Ensure release can only run from specific SHA

.github/workflows/release-2-update-release-candidate.yml

@@ -146,6 +146,7 @@ jobs:
           java-version: '21'
 
       - name: Update project versions
+        if: env.rc_number == '0'
         run: |
           source "${LIBS_DIR}/_version.sh"
 
@@ -156,6 +157,7 @@ jobs:
           EOT
 
       - name: Update changelog
+        if: env.rc_number == '0'
         run: |
           source "${LIBS_DIR}/_exec.sh"
           exec_process ./gradlew patchChangelog
@@ -166,6 +168,7 @@ jobs:
           EOT
 
       - name: Commit and push changes
+        if: env.rc_number == '0'
         run: |
           source "${LIBS_DIR}/_constants.sh"
           source "${LIBS_DIR}/_exec.sh"
@@ -176,19 +179,19 @@ jobs:
             "$HELM_CHART_YAML_FILE" \
             "$HELM_README_FILE" \
             "$CHANGELOG_FILE"
-          exec_process git commit -m "[chore] Bump version to ${version_without_rc} for release candidate ${rc_number}"
+          exec_process git commit -m "[chore] Bump version to ${version_without_rc}"
 
           # Push the changes
           exec_process git push origin "${release_branch}"
 
-          # Get the new commit SHA after our changes
-          new_tag_ref=$(git rev-parse HEAD)
-          echo "new_tag_ref=${new_tag_ref}" >> $GITHUB_ENV
-
       - name: Create RC tag at new commit
         run: |
           source "${LIBS_DIR}/_exec.sh"
 
+          # Get the new commit SHA after our changes
+          new_tag_ref=$(git rev-parse HEAD)
+          echo "new_tag_ref=${new_tag_ref}" >> $GITHUB_ENV
+
           # Create the tag at the new commit
           exec_process git tag "${release_tag}" "${new_tag_ref}"
           exec_process git push origin "${release_tag}"

.github/workflows/release-3-build-and-publish-artifacts.yml

@@ -73,8 +73,19 @@ jobs:
 
           echo "## Parameters" >> $GITHUB_STEP_SUMMARY
 
-          if ! git_tag=$(git describe --tags --exact-match HEAD 2>/dev/null); then
-            echo "❌ Current HEAD is not on a release candidate tag. Please checkout a release candidate tag first." >> $GITHUB_STEP_SUMMARY
+          # Extract the ref name from github.ref
+          # github.ref format: refs/heads/branch-name or refs/tags/tag-name
+          ref="${{ github.ref }}"
+
+          if [[ "${ref}" =~ ^refs/tags/(.+)$ ]]; then
+            # Running from a tag
+            git_tag="${BASH_REMATCH[1]}"
+          else
+            echo "❌ Workflow must be run from a release candidate tag, not a branch." >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Current ref: \`${ref}\`" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Please select a release candidate tag (e.g., \`apache-polaris-1.0.0-incubating-rc0\`) from the 'Use workflow from' dropdown in the GitHub UI." >> $GITHUB_STEP_SUMMARY
             exit 1
           fi
 

.github/workflows/release-4-publish-release.yml

@@ -92,38 +92,38 @@ jobs:
         run: |
           source "${LIBS_DIR}/_version.sh"
 
-          # Get the current branch name
-          current_branch=$(git branch --show-current)
-
           echo "## Parameters" >> $GITHUB_STEP_SUMMARY
 
-          # Validate that we're on a release branch
-          if [[ ! "${current_branch}" =~ ^release/(.+)$ ]]; then
-            echo "❌ This workflow must be run from a release branch (release/major.minor.x). Current branch: \`${current_branch}\`." >> $GITHUB_STEP_SUMMARY
+          # Extract the ref name from github.ref
+          # github.ref format: refs/heads/branch-name or refs/tags/tag-name
+          ref="${{ github.ref }}"
+
+          if [[ "${ref}" =~ ^refs/heads/release/(.+)$ ]]; then
+            # Running from a release branch
+            branch_version="${BASH_REMATCH[1]}"
+            current_branch="release/${branch_version}"
+          else
+            echo "❌ This workflow must be run from a release branch (release/major.minor.x)." >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Current ref: \`${ref}\`" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Please select a release branch (e.g., \`release/1.0.x\`) from the 'Use workflow from' dropdown in the GitHub UI." >> $GITHUB_STEP_SUMMARY
             exit 1
           fi
 
-          # Extract version from release branch name
-          branch_version="${BASH_REMATCH[1]}"
-
           # Validate branch version format and extract components
           if ! validate_and_extract_branch_version "${branch_version}"; then
             echo "❌ Invalid release branch version format: \`${branch_version}\`. Expected format: major.minor.x." >> $GITHUB_STEP_SUMMARY
             exit 1
           fi
 
-          # Find the next patch number for this major.minor version by looking at existing tags
+          # Find the patch number for this major.minor version by looking at existing tags
+          # Note: find_next_patch_number returns the current patch if no final tag exists,
+          # which is exactly what we need for publishing (we publish from an RC that has no final tag yet)
           find_next_patch_number "${major}" "${minor}"
-          next_patch=$((patch))
-          latest_patch=$((next_patch - 1))
-
-          if [[ ${next_patch} -eq 0 ]]; then
-            echo "❌ No existing tags found for version \`${major}.${minor}.0\`. Expected at least one RC to be created before publishing a release." >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
 
-          # Build the version string for the latest existing patch
-          version_without_rc="${major}.${minor}.${latest_patch}-incubating"
+          # Build the version string for the patch with RC tags
+          version_without_rc="${major}.${minor}.${patch}-incubating"
 
           # Find the latest RC tag for this version
           find_next_rc_number "${version_without_rc}"
@@ -142,6 +142,21 @@ jobs:
             exit 1
           fi
 
+          # Verify that current HEAD is at the RC tag commit
+          rc_commit=$(git rev-parse "${rc_tag}")
+          current_commit=$(git rev-parse HEAD)
+
+          if [[ "${current_commit}" != "${rc_commit}" ]]; then
+            echo "❌ Current HEAD (\`${current_commit}\`) does not match RC tag \`${rc_tag}\` (\`${rc_commit}\`)." >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "This means that some commits have been made on the release branch after the last RC was created." >> $GITHUB_STEP_SUMMARY
+            echo "You should not publish a release from a branch that has received additional commits after the last RC was created." >> $GITHUB_STEP_SUMMARY
+            echo "Either remove the commits from the release branch so that it points to the last RC that was voted on, or create a new RC from the current state of the branch." >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+          echo "✅ Current HEAD matches RC tag \`${rc_tag}\`" >> $GITHUB_STEP_SUMMARY
+
           # Create final release tag name
           final_release_tag="apache-polaris-${version_without_rc}"
 

releasey/libs/_version.sh

@@ -146,19 +146,23 @@ function find_next_patch_number {
   # This function finds the next available patch number for a given major.minor version.
   # It returns 0 and sets the global variable patch to the next available patch number.
   # Patch numbers start from 0. It takes major and minor as input (e.g., "1", "0").
+  #
+  # The patch number should only be incremented if there is a final release tag (without -rc suffix)
+  # for the current highest patch. If only RC tags exist for the highest patch, we should reuse
+  # that patch number (allowing for additional RCs like rc1, rc2, etc.).
   local major="$1"
   local minor="$2"
 
-  # Get all existing tags for this major.minor version
-  local tag_pattern="apache-polaris-${major}.${minor}.*-incubating-rc*"
-  local existing_tags
-  existing_tags=$(git tag -l "${tag_pattern}" | sort -V)
+  # Get all existing RC tags for this major.minor version
+  local rc_tag_pattern="apache-polaris-${major}.${minor}.*-incubating-rc*"
+  local existing_rc_tags
+  existing_rc_tags=$(git tag -l "${rc_tag_pattern}" | sort -V)
 
-  if [[ -z "${existing_tags}" ]]; then
-    # No existing tags, start with patch 0
+  if [[ -z "${existing_rc_tags}" ]]; then
+    # No existing RC tags, start with patch 0
     patch=0
   else
-    # Extract all patch numbers and find the highest
+    # Extract all patch numbers from RC tags and find the highest
     local highest_patch=-1
     while IFS= read -r tag; do
       if [[ ${tag} =~ apache-polaris-${major}\.${minor}\.([0-9]+)-incubating-rc[0-9]+ ]]; then
@@ -167,10 +171,17 @@ function find_next_patch_number {
           highest_patch=${current_patch}
         fi
       fi
-    done <<< "${existing_tags}"
-
-    # Increment the highest patch number found
-    patch=$((highest_patch + 1))
+    done <<< "${existing_rc_tags}"
+
+    # Check if a final release tag exists for the highest patch (without -rc suffix)
+    local final_tag="apache-polaris-${major}.${minor}.${highest_patch}-incubating"
+    if git rev-parse "${final_tag}" >/dev/null 2>&1; then
+      # Final release tag exists, increment to next patch number
+      patch=$((highest_patch + 1))
+    else
+      # No final release tag yet, reuse the same patch number for additional RCs
+      patch=${highest_patch}
+    fi
   fi
 
   return 0