ci: switch to ephemeral branches

.github/workflows/release-proposal-dispatch.yml

@@ -30,7 +30,6 @@ concurrency:
 
 env:
   MAIN_BRANCH: main
-  RELEASE_BRANCH: release
   PROPOSAL_BRANCH_PREFIX: release-proposal
   GIT_USER_NAME: "dd-octo-sts[bot]"
   GIT_USER_EMAIL: "200755185+dd-octo-sts[bot]@users.noreply.github.com"
@@ -45,8 +44,8 @@ jobs:
           fetch-tags: true
       - name: Check if a release proposal is ongoing
         run: |
-          # Check if there are any branches with the prefix "${{ env.PROPOSAL_BRANCH_PREFIX }}"
-          EXISTING_BRANCHES=$(git branch -r --list "origin/${{ env.PROPOSAL_BRANCH_PREFIX }}/*")
+          # Check if there are any proposal branches or ephemeral release branches (release/*/*)
+          EXISTING_BRANCHES=$(git branch -r --list "origin/${{ env.PROPOSAL_BRANCH_PREFIX }}/*" "origin/release/*/*")
           if [ -n "$EXISTING_BRANCHES" ]; then
             echo "Error: A release proposal is ongoing. Please cancel it or wait for it to be merged." >&2
             echo "Existing branches:"
@@ -84,59 +83,17 @@ jobs:
             exit 1
           fi
 
-  update-release-branch:
-    permissions:
-      id-token: write # Enable OIDC
-      contents: write
-    runs-on: ubuntu-latest
-    needs: check-membership
-    steps:
-      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
-        id: octo-sts
-        with:
-          scope: DataDog/libdatadog
-          policy: self.write.pr
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
-        with:
-          token: ${{ steps.octo-sts.outputs.token }}
-          fetch-depth: 0
-          fetch-tags: true
-
-      - name: Configure Git identity for dd-octo-sts GitHub App
-        env:
-          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
-        run: |
-
-          git config --global user.name "$GIT_USER_NAME"
-          git config --global user.email "$GIT_USER_EMAIL"
-
-      - name: Merge the main branch into the release branch
-        run: |
-          git fetch origin "${{ env.MAIN_BRANCH }}" "${{ env.RELEASE_BRANCH }}" --tags
-          git checkout "${{ env.RELEASE_BRANCH }}"
-
-          if ! git merge origin/"${{ env.MAIN_BRANCH }}"; then
-            echo "Error: Cannot merge ${{ env.MAIN_BRANCH }} into ${{ env.RELEASE_BRANCH }}" >&2
-            echo "There are merge conflicts or the branches have diverged." >&2
-            echo "If you have recently launched another release, it is possible that ${{ env.MAIN_BRANCH }} branch is not yet updated with the ${{ env.RELEASE_BRANCH }} changes." >&2
-            echo "Please try again later." >&2
-            exit 1
-          fi
-
-          git push origin "${{ env.RELEASE_BRANCH }}" --tags
-
   cargo-release:
     permissions:
       id-token: write # Enable OIDC
       pull-requests: write
       contents: write
-    needs: update-release-branch
+    needs: check-membership
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
         with:
-          ref: ${{ env.RELEASE_BRANCH }}
+          ref: ${{ env.MAIN_BRANCH }}
           fetch-depth: 0
           fetch-tags: true
       - uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
@@ -168,6 +125,17 @@ jobs:
           git config --global user.name "${{ env.GIT_USER_NAME }}"
           git config --global user.email "${{ env.GIT_USER_EMAIL }}"
 
+      - name: Create ephemeral release branch
+        id: ephemeral-branch
+        run: |
+          TIMESTAMP=$(date +%Y%m%d-%H%M%S)
+          EPHEMERAL_BRANCH="release/${{ inputs.crate }}/$TIMESTAMP"
+          git checkout -b "$EPHEMERAL_BRANCH"
+          git push origin "$EPHEMERAL_BRANCH"
+          echo "Ephemeral release branch created: $EPHEMERAL_BRANCH from ${{ env.MAIN_BRANCH }} branch"
+          echo "ephemeral_branch=$EPHEMERAL_BRANCH" >> "$GITHUB_OUTPUT"
+          echo "timestamp=$TIMESTAMP" >> "$GITHUB_OUTPUT"
+
       - name: Get publication order for crate and dependencies
         run: |
           echo "Getting publication order for ${{ inputs.crate }}..."
@@ -182,7 +150,7 @@ jobs:
           # Get commits since release for each crate and save to file
           ./scripts/commits-since-release.sh "$(cat /tmp/crates.json)" > /tmp/commits-by-crate.json
 
-          # Capture release branch tip now (while HEAD=release). Use this in Release version bumps
+          # Capture ephemeral release branch tip now. Use this in Release version bumps
           # so tag/merge-base resolution uses the same ref the script used.
           git rev-parse HEAD > /tmp/release_head_sha
           echo "Release branch HEAD (saved for later): $(cat /tmp/release_head_sha)"
@@ -202,14 +170,14 @@ jobs:
           # previous steps.
           # Assure we have the full history, 2147483647 is the highest integer number that
           # git accepts.
-          git fetch --depth=2147483647 --tags origin "${{ env.MAIN_BRANCH }}" "${{ env.RELEASE_BRANCH }}"
+          git fetch --depth=2147483647 --tags origin "${{ env.MAIN_BRANCH }}" "${{ steps.ephemeral-branch.outputs.ephemeral_branch }}"
 
-          git checkout "${{ env.RELEASE_BRANCH }}"
-          TIMESTAMP=$(date +%Y%m%d-%H%M%S)
+          git checkout "${{ steps.ephemeral-branch.outputs.ephemeral_branch }}"
+          TIMESTAMP="${{ steps.ephemeral-branch.outputs.timestamp }}"
           BRANCH_NAME="${{ env.PROPOSAL_BRANCH_PREFIX }}/${{ inputs.crate }}/$TIMESTAMP"
           git checkout -b "$BRANCH_NAME"
           git push origin "$BRANCH_NAME" --tags
-          echo "Branch created: $BRANCH_NAME from ${{ env.RELEASE_BRANCH }} branch"
+          echo "Branch created: $BRANCH_NAME from ${{ steps.ephemeral-branch.outputs.ephemeral_branch }} branch"
           echo "branch_name=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
 
       - name: Release version bumps
@@ -387,7 +355,7 @@ jobs:
           done
 
           # Check if there are commits to push
-          if git diff --quiet "${{ env.RELEASE_BRANCH }}"; then
+          if git diff --quiet "${{ steps.ephemeral-branch.outputs.ephemeral_branch }}"; then
             echo "No changes to push. Cancelling the workflow."
             exit 1
           fi
@@ -409,14 +377,22 @@ jobs:
           retention-days: 1
 
       - name: Cleanup on failure
-        if: failure() && steps.proposal-branch.outputs.branch_name != ''
+        if: failure() && (steps.proposal-branch.outputs.branch_name != '' || steps.ephemeral-branch.outputs.ephemeral_branch != '')
         run: |
           BRANCH_NAME="${{ steps.proposal-branch.outputs.branch_name }}"
-          echo "Job failed, deleting branch $BRANCH_NAME..."
-          git push origin --delete "$BRANCH_NAME" || echo "Failed to delete branch (may not exist on remote)"
+          if [ -n "$BRANCH_NAME" ]; then
+            echo "Job failed, deleting branch $BRANCH_NAME..."
+            git push origin --delete "$BRANCH_NAME" || echo "Failed to delete branch (may not exist on remote)"
+          fi
+          EPHEMERAL_BRANCH="${{ steps.ephemeral-branch.outputs.ephemeral_branch }}"
+          if [ -n "$EPHEMERAL_BRANCH" ]; then
+            echo "Deleting ephemeral release branch $EPHEMERAL_BRANCH..."
+            git push origin --delete "$EPHEMERAL_BRANCH" || echo "Failed to delete ephemeral branch (may not exist on remote)"
+          fi
 
     outputs:
       branch_name: ${{ steps.proposal-branch.outputs.branch_name }}
+      ephemeral_branch: ${{ steps.ephemeral-branch.outputs.ephemeral_branch }}
 
   create-pr:
     needs: cargo-release
@@ -486,11 +462,20 @@ jobs:
             --title "chore(release): proposal for ${{ inputs.crate }}" \
             --body "$PR_BODY" \
             --label "release-proposal" \
-            --base "${{ env.RELEASE_BRANCH }}"
+            --label "skip-metadata-check" \
+            --label "skip-changelog-check" \
+            --base "${{ needs.cargo-release.outputs.ephemeral_branch }}"
 
       - name: Cleanup on failure
-        if: failure() && needs.cargo-release.outputs.branch_name != ''
+        if: failure() && (needs.cargo-release.outputs.branch_name != '' || needs.cargo-release.outputs.ephemeral_branch != '')
         run: |
           BRANCH_NAME="${{ needs.cargo-release.outputs.branch_name }}"
-          echo "Job failed, deleting branch $BRANCH_NAME..."
-          git push origin --delete "$BRANCH_NAME" || echo "Failed to delete branch (may not exist on remote)"
+          if [ -n "$BRANCH_NAME" ]; then
+            echo "Job failed, deleting branch $BRANCH_NAME..."
+            git push origin --delete "$BRANCH_NAME" || echo "Failed to delete branch (may not exist on remote)"
+          fi
+          EPHEMERAL_BRANCH="${{ needs.cargo-release.outputs.ephemeral_branch }}"
+          if [ -n "$EPHEMERAL_BRANCH" ]; then
+            echo "Deleting ephemeral release branch $EPHEMERAL_BRANCH..."
+            git push origin --delete "$EPHEMERAL_BRANCH" || echo "Failed to delete ephemeral branch (may not exist on remote)"
+          fi

.gitlab-ci.yml

@@ -20,7 +20,12 @@ trigger_internal_build:
     LIBDATADOG_COMMIT_BEFORE_SHA: $CI_COMMIT_BEFORE_SHA
     LIBDATADOG_COMMIT_TITLE: $CI_COMMIT_TITLE
     LIBDATADOG_ENABLE_MACOS_JOBS: "false"
+    LIBDATADOG_IS_RELEASE_BRANCH: "false"
   rules:
+    - if: '$CI_COMMIT_BRANCH =~ /^release\//'
+      variables:
+        LIBDATADOG_IS_RELEASE_BRANCH: "true"
+      when: always
     - if: '$CI_MERGE_REQUEST_LABELS =~ /run-macos-tests/'
       variables:
         LIBDATADOG_ENABLE_MACOS_JOBS: "true"