves modules via git directly
removes the upstream remote so gorepomod's DetermineRemoteToUse picks origin
puts a fake make on PATH that no-ops verify-kustomize-repo (so the e2e finishes in seconds instead of ~15 min)

In a real release from kubernetes-sigs/kustomize none of this shimming is needed — tags are pushed to the canonical repo and go mod resolves them normally.

Full script output

=== START 2026-07-09T03:44:30+09:00 ===
=== fork: tsuzu/kustomize ===
=== base: master ===
=== bumps: module=patch kustomize=patch ===

[release-all.sh] base branch: master
[release-all.sh] release branch: release-v5.8.7
[release-all.sh] remote: origin
[release-all.sh] GitHub repo: tsuzu/kustomize
[release-all.sh] module bump: patch -> v0.22.5
[release-all.sh] kustomize bump: patch -> v5.8.7
[release-all.sh] + git checkout master
Switched to branch 'master'
Your branch is up to date with 'origin/master'.
[release-all.sh] + git fetch origin master
From https://github.com/tsuzu/kustomize
 * branch                master     -> FETCH_HEAD
[release-all.sh] + git merge --ff-only origin/master
Already up to date.
[release-all.sh] + make IS_LOCAL=true verify-kustomize-repo
(test wrapper) skipping verify-kustomize-repo
[release-all.sh] + go tool gorepomod release kyaml patch --release-branch release-v5.8.7 --doIt --local
Releasing kyaml, stepping from v0.22.4 to v0.22.5
  assuring a clean workspace
    [x] /opt/homebrew/bin/git status
  fetching remote
    [x] /opt/homebrew/bin/git fetch origin
  assuring a clean workspace
    [x] /opt/homebrew/bin/git status
  looking for branch on remote
    [x] /opt/homebrew/bin/git branch -r
  creating branch
    [x] /opt/homebrew/bin/git checkout -B release-v5.8.7 origin/master
  merging from remote
    [x] /opt/homebrew/bin/git merge --ff-only origin/master
  pushing branch to remote
    [x] /opt/homebrew/bin/git push -f origin release-v5.8.7
  creating local release tag
    [x] /opt/homebrew/bin/git tag -a -m "Release kyaml/v0.22.5 on branch release-v5.8.7" kyaml/v0.22.5
  pushing tag to remote
    [x] /opt/homebrew/bin/git push origin kyaml/v0.22.5
[release-all.sh] + go tool gorepomod pin kyaml v0.22.5 --doIt --local
[release-all.sh] + git commit -am Update kyaml to v0.22.5
[release-v5.8.7 6b48e7da0] Update kyaml to v0.22.5
 64 files changed, 96 insertions(+), 96 deletions(-)
[release-all.sh] + git push origin release-v5.8.7
To https://github.com/tsuzu/kustomize.git
   71909da60..6b48e7da0  release-v5.8.7 -> release-v5.8.7
[release-all.sh] + make IS_LOCAL=true verify-kustomize-repo
(test wrapper) skipping verify-kustomize-repo
[release-all.sh] + go tool gorepomod release cmd/config patch --release-branch release-v5.8.7 --doIt --local
Releasing cmd/config, stepping from v0.22.4 to v0.22.5
  assuring a clean workspace
    [x] /opt/homebrew/bin/git status
  fetching remote
    [x] /opt/homebrew/bin/git fetch origin
  assuring a clean workspace
    [x] /opt/homebrew/bin/git status
  looking for branch on remote
    [x] /opt/homebrew/bin/git branch -r
  checking out branch
    [x] /opt/homebrew/bin/git checkout release-v5.8.7
  merging from remote
    [x] /opt/homebrew/bin/git merge --ff-only origin/master
  pushing branch to remote
    [x] /opt/homebrew/bin/git push -f origin release-v5.8.7
  creating local release tag
    [x] /opt/homebrew/bin/git tag -a -m "Release cmd/config/v0.22.5 on branch release-v5.8.7" cmd/config/v0.22.5
  pushing tag to remote
    [x] /opt/homebrew/bin/git push origin cmd/config/v0.22.5
[release-all.sh] + go tool gorepomod pin cmd/config v0.22.5 --doIt --local
[release-all.sh] + git commit -am Update cmd/config to v0.22.5
[release-v5.8.7 cdcbe91f9] Update cmd/config to v0.22.5
 2 files changed, 3 insertions(+), 3 deletions(-)
[release-all.sh] + git push origin release-v5.8.7
To https://github.com/tsuzu/kustomize.git
   6b48e7da0..cdcbe91f9  release-v5.8.7 -> release-v5.8.7
[release-all.sh] + make IS_LOCAL=true verify-kustomize-repo
(test wrapper) skipping verify-kustomize-repo
[release-all.sh] + go tool gorepomod release api patch --release-branch release-v5.8.7 --doIt --local
Releasing api, stepping from v0.22.4 to v0.22.5
  ... (same structure) ...
  pushing tag to remote
    [x] /opt/homebrew/bin/git push origin api/v0.22.5
[release-all.sh] + go tool gorepomod pin api v0.22.5 --doIt --local
[release-all.sh] + git commit -am Update api to v0.22.5
[release-v5.8.7 ec5f51ac0] Update api to v0.22.5
 60 files changed, 90 insertions(+), 90 deletions(-)
[release-all.sh] + git push origin release-v5.8.7
[release-all.sh] + make IS_LOCAL=true verify-kustomize-repo
(test wrapper) skipping verify-kustomize-repo
[release-all.sh] + go tool gorepomod release kustomize patch --release-branch release-v5.8.7 --doIt --local
Releasing kustomize, stepping from v5.8.6 to v5.8.7
  ... (same structure) ...
  pushing tag to remote
    [x] /opt/homebrew/bin/git push origin kustomize/v5.8.7
[release-all.sh] + go tool gorepomod unpin api --doIt --local
[release-all.sh] + go tool gorepomod unpin cmd/config --doIt --local
[release-all.sh] + go tool gorepomod unpin kyaml --doIt --local
[release-all.sh] + sed -i.bak s/LATEST_RELEASE=.*/LATEST_RELEASE=v5.8.7/ Makefile
[release-all.sh] + rm -f Makefile.bak
[release-all.sh] + git commit -am Back to development mode after v5.8.7
[release-v5.8.7 10aff28ef] Back to development mode after v5.8.7
 65 files changed, 127 insertions(+), 127 deletions(-)
[release-all.sh] + git push origin release-v5.8.7
https://github.com/tsuzu/kustomize/pull/8
[release-all.sh] release branch automation completed
[release-all.sh] waiting for release workflow run for kyaml/v0.22.5
[release-all.sh] waiting for release workflow run for cmd/config/v0.22.5
[release-all.sh] waiting for release workflow run for api/v0.22.5
[release-all.sh] waiting for release workflow run for kustomize/v5.8.7

Next steps:
  PR: https://github.com/tsuzu/kustomize/pull/8

  Watch release workflows:
    kyaml/v0.22.5:      https://github.com/tsuzu/kustomize/actions/runs/28967213996
    cmd/config/v0.22.5: https://github.com/tsuzu/kustomize/actions/runs/28967223710
    api/v0.22.5:        https://github.com/tsuzu/kustomize/actions/runs/28967231646
    kustomize/v5.8.7:   https://github.com/tsuzu/kustomize/actions/runs/28967242646

  After the workflows finish, open the releases page and undraft the
  4 drafts (kyaml/v0.22.5, cmd/config/v0.22.5, api/v0.22.5, kustomize/v5.8.7):
    https://github.com/tsuzu/kustomize/releases

=== END 2026-07-09T03:45:27+09:00 rc=0 ===

koba1t · 2026-07-11T13:57:31Z

/ok-to-test

…ody)

koba1t

@tsuzu
Thank you for your work!
I have added some review comments. Please take a time to check them.

koba1t · 2026-07-24T14:41:42Z

+    --kustomize-bump patch|minor \
+    [--branch release-vX.Y.Z] \
+    [--base master] \
+    [--remote upstream|origin] \


--remote controls the shell script’s branch checks, pushes, gh repo, PR creation, and workflow lookup, but it is not passed to gorepomod release. gorepomod independently prefers upstream over origin.
With both remotes configured, --remote origin can therefore push release tags to upstream while pushing the final branch and creating the PR against origin. The fork E2E had to remove upstream to avoid this exact behavior.

Please remove the unsupported --remote origin path.

koba1t · 2026-07-24T14:42:44Z

+    --module-bump patch|minor \
+    --kustomize-bump patch|minor \
+    [--branch release-vX.Y.Z] \
+    [--base master] \


The public --base option is not honored by gorepomod. The shell script checks out and creates the final PR against the selected base, but gorepomod still creates the release branch from /master and merges /master.

Please remove --base and explicitly support only master.

koba1t · 2026-07-25T20:26:49Z

+The recommended release path is to automate the process from `Release kyaml` through `Return the repo to development mode` with [`release-all.sh`](./release-all.sh).
+
+```bash
+releasing/release-all.sh \


This script pushes the release branch and module tags incrementally, but a later failure leaves those remote resources behind and the next run immediately fails because the release branch already exists.

Is it possible to add a way to resume or rollback if scripts fail until complete through?

koba1t · 2026-07-25T20:33:34Z

 After establishing the version, the command looks for a branch named

-> _release-{module}/-v{major}.{minor}_
+> _release-v{major}.{minor}.{patch}_


Nit: --release-branch is used preferentially here, it may be a good to update the description.

koba1t · 2026-07-25T20:40:33Z

 	if err := gr.CheckoutReleaseBranch(mgr.remoteName, relBranch); err != nil {
 		return err
 	}
 	if err := gr.MergeFromRemoteMain(mgr.remoteName); err != nil {


Since MergeFromRemoteMain() is executed here, wouldn't the contents of the master branch get merged in with every release of each module?

saitejabandaru-in

LGTM! This is a fantastic improvement to the release process. Consolidating the releases onto a single release branch and pushing the tags from there is much more streamlined than the previous iterative PR-per-module approach. The release-all.sh script looks very robust.

kubernetes-prow · 2026-08-10T17:06:00Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: saitejabandaru-in, tsuzu
Once this PR has been reviewed and has the lgtm label, please assign varshaprasad96 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kubernetes-prow Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 8, 2026

kubernetes-prow Bot requested review from koba1t and varshaprasad96 July 8, 2026 18:31

kubernetes-prow Bot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jul 8, 2026

kubernetes-prow Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jul 11, 2026

tsuzu added 10 commits July 23, 2026 23:36

gorepomod release: require explicit --release-branch flag

856c8bd

releasing: add release-all.sh automation script

52c1296

releasing: align release-all.sh with the manual flow

24641e3

releasing: use --local for gorepomod in both flows

29fa049

releasing: retitle the final release PR

c220af2

releasing: keep go.work.sum out of release-branch commits

9450029

releasing: guard against go.work.sum drift instead of auto-restoring

049142c

releasing: link to releases page for undraft, not draft-specific URLs

80fac27

releasing: drop --no-test flag and go.work.sum guard

b82a671

gorepomod: dedupe --release-branch args branches (gocritic dupBranchB…

5c4c3bd

…ody)

tsuzu force-pushed the feat/release-script branch from 046563e to 5c4c3bd Compare July 23, 2026 15:10

kubernetes-prow Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 23, 2026

koba1t added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Jul 23, 2026

tsuzu marked this pull request as ready for review July 23, 2026 16:23

kubernetes-prow Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 23, 2026

kubernetes-prow Bot requested a review from sarab97 July 23, 2026 16:23

koba1t requested changes Jul 25, 2026

View reviewed changes

saitejabandaru-in approved these changes Aug 10, 2026

View reviewed changes

Navigation Menu

Uh oh!

Automate the multi-module release with release-all.sh - #6183

Automate the multi-module release with release-all.sh#6183
tsuzu wants to merge 10 commits into
kubernetes-sigs:masterfrom
tsuzu:feat/release-script

tsuzu commented Jul 8, 2026 •

edited

Loading

Uh oh!

kubernetes-prow Bot commented Jul 8, 2026

Uh oh!

kubernetes-prow Bot commented Jul 8, 2026

Uh oh!

tsuzu commented Jul 8, 2026

Uh oh!

koba1t commented Jul 11, 2026

Uh oh!

koba1t left a comment

Uh oh!

koba1t Jul 24, 2026

Uh oh!

koba1t Jul 24, 2026

Uh oh!

koba1t Jul 25, 2026

Uh oh!

koba1t Jul 25, 2026

Uh oh!

koba1t Jul 25, 2026

Uh oh!

saitejabandaru-in left a comment

Uh oh!

kubernetes-prow Bot commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

tsuzu commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Out of scope of this PR

Question for reviewers

Special notes for reviewers

Uh oh!

kubernetes-prow Bot commented Jul 8, 2026

Uh oh!

kubernetes-prow Bot commented Jul 8, 2026

Uh oh!

tsuzu commented Jul 8, 2026

End-to-end test (with --do-it, on my fork)

How the run reached the fork

Uh oh!

koba1t commented Jul 11, 2026

Uh oh!

koba1t left a comment

Choose a reason for hiding this comment

Uh oh!

koba1t Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

koba1t Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

koba1t Jul 25, 2026

Choose a reason for hiding this comment

Uh oh!

koba1t Jul 25, 2026

Choose a reason for hiding this comment

Uh oh!

koba1t Jul 25, 2026

Choose a reason for hiding this comment

Uh oh!

saitejabandaru-in left a comment

Choose a reason for hiding this comment

Uh oh!

kubernetes-prow Bot commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tsuzu commented Jul 8, 2026 •

edited

Loading

End-to-end test (with `--do-it`, on my fork)