Skip to content

release-26.1: build,release: forward IS_PRODUCTION_REPO into the release binary#170392

Merged
trunk-io[bot] merged 1 commit into
cockroachdb:release-26.1from
rail:blathers/backport-release-26.1-170388
May 15, 2026
Merged

release-26.1: build,release: forward IS_PRODUCTION_REPO into the release binary#170392
trunk-io[bot] merged 1 commit into
cockroachdb:release-26.1from
rail:blathers/backport-release-26.1-170388

Conversation

@rail
Copy link
Copy Markdown
Member

@rail rail commented May 15, 2026 •
edited
Loading

Backport 1/1 commits from #170388 on behalf of @rail.

The release binary's isProductionRepo() check reads the IS_PRODUCTION_REPO env var to decide between the production Slack channel (#db-release-status) and the rehearsal channel (#db-release-test). The branch-cut and pick-sha workflows gate themselves on vars.IS_PRODUCTION_REPO via their job-level if:, but never exported the value to the run step or the bazel docker container. As a result, a non-dry-run on the production repo still routed Slack to #db-release-test.

Add IS_PRODUCTION_REPO to each workflow's env: block and to the docker -e passthrough list in the wrapper scripts, so the var reaches the binary on both layers.

Release note: None
Epic: none

Release justification: release automation changes

@rail
build,release: forward IS_PRODUCTION_REPO into the release binary
2203403 
The release binary's isProductionRepo() check reads the IS_PRODUCTION_REPO
env var to decide between the production Slack channel
(#db-release-status) and the rehearsal channel (#db-release-test). The
branch-cut and pick-sha workflows gate themselves on
vars.IS_PRODUCTION_REPO via their job-level if:, but never exported the
value to the run step or the bazel docker container. As a result, a
non-dry-run on the production repo still routed Slack to
#db-release-test.

Add IS_PRODUCTION_REPO to each workflow's env: block and to the docker
-e passthrough list in the wrapper scripts, so the var reaches the
binary on both layers.

Release note: None
Epic: none
@rail rail requested a review from a team as a code owner May 15, 2026 15:14
@blathers-crl blathers-crl Bot added blathers-backport This is a backport that Blathers created automatically. O-robot Originated from a bot. labels May 15, 2026
@trunk-io
Copy link
Copy Markdown
Contributor

trunk-io Bot commented May 15, 2026 •
edited
Loading

😎 Merged successfully - details.

@blathers-crl blathers-crl Bot requested a review from jlinder May 15, 2026 15:14
@blathers-crl
Copy link
Copy Markdown

blathers-crl Bot commented May 15, 2026

Thanks for opening a backport.

Before merging, please confirm that the change does not break backwards compatibility and otherwise complies with the backport policy. Include a brief release justification in the PR description explaining why the backport is appropriate. All backports must be reviewed by the TL for the owning area. While the stricter LTS policy does not yet apply, please exercise judgment and consider gating non-critical changes behind a disabled-by-default feature flag when appropriate.

@blathers-crl blathers-crl Bot added backport Label PR's that are backports to older release branches T-code-systems labels May 15, 2026
@cockroach-teamcity
Copy link
Copy Markdown
Member

cockroach-teamcity commented May 15, 2026

This change is Reviewable

@trunk-io trunk-io Bot merged commit 5d80eb1 into cockroachdb:release-26.1 May 15, 2026
21 checks passed
@rail rail deleted the blathers/backport-release-26.1-170388 branch May 15, 2026 16:07
This was referenced May 22, 2026
Merged
Open
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-25.2: backport GHA migration + follow-ups
f4152d0 
Bring release-25.2 in line with release-26.1's release-tooling stack so
the new GitHub Actions release pipeline can drive 25.2 patch releases.
This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

The 8 source PRs do not cherry-pick cleanly onto release-25.2 because
the legacy email/Jira release tooling (blockers.go, github.go, jira.go,
metadata.go, orchestration.go, set_cockroach_version.go, their tests
and templates) was removed before release-25.4 was cut. Rather than
hand-merging hundreds of hunks, the release-tooling code is replaced
wholesale with the post-PR state from release-26.1:

  * pkg/cmd/release/ entire library lifted from release-26.1 tip
    (97b3f3e); legacy email-tooling files deleted to match.
  * .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
    publish}.yml added.
  * build/github/release-*.sh wrapper scripts added.
  * Shared TeamCity-era scripts (build/release/teamcity-*.sh,
    build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
    build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
    build/teamcity/internal/release/process/*.sh) lifted from
    release-26.1; the migration's changes here are additive (new WIF
    auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE) and
    the legacy TeamCity code paths still work.
  * cockroachdb/version bumped from the March 2025 pin to the May 2025
    pin so the new pkg/cmd/release can use version.IncPreRelease /
    IncPatch. The bump renames IsCustomOrNightlyBuild to
    IsCustomOrAdhocBuild on the *Version receiver; the one caller in
    pkg/build/info.go is updated.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-25.2: backport GHA migration + follow-ups
2a6d46d 
Bring release-25.2 in line with release-26.1's release-tooling stack so
the new GitHub Actions release pipeline can drive 25.2 patch releases.
This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

The 8 source PRs do not cherry-pick cleanly onto release-25.2 because
the legacy email/Jira release tooling (blockers.go, github.go, jira.go,
metadata.go, orchestration.go, set_cockroach_version.go, their tests
and templates) was removed before release-25.4 was cut. Rather than
hand-merging hundreds of hunks, the release-tooling code is replaced
wholesale with the post-PR state from release-26.1:

  * pkg/cmd/release/ entire library lifted from release-26.1 tip
    (97b3f3e); legacy email-tooling files deleted to match.
  * .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
    publish}.yml added.
  * build/github/release-*.sh wrapper scripts added.
  * Shared TeamCity-era scripts (build/release/teamcity-*.sh,
    build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
    build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
    build/teamcity/internal/release/process/*.sh) lifted from
    release-26.1; the migration's changes here are additive (new WIF
    auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE) and
    the legacy TeamCity code paths still work.
  * cockroachdb/version bumped from the March 2025 pin to the May 2025
    pin so the new pkg/cmd/release can use version.IncPreRelease /
    IncPatch. The bump renames IsCustomOrNightlyBuild to
    IsCustomOrAdhocBuild on the *Version receiver; the one caller in
    pkg/build/info.go is updated.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
This was referenced May 22, 2026
Open
Open
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-24.3: backport GHA migration + follow-ups
7a32bf4 
Bring release-24.3 in line with release-26.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 24.3 patch
releases. This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

Like the release-25.2 backport (cockroachdb#170813), the 8 commits don't
cherry-pick cleanly onto release-24.3 because the legacy email/Jira
release tooling (blockers.go, github.go, jira.go, metadata.go,
orchestration.go, set_cockroach_version.go, their tests and
templates) was removed before release-25.4 was cut. The release-tooling
code is replaced wholesale with the post-PR state from release-26.1
(tip 97b3f3e):

- pkg/cmd/release/ entire library lifted from release-26.1 tip; legacy
  email-tooling Go files, templates, and testdata deleted to match.
- .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
  publish}.yml added.
- build/github/release-*.sh wrapper scripts added.
- Shared TeamCity-era scripts (build/release/teamcity-*.sh,
  build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
  build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
  build/teamcity/internal/release/process/build-cockroach-release-*.sh)
  lifted from release-26.1; the migration's edits here are additive
  WIF-auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE,
  so the legacy TeamCity code paths still work.
- cockroachdb/version added as a new dep (release-24.3 didn't have it
  at all) at the May 2025 pin so the new pkg/cmd/release can use
  version.IncPreRelease / IncPatch. go-github v61 also added.
  Orphaned deps from the deleted legacy tooling
  (andygrunwald/go-jira, google/go-github/v42, indirect trivago/tgo
  and fatih/structs) dropped. DEPS.bzl regenerated accordingly.

Branch-specific adjustments (release-24.3 differs from release-26.1):

- verify_docker_image reverted to detect FIPS via Go version + OpenSSL
  fingerprint. The 26.1 version greps for a 'FIPS enabled: true'
  line that requires the crypto/fips140-based check in
  pkg/build/info.go introduced post-24.3; release-24.3's cockroach
  binary doesn't emit it. (pkg/build/info.go itself is unchanged on
  this branch because release-24.3 still uses the internal
  pkg/util/version package and never adopted the cockroachdb/version
  external module that introduced the IsCustomOrAdhocBuild rename.)
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel —
  release-24.3's TC environment doesn't set it.
- run_bazel_fips left removed (no callers on release-24.3).
- linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, the publish-staged
  platforms list, and the cloud-only comment. release-24.3 does not
  build s390x. IBM build/sign jobs are kept (no-telemetry linux
  variants, not s390x-only).
- build-cockroach-release-per-platform.sh reverted to
  'publish-provisional-artifacts -provisional -release' — release-24.3
  predates the publish-artifacts rename + release subcommand split.
- build-cockroach-release-per-platform.sh restores the
  '--build-arg fips_enabled=1' branch for the FIPS docker image;
  the release-24.3 build/deploy/Dockerfile gates FIPS package
  installation on this arg.
- make-and-publish-* TC-only nightly scripts reverted to 24.3
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-24.1: backport GHA migration + follow-ups
b619144 
Bring release-24.1 in line with release-26.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 24.1 patch
releases. This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

Mirrors the release-24.3 (cockroachdb#170820) and release-25.2 (cockroachdb#170813)
backports: the legacy email/Jira release tooling that release-24.1
still carries is replaced wholesale with the post-PR state from
release-26.1 (tip 97b3f3e):

- pkg/cmd/release/ entire library lifted from release-26.1 tip;
  legacy email-tooling Go files, templates, and testdata deleted to
  match.
- .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
  publish}.yml added.
- build/github/release-*.sh wrapper scripts added.
- Shared TeamCity-era scripts (build/release/teamcity-*.sh,
  build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
  build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
  build/teamcity/internal/release/process/build-cockroach-release-*.sh)
  lifted from release-26.1; the migration's edits there are additive
  WIF-auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE,
  so the legacy TeamCity code paths still work.
- cockroachdb/version added as a new dep (release-24.1 didn't carry
  it) at the May 2025 pin so the new pkg/cmd/release can use
  version.IncPreRelease / IncPatch. go-github v61 also added.
  Orphaned deps from the deleted legacy tooling
  (andygrunwald/go-jira, google/go-github/v42, indirect trivago/tgo
  and fatih/structs) dropped from go.mod, go.sum, and DEPS.bzl.

Branch-specific adjustments (release-24.1 differs from release-26.1):

- verify_docker_image reverted to detect FIPS via Go version + OpenSSL
  fingerprint. The 26.1 version greps for a 'FIPS enabled: true'
  line that requires the crypto/fips140-based check in
  pkg/build/info.go introduced post-24.1. (pkg/build/info.go itself
  is unchanged here because release-24.1 still uses the internal
  pkg/util/version package and never adopted the cockroachdb/version
  external module.)
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel —
  release-24.1's TC environment doesn't set it.
- run_bazel_fips left removed (no callers on release-24.1).
- linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, the publish-staged
  platforms list, and the cloud-only comment. release-24.1 does not
  build s390x. IBM build/sign jobs are kept (no-telemetry linux
  variants, not s390x-only).
- build-cockroach-release-per-platform.sh reverted to
  'publish-provisional-artifacts -provisional -release' — release-24.1
  predates the publish-artifacts rename + release subcommand split.
- build-cockroach-release-per-platform.sh restores the
  '--build-arg fips_enabled=1' branch for the FIPS docker image;
  the release-24.1 build/deploy/Dockerfile gates FIPS package
  installation on this arg.
- make-and-publish-* TC-only nightly scripts kept at 24.1
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-24.3: backport GHA migration + follow-ups
3cb5d58 
Bring release-24.3 in line with release-26.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 24.3 patch
releases. This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

Like the release-25.2 backport (cockroachdb#170813), the 8 commits don't
cherry-pick cleanly onto release-24.3 because the legacy email/Jira
release tooling (blockers.go, github.go, jira.go, metadata.go,
orchestration.go, set_cockroach_version.go, their tests and
templates) was removed before release-25.4 was cut. The release-tooling
code is replaced wholesale with the post-PR state from release-26.1
(tip 97b3f3e):

- pkg/cmd/release/ entire library lifted from release-26.1 tip; legacy
  email-tooling Go files, templates, and testdata deleted to match.
- .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
  publish}.yml added.
- build/github/release-*.sh wrapper scripts added.
- Shared TeamCity-era scripts (build/release/teamcity-*.sh,
  build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
  build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
  build/teamcity/internal/release/process/build-cockroach-release-*.sh)
  lifted from release-26.1; the migration's edits here are additive
  WIF-auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE,
  so the legacy TeamCity code paths still work.
- cockroachdb/version added as a new dep (release-24.3 didn't have it
  at all) at the May 2025 pin so the new pkg/cmd/release can use
  version.IncPreRelease / IncPatch. go-github v61 also added.
  Orphaned deps from the deleted legacy tooling
  (andygrunwald/go-jira, google/go-github/v42, indirect trivago/tgo
  and fatih/structs) dropped. DEPS.bzl regenerated accordingly.

Branch-specific adjustments (release-24.3 differs from release-26.1):

- verify_docker_image reverted to detect FIPS via Go version + OpenSSL
  fingerprint. The 26.1 version greps for a 'FIPS enabled: true'
  line that requires the crypto/fips140-based check in
  pkg/build/info.go introduced post-24.3; release-24.3's cockroach
  binary doesn't emit it. (pkg/build/info.go itself is unchanged on
  this branch because release-24.3 still uses the internal
  pkg/util/version package and never adopted the cockroachdb/version
  external module that introduced the IsCustomOrAdhocBuild rename.)
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel —
  release-24.3's TC environment doesn't set it.
- run_bazel_fips left removed (no callers on release-24.3).
- linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, the publish-staged
  platforms list, and the cloud-only comment. release-24.3 does not
  build s390x. IBM build/sign jobs are kept (no-telemetry linux
  variants, not s390x-only).
- build-cockroach-release-per-platform.sh reverted to
  'publish-provisional-artifacts -provisional -release' — release-24.3
  predates the publish-artifacts rename + release subcommand split.
- build-cockroach-release-per-platform.sh restores the
  '--build-arg fips_enabled=1' branch for the FIPS docker image;
  the release-24.3 build/deploy/Dockerfile gates FIPS package
  installation on this arg.
- make-and-publish-* TC-only nightly scripts reverted to 24.3
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-24.1: backport GHA migration + follow-ups
6d6d3f6 
Bring release-24.1 in line with release-26.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 24.1 patch
releases. This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

Mirrors the release-24.3 (cockroachdb#170820) and release-25.2 (cockroachdb#170813)
backports: the legacy email/Jira release tooling that release-24.1
still carries is replaced wholesale with the post-PR state from
release-26.1 (tip 97b3f3e):

- pkg/cmd/release/ entire library lifted from release-26.1 tip;
  legacy email-tooling Go files, templates, and testdata deleted to
  match.
- .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
  publish}.yml added.
- build/github/release-*.sh wrapper scripts added.
- Shared TeamCity-era scripts (build/release/teamcity-*.sh,
  build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
  build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
  build/teamcity/internal/release/process/build-cockroach-release-*.sh)
  lifted from release-26.1; the migration's edits there are additive
  WIF-auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE,
  so the legacy TeamCity code paths still work.
- cockroachdb/version added as a new dep (release-24.1 didn't carry
  it) at the May 2025 pin so the new pkg/cmd/release can use
  version.IncPreRelease / IncPatch. go-github v61 also added.
  Orphaned deps from the deleted legacy tooling
  (andygrunwald/go-jira, google/go-github/v42, indirect trivago/tgo
  and fatih/structs) dropped from go.mod, go.sum, and DEPS.bzl.

Branch-specific adjustments (release-24.1 differs from release-26.1):

- verify_docker_image reverted to detect FIPS via Go version + OpenSSL
  fingerprint. The 26.1 version greps for a 'FIPS enabled: true'
  line that requires the crypto/fips140-based check in
  pkg/build/info.go introduced post-24.1. (pkg/build/info.go itself
  is unchanged here because release-24.1 still uses the internal
  pkg/util/version package and never adopted the cockroachdb/version
  external module.)
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel —
  release-24.1's TC environment doesn't set it.
- run_bazel_fips left removed (no callers on release-24.1).
- linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, the publish-staged
  platforms list, and the cloud-only comment. release-24.1 does not
  build s390x. IBM build/sign jobs are kept (no-telemetry linux
  variants, not s390x-only).
- build-cockroach-release-per-platform.sh reverted to
  'publish-provisional-artifacts -provisional -release' — release-24.1
  predates the publish-artifacts rename + release subcommand split.
- build-cockroach-release-per-platform.sh restores the
  '--build-arg fips_enabled=1' branch for the FIPS docker image;
  the release-24.1 build/deploy/Dockerfile gates FIPS package
  installation on this arg.
- make-and-publish-* TC-only nightly scripts kept at 24.1
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-24.3: backport GHA migration + follow-ups
0e3ee63 
Bring release-24.3 in line with release-26.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 24.3 patch
releases. This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

Like the release-25.2 backport (cockroachdb#170813), the 8 commits don't
cherry-pick cleanly onto release-24.3 because the legacy email/Jira
release tooling (blockers.go, github.go, jira.go, metadata.go,
orchestration.go, set_cockroach_version.go, their tests and
templates) was removed before release-25.4 was cut. The release-tooling
code is replaced wholesale with the post-PR state from release-26.1
(tip 97b3f3e):

- pkg/cmd/release/ entire library lifted from release-26.1 tip; legacy
  email-tooling Go files, templates, and testdata deleted to match.
- .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
  publish}.yml added.
- build/github/release-*.sh wrapper scripts added.
- Shared TeamCity-era scripts (build/release/teamcity-*.sh,
  build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
  build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
  build/teamcity/internal/release/process/build-cockroach-release-*.sh)
  lifted from release-26.1; the migration's edits here are additive
  WIF-auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE,
  so the legacy TeamCity code paths still work.
- cockroachdb/version added as a new dep (release-24.3 didn't have it
  at all) at the May 2025 pin so the new pkg/cmd/release can use
  version.IncPreRelease / IncPatch. go-github v61 also added.
  Orphaned deps from the deleted legacy tooling
  (andygrunwald/go-jira, google/go-github/v42, indirect trivago/tgo
  and fatih/structs) dropped. DEPS.bzl regenerated accordingly.

Branch-specific adjustments (release-24.3 differs from release-26.1):

- verify_docker_image reverted to detect FIPS via Go version + OpenSSL
  fingerprint. The 26.1 version greps for a 'FIPS enabled: true'
  line that requires the crypto/fips140-based check in
  pkg/build/info.go introduced post-24.3; release-24.3's cockroach
  binary doesn't emit it. (pkg/build/info.go itself is unchanged on
  this branch because release-24.3 still uses the internal
  pkg/util/version package and never adopted the cockroachdb/version
  external module that introduced the IsCustomOrAdhocBuild rename.)
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel —
  release-24.3's TC environment doesn't set it.
- run_bazel_fips left removed (no callers on release-24.3).
- linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, the publish-staged
  platforms list, and the cloud-only comment. release-24.3 does not
  build s390x. IBM build/sign jobs are kept (no-telemetry linux
  variants, not s390x-only).
- build-cockroach-release-per-platform.sh reverted to
  'publish-provisional-artifacts -provisional -release' — release-24.3
  predates the publish-artifacts rename + release subcommand split.
- build-cockroach-release-per-platform.sh restores the
  '--build-arg fips_enabled=1' branch for the FIPS docker image;
  the release-24.3 build/deploy/Dockerfile gates FIPS package
  installation on this arg.
- make-and-publish-* TC-only nightly scripts reverted to 24.3
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-24.1: backport GHA migration + follow-ups
1e92f56 
Bring release-24.1 in line with release-26.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 24.1 patch
releases. This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

Mirrors the release-24.3 (cockroachdb#170820) and release-25.2 (cockroachdb#170813)
backports: the legacy email/Jira release tooling that release-24.1
still carries is replaced wholesale with the post-PR state from
release-26.1 (tip 97b3f3e):

- pkg/cmd/release/ entire library lifted from release-26.1 tip;
  legacy email-tooling Go files, templates, and testdata deleted to
  match.
- .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
  publish}.yml added.
- build/github/release-*.sh wrapper scripts added.
- Shared TeamCity-era scripts (build/release/teamcity-*.sh,
  build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
  build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
  build/teamcity/internal/release/process/build-cockroach-release-*.sh)
  lifted from release-26.1; the migration's edits there are additive
  WIF-auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE,
  so the legacy TeamCity code paths still work.
- cockroachdb/version added as a new dep (release-24.1 didn't carry
  it) at the May 2025 pin so the new pkg/cmd/release can use
  version.IncPreRelease / IncPatch. go-github v61 also added.
  Orphaned deps from the deleted legacy tooling
  (andygrunwald/go-jira, google/go-github/v42, indirect trivago/tgo
  and fatih/structs) dropped from go.mod, go.sum, and DEPS.bzl.

Branch-specific adjustments (release-24.1 differs from release-26.1):

- verify_docker_image reverted to detect FIPS via Go version + OpenSSL
  fingerprint. The 26.1 version greps for a 'FIPS enabled: true'
  line that requires the crypto/fips140-based check in
  pkg/build/info.go introduced post-24.1. (pkg/build/info.go itself
  is unchanged here because release-24.1 still uses the internal
  pkg/util/version package and never adopted the cockroachdb/version
  external module.)
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel —
  release-24.1's TC environment doesn't set it.
- run_bazel_fips left removed (no callers on release-24.1).
- linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, the publish-staged
  platforms list, and the cloud-only comment. release-24.1 does not
  build s390x. IBM build/sign jobs are kept (no-telemetry linux
  variants, not s390x-only).
- build-cockroach-release-per-platform.sh reverted to
  'publish-provisional-artifacts -provisional -release' — release-24.1
  predates the publish-artifacts rename + release subcommand split.
- build-cockroach-release-per-platform.sh restores the
  '--build-arg fips_enabled=1' branch for the FIPS docker image;
  the release-24.1 build/deploy/Dockerfile gates FIPS package
  installation on this arg.
- make-and-publish-* TC-only nightly scripts kept at 24.1
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-24.3: backport GHA migration + follow-ups
9ce1c0c 
Bring release-24.3 in line with release-26.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 24.3 patch
releases. This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

Like the release-25.2 backport (cockroachdb#170813), the 8 commits don't
cherry-pick cleanly onto release-24.3 because the legacy email/Jira
release tooling (blockers.go, github.go, jira.go, metadata.go,
orchestration.go, set_cockroach_version.go, their tests and
templates) was removed before release-25.4 was cut. The release-tooling
code is replaced wholesale with the post-PR state from release-26.1
(tip 97b3f3e):

- pkg/cmd/release/ entire library lifted from release-26.1 tip; legacy
  email-tooling Go files, templates, and testdata deleted to match.
- .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
  publish}.yml added.
- build/github/release-*.sh wrapper scripts added.
- Shared TeamCity-era scripts (build/release/teamcity-*.sh,
  build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
  build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
  build/teamcity/internal/release/process/build-cockroach-release-*.sh)
  lifted from release-26.1; the migration's edits here are additive
  WIF-auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE,
  so the legacy TeamCity code paths still work.
- cockroachdb/version added as a new dep (release-24.3 didn't have it
  at all) at the May 2025 pin so the new pkg/cmd/release can use
  version.IncPreRelease / IncPatch. go-github v61 also added.
  Orphaned deps from the deleted legacy tooling
  (andygrunwald/go-jira, google/go-github/v42, indirect trivago/tgo
  and fatih/structs) dropped. DEPS.bzl regenerated accordingly.

Branch-specific adjustments (release-24.3 differs from release-26.1):

- verify_docker_image reverted to detect FIPS via Go version + OpenSSL
  fingerprint. The 26.1 version greps for a 'FIPS enabled: true'
  line that requires the crypto/fips140-based check in
  pkg/build/info.go introduced post-24.3; release-24.3's cockroach
  binary doesn't emit it. (pkg/build/info.go itself is unchanged on
  this branch because release-24.3 still uses the internal
  pkg/util/version package and never adopted the cockroachdb/version
  external module that introduced the IsCustomOrAdhocBuild rename.)
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel —
  release-24.3's TC environment doesn't set it.
- run_bazel_fips left removed (no callers on release-24.3).
- linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, the publish-staged
  platforms list, and the cloud-only comment. release-24.3 does not
  build s390x. IBM build/sign jobs are kept (no-telemetry linux
  variants, not s390x-only).
- build-cockroach-release-per-platform.sh reverted to
  'publish-provisional-artifacts -provisional -release' — release-24.3
  predates the publish-artifacts rename + release subcommand split.
- build-cockroach-release-per-platform.sh restores the
  '--build-arg fips_enabled=1' branch for the FIPS docker image;
  the release-24.3 build/deploy/Dockerfile gates FIPS package
  installation on this arg.
- make-and-publish-* TC-only nightly scripts reverted to 24.3
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-24.1: backport GHA migration + follow-ups
61b126b 
Bring release-24.1 in line with release-26.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 24.1 patch
releases. This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

Mirrors the release-24.3 (cockroachdb#170820) and release-25.2 (cockroachdb#170813)
backports: the legacy email/Jira release tooling that release-24.1
still carries is replaced wholesale with the post-PR state from
release-26.1 (tip 97b3f3e):

- pkg/cmd/release/ entire library lifted from release-26.1 tip;
  legacy email-tooling Go files, templates, and testdata deleted to
  match.
- .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
  publish}.yml added.
- build/github/release-*.sh wrapper scripts added.
- Shared TeamCity-era scripts (build/release/teamcity-*.sh,
  build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
  build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
  build/teamcity/internal/release/process/build-cockroach-release-*.sh)
  lifted from release-26.1; the migration's edits there are additive
  WIF-auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE,
  so the legacy TeamCity code paths still work.
- cockroachdb/version added as a new dep (release-24.1 didn't carry
  it) at the May 2025 pin so the new pkg/cmd/release can use
  version.IncPreRelease / IncPatch. go-github v61 also added.
  Orphaned deps from the deleted legacy tooling
  (andygrunwald/go-jira, google/go-github/v42, indirect trivago/tgo
  and fatih/structs) dropped from go.mod, go.sum, and DEPS.bzl.

Branch-specific adjustments (release-24.1 differs from release-26.1):

- verify_docker_image reverted to detect FIPS via Go version + OpenSSL
  fingerprint. The 26.1 version greps for a 'FIPS enabled: true'
  line that requires the crypto/fips140-based check in
  pkg/build/info.go introduced post-24.1. (pkg/build/info.go itself
  is unchanged here because release-24.1 still uses the internal
  pkg/util/version package and never adopted the cockroachdb/version
  external module.)
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel —
  release-24.1's TC environment doesn't set it.
- run_bazel_fips left removed (no callers on release-24.1).
- linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, the publish-staged
  platforms list, and the cloud-only comment. release-24.1 does not
  build s390x. IBM build/sign jobs are kept (no-telemetry linux
  variants, not s390x-only).
- build-cockroach-release-per-platform.sh reverted to
  'publish-provisional-artifacts -provisional -release' — release-24.1
  predates the publish-artifacts rename + release subcommand split.
- build-cockroach-release-per-platform.sh restores the
  '--build-arg fips_enabled=1' branch for the FIPS docker image;
  the release-24.1 build/deploy/Dockerfile gates FIPS package
  installation on this arg.
- make-and-publish-* TC-only nightly scripts kept at 24.1
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 22, 2026
@rail
release-24.3: backport GHA migration + follow-ups
e9de4e4 
Bring release-24.3 in line with release-26.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 24.3 patch
releases. This bundles the eight release-26.1 PRs listed below:

  cockroachdb#170348 release: migrate release pipelines from TeamCity to GitHub Actions
  cockroachdb#170392 build,release: forward IS_PRODUCTION_REPO into the release binary
  cockroachdb#170657 release: fix two prod release-workflow bugs
  cockroachdb#170670 release: bump release-notes API client timeout to 2 minutes
  cockroachdb#170686 release: fix two more prod release-workflow auth bugs
  cockroachdb#170727 release/sentry: use 'gcloud storage cp' to download artifact
  cockroachdb#170765 release: follow-ups to the pick-sha + cloud-rollout flow
  cockroachdb#170779 release: route build/publish notify to #release-ops by ID-vs-name

Like the release-25.2 backport (cockroachdb#170813), the 8 commits don't
cherry-pick cleanly onto release-24.3 because the legacy email/Jira
release tooling (blockers.go, github.go, jira.go, metadata.go,
orchestration.go, set_cockroach_version.go, their tests and
templates) was removed before release-25.4 was cut. The release-tooling
code is replaced wholesale with the post-PR state from release-26.1
(tip 97b3f3e):

- pkg/cmd/release/ entire library lifted from release-26.1 tip; legacy
  email-tooling Go files, templates, and testdata deleted to match.
- .github/workflows/release-{branch-cut,build-and-sign,pick-sha,
  publish}.yml added.
- build/github/release-*.sh wrapper scripts added.
- Shared TeamCity-era scripts (build/release/teamcity-*.sh,
  build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
  build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
  build/teamcity/internal/release/process/build-cockroach-release-*.sh)
  lifted from release-26.1; the migration's edits here are additive
  WIF-auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE,
  so the legacy TeamCity code paths still work.
- cockroachdb/version added as a new dep (release-24.3 didn't have it
  at all) at the May 2025 pin so the new pkg/cmd/release can use
  version.IncPreRelease / IncPatch. go-github v61 also added.
  Orphaned deps from the deleted legacy tooling
  (andygrunwald/go-jira, google/go-github/v42, indirect trivago/tgo
  and fatih/structs) dropped. DEPS.bzl regenerated accordingly.

Branch-specific adjustments (release-24.3 differs from release-26.1):

- verify_docker_image reverted to detect FIPS via Go version + OpenSSL
  fingerprint. The 26.1 version greps for a 'FIPS enabled: true'
  line that requires the crypto/fips140-based check in
  pkg/build/info.go introduced post-24.3; release-24.3's cockroach
  binary doesn't emit it. (pkg/build/info.go itself is unchanged on
  this branch because release-24.3 still uses the internal
  pkg/util/version package and never adopted the cockroachdb/version
  external module that introduced the IsCustomOrAdhocBuild rename.)
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel —
  release-24.3's TC environment doesn't set it.
- run_bazel_fips left removed (no callers on release-24.3).
- linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, the publish-staged
  platforms list, and the cloud-only comment. release-24.3 does not
  build s390x. IBM build/sign jobs are kept (no-telemetry linux
  variants, not s390x-only).
- build-cockroach-release-per-platform.sh reverted to
  'publish-provisional-artifacts -provisional -release' — release-24.3
  predates the publish-artifacts rename + release subcommand split.
- build-cockroach-release-per-platform.sh restores the
  '--build-arg fips_enabled=1' branch for the FIPS docker image;
  the release-24.3 build/deploy/Dockerfile gates FIPS package
  installation on this arg.
- make-and-publish-* TC-only nightly scripts reverted to 24.3
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 23, 2026
@rail
release-23.2: backport GHA migration + follow-ups
263fc73 
Bring release-23.2 in line with release-24.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 23.2 patch
releases. This bundles the eight release-26.1 PRs already backported
to 24.1 (cockroachdb#170348, cockroachdb#170392, cockroachdb#170657, cockroachdb#170670, cockroachdb#170686, cockroachdb#170727,
cockroachdb#170765, cockroachdb#170779).

Mirrors the release-24.1 (cockroachdb#170823) recipe: legacy email/Jira release
tooling that release-23.2 still carries is replaced wholesale with
the post-PR state from release-26.1 (tip 97b3f3e).

Trimmed for release-23.2's scope — these workflows / scripts were
intentionally dropped because the corresponding pipeline isn't run
on this branch:
- IBM build/sign infrastructure (build-per-platform-ibm,
  build-docker-ibm, ibm-signing, release-sign-ibm.sh): release-23.2
  does not ship IBM / linux-s390x builds.
- Cloud-only image (publish-cloud-only, cloud-rollout,
  release-cloud-only.sh, release-cloud-rollout.sh,
  build-cockroach-release-cloud-only.sh): no cloud-only image
  build/publish on this branch.
- RAFA rollout (create-rafa-prs, release-publish-rafa-prs.sh):
  release-23.2 doesn't open RAFA PRs.

Other adjustments mirror the 24.1 backport:
- cockroachdb/version added as a new dep at the May 2025 pin so the
  new pkg/cmd/release can use version.IncPreRelease / IncPatch.
  go-github/v61, plus transitive bumps of cockroachdb/errors v1.11.3,
  getsentry/sentry-go v0.27.0, google/go-cmp v0.6.0, and
  stretchr/testify v1.10.0.
- Orphaned deps dropped: andygrunwald/go-jira, google/go-github/v42,
  indirect trivago/tgo. DEPS.bzl + distdir_files.bzl updated.
- verify_docker_image reverted to detect FIPS via Go version +
  OpenSSL fingerprint (release-23.2's cockroach doesn't emit
  "FIPS enabled: true").
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel.
- linux-s390x dropped from matrices.
- build-cockroach-release-per-platform.sh reverted to
  publish-provisional-artifacts and restores --build-arg fips_enabled=1.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
rail added a commit to rail/cockroach that referenced this pull request May 23, 2026
@rail
release-23.2: backport GHA migration + follow-ups
8d30924 
Bring release-23.2 in line with release-24.1's release-tooling stack
so the new GitHub Actions release pipeline can drive 23.2 patch
releases. This bundles the eight release-26.1 PRs already backported
to 24.1 (cockroachdb#170348, cockroachdb#170392, cockroachdb#170657, cockroachdb#170670, cockroachdb#170686, cockroachdb#170727,
cockroachdb#170765, cockroachdb#170779).

Mirrors the release-24.1 (cockroachdb#170823) recipe: legacy email/Jira release
tooling that release-23.2 still carries is replaced wholesale with
the post-PR state from release-26.1 (tip 97b3f3e).

Trimmed for release-23.2's scope — these workflows / scripts were
intentionally dropped because the corresponding pipeline isn't run
on this branch:
- IBM build/sign infrastructure (build-per-platform-ibm,
  build-docker-ibm, ibm-signing, release-sign-ibm.sh): release-23.2
  does not ship IBM / linux-s390x builds.
- Cloud-only image (publish-cloud-only, cloud-rollout,
  release-cloud-only.sh, release-cloud-rollout.sh,
  build-cockroach-release-cloud-only.sh): no cloud-only image
  build/publish on this branch.
- RAFA rollout (create-rafa-prs, release-publish-rafa-prs.sh):
  release-23.2 doesn't open RAFA PRs.

Other adjustments mirror the 24.1 backport:
- cockroachdb/version added as a new dep at the May 2025 pin so the
  new pkg/cmd/release can use version.IncPreRelease / IncPatch.
  go-github/v61, plus transitive bumps of cockroachdb/errors v1.11.3,
  getsentry/sentry-go v0.27.0, google/go-cmp v0.6.0, and
  stretchr/testify v1.10.0.
- Orphaned deps dropped: andygrunwald/go-jira, google/go-github/v42,
  indirect trivago/tgo. DEPS.bzl + distdir_files.bzl updated.
- verify_docker_image reverted to detect FIPS via Go version +
  OpenSSL fingerprint (release-23.2's cockroach doesn't emit
  "FIPS enabled: true").
- TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel.
- linux-s390x dropped from matrices.
- build-cockroach-release-per-platform.sh reverted to
  publish-provisional-artifacts and restores --build-arg fips_enabled=1.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rickystewart rickystewart rickystewart approved these changes

@rishabh7m rishabh7m rishabh7m approved these changes

@jlinder jlinder Awaiting requested review from jlinder

Assignees

@rail rail

Labels

backport Label PR's that are backports to older release branches blathers-backport This is a backport that Blathers created automatically. O-robot Originated from a bot. T-code-systems target-release-26.1.5

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@rail @cockroach-teamcity @rickystewart @rishabh7m