Release from a fresh clone, ask for the versions, and rotate the changelog

Makefile

@@ -60,6 +60,7 @@ release-src: clean
 	--exclude .gitignore \
 	--exclude .DS_Store \
 	--exclude .github \
+	--exclude tools/releasing/skywalking-helm \
 	. && \
 	mv $(TMPDIR)/$(RELEASE_SRC).tgz .
 

chart/skywalking/Chart.yaml

@@ -16,7 +16,7 @@
 apiVersion: v2
 name: skywalking-helm
 home: https://skywalking.apache.org
-version: 5.0.0
+version: 5.1.0
 description: Helm Chart for Apache SkyWalking
 icon: https://raw.githubusercontent.com/apache/skywalking-kubernetes/master/logo/sw-logo-for-chart.jpg
 sources:

docs/README.md

@@ -55,7 +55,7 @@ the pod reports Ready and nobody can sign in until you configure users. See
 - **Every value** — [Chart Values](reference/skywalking-chart-values.md)
 - **Contributing** — [Run the E2E Tests](contributing/e2e-tests.md),
   [Package and Publish a Release](contributing/release.md)
-- **What changed in 5.0.0** — [Changelog](changes/changes.md)
+- **What changed** — [Changelog](changes/changes.md), and the [5.0.0 release notes](changes/changes-5.0.0.md)
 
 ## Related documentation
 

docs/changes/changes-5.0.0.md

@@ -0,0 +1,70 @@
+# Changelog
+
+## 5.0.0
+
+Targets SkyWalking OAP 11.0.0, Horizon UI 1.0.0 and BanyanDB 0.11.0. See
+[Upgrade](../upgrade/upgrading.md) for the migration steps.
+
+### Breaking changes
+
+- **OAP 11 requires BanyanDB 0.11.x.** OAP pins the BanyanDB server API versions it accepts
+  (`SW_STORAGE_BANYANDB_COMPATIBLE_SERVER_API_VERSIONS`, `0.11` in 11.0.0) and checks them with
+  string equality, so pairing OAP 11 with BanyanDB 0.10.x makes OAP refuse to start. The three
+  versions move together — see [Version Compatibility](../evaluate/version-compatibility.md).
+- **`oap.ports.admin` is required.** OAP 11 enables every admin feature module by default and
+  serves `/status/*` and `/debugging/*` on the admin port only; they are no longer mirrored on
+  `oap.ports.rest`. Horizon UI reads status, inspect, DSL debugging and the dashboard template
+  store from it.
+- **The legacy booster UI is no longer supported.** OAP 11 deleted `apm-webapp` and the
+  `skywalking-booster-ui` submodule along with the `docker.ui` build target, so
+  `apache/skywalking-ui` publishes no `11.x` tag — only `horizon-*` tags. Replace
+  `ui.image.tag=<oap-version>` with `ui.image.tag=horizon-1.0.0`.
+- **`oap.config.ui-initialized-templates` does nothing.** OAP 11 removed the on-disk dashboard
+  seed files and `UITemplateInitializer`, along with the sidebar menu storage, the
+  `UIConfigurationManagement` GraphQL mutations and `SW_ENABLE_UPDATE_UI_TEMPLATE`. Horizon UI
+  ships its own dashboard library and manages templates over the admin REST port.
+- **Horizon is configured by environment variable, and no ConfigMap is mounted by default.** The
+  image ships a complete env-tokenized `/app/horizon.yaml`; the chart sets only what it computes
+  (`HORIZON_SERVER_PORT`, `HORIZON_OAP_QUERY_URL`, and the admin, Zipkin and public URLs when
+  configured) and leaves the rest to `ui.extraEnv` / `ui.envFromSecret`. `ui.config` is now opt-in:
+  setting it renders a ConfigMap and mounts it *over* the image's file, so fields you do not write
+  fall back to Horizon's defaults. If you carried a `ui.config` block from the pre-release `main`
+  values, move it to environment variables — see [Configure Horizon](../ui/configure.md).
+- **The SWCK charts are removed.** `chart/operator` and `chart/adapter` packaged
+  [apache/skywalking-swck](https://github.com/apache/skywalking-swck) — its image, its CRDs and its
+  version — and had no relationship to `chart/skywalking`. They were never released to Docker Hub,
+  so no released artifact disappears, but installs from source or from the `ghcr.io` snapshot
+  channel will break. They belong with the operator, where the CRDs are generated alongside the
+  code that consumes them.
+- **The UI no longer proxies `/graphql`.** Callers that talked to the UI's GraphQL endpoint
+  (for example `swctl --base-url=http://<ui>/graphql`) must target the OAP service directly on
+  `oap.ports.rest`.
+
+### Features
+
+- `ui.extraVolumes` / `ui.extraVolumeMounts`, for the two Horizon settings that take a filesystem
+  path: `auth.tokensFile` and `sourceMaps.bootMountDir`.
+- `server.publicUrl` is derived from the first `ui.ingress.hosts` entry when an ingress is enabled,
+  so single sign-on callbacks and the OAuth issuer are built from the address operators actually
+  reach — see [UI Service and Ingress](../expose/ui-service-and-ingress.md).
+- `server.port` is derived from `ui.service.internalPort`, so the BFF binds the port the container
+  exposes.
+- `oap.extraEnv` (a list, so entries can carry `valueFrom`) and `oap.envFromSecret`, applied to the
+  OAP Deployment and the init Job. Note Kubernetes gives an explicit `env` entry precedence over
+  `envFrom`, and the chart sets `SW_ES_PASSWORD` / `SW_DATA_SOURCE_PASSWORD` itself — so sourcing
+  those from a Secret needs `oap.extraEnv`.
+- Horizon's config hot-reload works again. The chart previously mounted `horizon.yaml` with
+  `subPath`, which Kubernetes never updates in place, so the file watcher could not fire.
+- `tools/releasing/release.sh` and `release-passed.sh`, plus
+  [the release guide](../contributing/release.md) — the Apache process was previously unwritten.
+- The E2E suite is rebuilt around Horizon: every assertion runs through the UI's API rather than
+  OAP's GraphQL, so it exercises the path the chart is responsible for wiring.
+- Documentation moved into `docs/` and is published at
+  [skywalking.apache.org/docs/skywalking-helm](https://skywalking.apache.org/docs/skywalking-helm/next/readme/).
+
+### Corrections
+
+- Horizon UI does **not** refuse to start without configured users. It boots, serves the login
+  page, and answers `/api/auth/health` with 200 — which is this chart's readiness probe — so the
+  pod reports Ready and nobody can sign in. Earlier documentation claimed a `CrashLoopBackOff`.
+  See [Set Up Logins](../ui/logins.md).

docs/changes/changes.md

@@ -1,70 +1,11 @@
 # Changelog
 
-## 5.0.0
-
-Targets SkyWalking OAP 11.0.0, Horizon UI 1.0.0 and BanyanDB 0.11.0. See
-[Upgrade](../upgrade/upgrading.md) for the migration steps.
+## 5.1.0
 
 ### Breaking changes
 
-- **OAP 11 requires BanyanDB 0.11.x.** OAP pins the BanyanDB server API versions it accepts
-  (`SW_STORAGE_BANYANDB_COMPATIBLE_SERVER_API_VERSIONS`, `0.11` in 11.0.0) and checks them with
-  string equality, so pairing OAP 11 with BanyanDB 0.10.x makes OAP refuse to start. The three
-  versions move together — see [Version Compatibility](../evaluate/version-compatibility.md).
-- **`oap.ports.admin` is required.** OAP 11 enables every admin feature module by default and
-  serves `/status/*` and `/debugging/*` on the admin port only; they are no longer mirrored on
-  `oap.ports.rest`. Horizon UI reads status, inspect, DSL debugging and the dashboard template
-  store from it.
-- **The legacy booster UI is no longer supported.** OAP 11 deleted `apm-webapp` and the
-  `skywalking-booster-ui` submodule along with the `docker.ui` build target, so
-  `apache/skywalking-ui` publishes no `11.x` tag — only `horizon-*` tags. Replace
-  `ui.image.tag=<oap-version>` with `ui.image.tag=horizon-1.0.0`.
-- **`oap.config.ui-initialized-templates` does nothing.** OAP 11 removed the on-disk dashboard
-  seed files and `UITemplateInitializer`, along with the sidebar menu storage, the
-  `UIConfigurationManagement` GraphQL mutations and `SW_ENABLE_UPDATE_UI_TEMPLATE`. Horizon UI
-  ships its own dashboard library and manages templates over the admin REST port.
-- **Horizon is configured by environment variable, and no ConfigMap is mounted by default.** The
-  image ships a complete env-tokenized `/app/horizon.yaml`; the chart sets only what it computes
-  (`HORIZON_SERVER_PORT`, `HORIZON_OAP_QUERY_URL`, and the admin, Zipkin and public URLs when
-  configured) and leaves the rest to `ui.extraEnv` / `ui.envFromSecret`. `ui.config` is now opt-in:
-  setting it renders a ConfigMap and mounts it *over* the image's file, so fields you do not write
-  fall back to Horizon's defaults. If you carried a `ui.config` block from the pre-release `main`
-  values, move it to environment variables — see [Configure Horizon](../ui/configure.md).
-- **The SWCK charts are removed.** `chart/operator` and `chart/adapter` packaged
-  [apache/skywalking-swck](https://github.com/apache/skywalking-swck) — its image, its CRDs and its
-  version — and had no relationship to `chart/skywalking`. They were never released to Docker Hub,
-  so no released artifact disappears, but installs from source or from the `ghcr.io` snapshot
-  channel will break. They belong with the operator, where the CRDs are generated alongside the
-  code that consumes them.
-- **The UI no longer proxies `/graphql`.** Callers that talked to the UI's GraphQL endpoint
-  (for example `swctl --base-url=http://<ui>/graphql`) must target the OAP service directly on
-  `oap.ports.rest`.
-
 ### Features
 
-- `ui.extraVolumes` / `ui.extraVolumeMounts`, for the two Horizon settings that take a filesystem
-  path: `auth.tokensFile` and `sourceMaps.bootMountDir`.
-- `server.publicUrl` is derived from the first `ui.ingress.hosts` entry when an ingress is enabled,
-  so single sign-on callbacks and the OAuth issuer are built from the address operators actually
-  reach — see [UI Service and Ingress](../expose/ui-service-and-ingress.md).
-- `server.port` is derived from `ui.service.internalPort`, so the BFF binds the port the container
-  exposes.
-- `oap.extraEnv` (a list, so entries can carry `valueFrom`) and `oap.envFromSecret`, applied to the
-  OAP Deployment and the init Job. Note Kubernetes gives an explicit `env` entry precedence over
-  `envFrom`, and the chart sets `SW_ES_PASSWORD` / `SW_DATA_SOURCE_PASSWORD` itself — so sourcing
-  those from a Secret needs `oap.extraEnv`.
-- Horizon's config hot-reload works again. The chart previously mounted `horizon.yaml` with
-  `subPath`, which Kubernetes never updates in place, so the file watcher could not fire.
-- `tools/releasing/release.sh` and `release-passed.sh`, plus
-  [the release guide](../contributing/release.md) — the Apache process was previously unwritten.
-- The E2E suite is rebuilt around Horizon: every assertion runs through the UI's API rather than
-  OAP's GraphQL, so it exercises the path the chart is responsible for wiring.
-- Documentation moved into `docs/` and is published at
-  [skywalking.apache.org/docs/skywalking-helm](https://skywalking.apache.org/docs/skywalking-helm/next/readme/).
-
-### Corrections
+### Bugs
 
-- Horizon UI does **not** refuse to start without configured users. It boots, serves the login
-  page, and answers `/api/auth/health` with 200 — which is this chart's readiness probe — so the
-  pod reports Ready and nobody can sign in. Earlier documentation claimed a `CrashLoopBackOff`.
-  See [Set Up Logins](../ui/logins.md).
+### Documentation

docs/changes/changes.tpl

@@ -0,0 +1,11 @@
+# Changelog
+
+## NEXT_RELEASE_VERSION
+
+### Breaking changes
+
+### Features
+
+### Bugs
+
+### Documentation

docs/contributing/release.md

@@ -137,33 +137,61 @@ gpg --list-secret-keys --keyid-format=long
 
 ## 3. Build, verify, tag, upload and call the vote — `release.sh`
 
-**From a pristine clone of the release commit.** Linux and macOS both work — the build was
-verified end to end on each. A pristine clone matters for a different reason: preflight refuses to
-run against a dirty tree, and `release-src` archives the working *tree*, so any untracked file
-sitting in the checkout would otherwise be shipped inside the source release.
+**Run it from your own checkout.** Linux and macOS both work — the build was verified end to end
+on each.
 
 ```shell
-git clone git@github.com:apache/skywalking-helm && cd skywalking-helm
-
-bash tools/releasing/release.sh --dry-run   # everything except the tag push and the svn commit
+bash tools/releasing/release.sh --dry-run   # everything except the four writes
 bash tools/releasing/release.sh
 ```
 
-`--dry-run` still builds, signs and verifies, and still runs the svn checkout — it prints
-`svn status` instead of committing, and creates no tag. Use it to find out whether the build is good
-before anything leaves your machine.
+You do not need a clean tree, because the script does not build from your tree. It clones
+`apache/skywalking-helm` fresh into `tools/releasing/skywalking-helm/` and does everything there.
+That is not tidiness: `make release-src` archives the working *tree*, not `HEAD`, so releasing from
+a working copy ships whatever untracked files happen to be sitting in it — editor state, an agent
+directory, a half-finished values file. Cloning removes the question. Your checkout is only read,
+for the default version.
+
+Note that ignoring such a directory does **not** protect you — `tar` does not read `.gitignore`, so
+a gitignored directory is silently archived. That is why the clone is excluded in the Makefile *and*
+`verify_artifacts` inspects the finished tarball.
+
+It asks for both versions before doing anything, defaulting from your checkout's `Chart.yaml`:
+
+```
+=== Versions ===
+  release version:  5.1.0   (from your checkout's chart/skywalking/Chart.yaml)
+  next dev version: 5.2.0
+
+  Are these correct? [y/N]
+```
+
+Answer anything but `y` to type them in. Both must be plain `MAJOR.MINOR.PATCH` — they end up in a
+git tag, an svn path and a branch name, and refusing anything else keeps shell metacharacters out of
+all three.
+
+`--dry-run` still clones, builds, signs and verifies, and still runs the svn checkout and the
+next-version commit. It skips exactly four things: the tag push, the svn commit, the branch push and
+the PR.
 
 ### The order matters
 
 | Stage | What it does |
 | --- | --- |
+| `resolve_versions` | asks for the release and next-dev versions, defaulting from your `Chart.yaml` |
 | `preflight` | refuses to start (see below) |
-| `build` | `make clean` then `make release` — six files in the repository root |
-| `verify_artifacts` | signature, checksum and a real render of the packaged chart |
+| `clone_repo` | fresh clone into `tools/releasing/skywalking-helm/`; everything below runs there |
+| `build` | `make clean` then `make release` — six files in the clone |
+| `verify_artifacts` | signature, checksum, a real render, and an inspection of the source tarball |
 | `tag` | `git tag -a v$VERSION` and `git push origin v$VERSION` |
 | `upload_to_svn` | sparse checkout of `dist/dev/skywalking`, then `svn add` + `svn commit` |
+| `prepare_next_version` | rotates the changelog, bumps the chart, opens the next-version PR |
 | `vote_mail` | prints the mail, with the real checksums and commit hash filled in |
 
+`clone_repo` also refuses to continue unless master's `Chart.yaml` already says the release version.
+This project tags master as it stands, so if the version is not already there then master is not
+ready — and setting it inside the clone would tag a commit that exists nowhere else.
+
 The tag is pushed **after** the build and the artifact checks, deliberately. A tag pushed first
 survives a failed build, and preflight then refuses to re-run because `v$VERSION` exists — so the
 irreversible step comes last, and a failure leaves nothing on the remote to clean up.
@@ -177,12 +205,10 @@ Preflight refuses to start when:
   read;
 - `gpg` holds no secret key. `make release` signs with `gpg --batch`, so without one the run would
   fail *after* building and packaging everything;
+- `gh` is not authenticated. It opens the next-version PR at the very end, so an unauthenticated
+  `gh` would otherwise surface only after the vote candidate is already staged;
 - `dist/dev/skywalking` cannot be read — a network problem, or svn credentials that are not set up;
-- the working tree is dirty — `release-src` archives the working *tree*, not `HEAD`;
-- a `*.tgz`, `*.tgz.asc` or `*.tgz.sha512` is lying in the repository root. Those are gitignored, so
-  `git status` cannot see them, and a leftover from a previous release would be embedded in this
-  release's source tarball;
-- `v$VERSION` already exists, or `dist/dev/skywalking/helm/$VERSION` already does. The second catches
+- `v$VERSION` already exists on the remote, or `dist/dev/skywalking/helm/$VERSION` already does. The second catches
   a re-run after a partial upload, which would otherwise only surface at `svn commit` — after the
   build, the signing and the tag push.
 
@@ -194,7 +220,23 @@ the remote; preflight is the only place where stopping is free.
 are present, that `gpg --batch --verify` passes and that `shasum -a 512 -c` passes. It then runs
 `helm template` over the packaged chart and requires at least one rendered `kind:` — a chart that
 lints but renders nothing is a valid chart. That render uses `oap.storageType=elasticsearch` with
-`elasticsearch.enabled` left at its default `true`, so it exercises the ECK path.
+`elasticsearch.enabled` left at its default `true`, so it exercises the ECK path. Finally it lists
+the source tarball and fails if it contains the build clone, a `.tgz`, a `charts/` directory or a
+`Chart.lock`.
+
+### The next-version PR
+
+`prepare_next_version` runs after the candidate is staged, on a `bump-to-$NEXT` branch of the clone:
+
+- `chart/skywalking/Chart.yaml` moves to the next dev version — with `sed`, not `yq`, because `yq`
+  rewrites the whole document and turns a one-line bump into a fifty-line reindent;
+- `docs/changes/changes.md` becomes `docs/changes/changes-$VERSION.md`, and a fresh changelog is
+  rendered from `docs/changes/changes.tpl`;
+- `docs/menu.yml` gains the released version, inserted directly after `Current Version` so the
+  in-progress changelog keeps the top of the menu and released versions stay newest-first.
+
+Merge it once the vote thread is open. It cannot affect the artifacts under vote — those were built
+from the tag, before this branch existed.
 
 ### Send the vote mail
 
@@ -358,6 +400,7 @@ as a no *without* aborting, so it walks the whole plan and does none of it.
 
 | Stage | Prompt | Declining |
 | --- | --- | --- |
+| `resolve_version` | confirm the version to publish | — |
 | `preflight` | — | fails if `svn` / `gh` / `git` are missing, if `gh` is not authenticated, if `dist/release/skywalking` cannot be read, or if `dist/dev/skywalking/helm/$VERSION` does not exist |
 | `promote_artifacts` | `svn mv` from `dist/dev` to `dist/release` | aborts |
 | `remove_previous` | remove everything under `release/helm/` other than `$VERSION` | **skips and continues** — the one exception |

docs/menu.yml

@@ -89,4 +89,8 @@ catalog:
       - name: "Package and Publish a Release"
         path: "/contributing/release"
   - name: "Changelog"
-    path: "/changes/changes"
+    catalog:
+      - name: "Current Version"
+        path: "/changes/changes"
+      - name: "5.0.0"
+        path: "/changes/changes-5.0.0"

tools/releasing/.gitignore

@@ -0,0 +1,19 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# release.sh clones the repository here and builds the release inside it. Throwaway, and it
+# belongs in no commit. Note this does NOT keep it out of the source tarball -- tar does not read
+# .gitignore -- which is why the Makefile excludes it and release.sh inspects the finished archive.
+skywalking-helm/