scripts/release.sh - external/github.com/coreos/etcd - Git at Google

 #!/usr/bin/env bash
 # Copyright 2025 The etcd Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
 # http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.

 set -o errexit
 set -o nounset
 set -o pipefail

 source ./scripts/test_lib.sh
 source ./scripts/release_mod.sh

 DRY_RUN=${DRY_RUN:-true}

 # Following preparation steps help with the release process:

 # If you use password-protected gpg key, make sure the password is managed
 # by agent:
 #
 # % gpg-connect-agent reloadagent /bye
 # % gpg -s --default-key [git-email]@google.com -o /dev/null -s /dev/null
 #
 # Refresh your google credentials:
 #  % gcloud auth login
 # or
 #  % gcloud auth activate-service-account --key-file=gcp-key-etcd-development.json
 #
 # Make sure gcloud-docker plugin is configured:
 #  % gcloud auth configure-docker


 help() {
   echo "$(basename "$0") [version]"
   echo "Release etcd using the same approach as the etcd-release-runbook (https://goo.gl/Gxwysq)"
   echo ""
   echo "WARNING: This does not perform the 'Add API capabilities', 'Performance testing' "
   echo "         or 'Documentation' steps. These steps must be performed manually BEFORE running this tool."
   echo ""
   echo "WARNING: This script does not send announcement emails. This step must be performed manually AFTER running this tool."
   echo ""
   echo "  args:"
   echo "    version: version of etcd to release, e.g. 'v3.2.18'"
   echo "  flags:"
   echo "    --in-place: build binaries using current branch."
   echo "    --no-docker-push: skip docker image pushes."
   echo "    --no-gh-release: skip creating the GitHub release using gh."
   echo "    --no-upload: skip gs://etcd binary artifact uploads."
   echo ""
   echo "One can perform a (dry-run) test release from any (uncommitted) branch using:"
   echo "  DRY_RUN=true REPOSITORY=\`pwd\` BRANCH='local-branch-name' ./scripts/release 3.5.0-foobar.2"
 }

 main() {
   # Allow to receive the version with the "v" prefix, i.e. v3.6.0.
   VERSION=${1#v}
   if [[ ! "${VERSION}" =~ ^[0-9]+.[0-9]+.[0-9]+ ]]; then
     log_error "Expected 'version' param of the form '<major-version>.<minor-version>.<patch-version>' but got '${VERSION}'"
     exit 1
   fi
   RELEASE_VERSION="v${VERSION}"
   MINOR_VERSION=$(echo "${VERSION}" | cut -d. -f 1-2)

   if [ "${IN_PLACE}" == 1 ]; then
       # Trigger release in current branch
       REPOSITORY=$(pwd)
       BRANCH=$(git rev-parse --abbrev-ref HEAD)
   else
       REPOSITORY=${REPOSITORY:-"git@github.com:etcd-io/etcd.git"}
       BRANCH=${BRANCH:-"release-${MINOR_VERSION}"}
   fi

   log_warning "DRY_RUN=${DRY_RUN}"
   log_callout "RELEASE_VERSION=${RELEASE_VERSION}"
   log_callout "MINOR_VERSION=${MINOR_VERSION}"
   log_callout "BRANCH=${BRANCH}"
   log_callout "REPOSITORY=${REPOSITORY}"
   log_callout ""

   # Required to enable 'docker manifest ...'
   export DOCKER_CLI_EXPERIMENTAL=enabled

   if ! command -v docker >/dev/null; then
     log_error "cannot find docker"
     exit 1
   fi

   # Expected umask for etcd release artifacts
   umask 022

   # Set up release directory.
   local reldir="/tmp/etcd-release-${VERSION}"
   log_callout "Preparing temporary directory: ${reldir}"
   if [ "${IN_PLACE}" == 0 ]; then
     if [ ! -d "${reldir}/etcd" ]; then
       mkdir -p "${reldir}"
       cd "${reldir}"
       run git clone "${REPOSITORY}" --branch "${BRANCH}" --depth 1
     fi
     run cd "${reldir}/etcd" || exit 2
     run git checkout "${BRANCH}" || exit 2
     run git pull origin

     git_assert_branch_in_sync || exit 2
   fi

   # mark local directory as root for test_lib scripts executions
   set_root_dir

   # If a release version tag already exists, use it.
   local remote_tag_exists
   remote_tag_exists=$(run git ls-remote origin "refs/tags/${RELEASE_VERSION}" | grep -c "${RELEASE_VERSION}" || true)

   if [ "${remote_tag_exists}" -gt 0 ]; then
     log_callout "Release version tag exists on remote. Checking out refs/tags/${RELEASE_VERSION}"
     git checkout -q "tags/${RELEASE_VERSION}"
   fi

   # Check go version.
   log_callout "Check go version"
   local go_version current_go_version
   go_version="go$(cat .go-version)"
   current_go_version=$(go version | awk '{ print $3 }')
   if [[ "${current_go_version}" != "${go_version}" ]]; then
     log_error "Current go version is ${current_go_version}, but etcd ${RELEASE_VERSION} requires ${go_version} (see .go-version)."
     exit 1
   fi

   if [ "${NO_GH_RELEASE}" == 1 ]; then
     log_callout "Skipping gh verification, --no-gh-release is set"
   else
     # Check that gh is installed and logged in.
     log_callout "Check gh installation"
     if ! command -v gh >/dev/null; then
       log_error "Cannot find gh. Please follow the installation instructions at https://github.com/cli/cli#installation"
       exit 1
     fi
     if ! gh auth status &>/dev/null; then
       log_error "GitHub authentication failed for gh. Please run gh auth login."
       exit 1
     fi
   fi

   # If the release tag does not already exist remotely, create it.
   log_callout "Create tag if not present"
   if [ "${remote_tag_exists}" -eq 0 ]; then
     # Bump version/version.go to release version.
     local source_version
     source_version=$(grep -E "\s+Version\s*=" api/version/version.go | sed -e "s/.*\"\(.*\)\".*/\1/g")
     if [[ "${source_version}" != "${VERSION}" ]]; then
       source_minor_version=$(echo "${source_version}" | cut -d. -f 1-2)
       if [[ "${source_minor_version}" != "${MINOR_VERSION}" ]]; then
         log_error "Wrong etcd minor version in api/version/version.go. Expected ${MINOR_VERSION} but got ${source_minor_version}. Aborting."
         exit 1
       fi
       log_callout "Updating modules definitions"
       TARGET_VERSION="v${VERSION}" update_versions_cmd

       log_callout "Updating version from ${source_version} to ${VERSION} in api/version/version.go"
       sed -i "s/${source_version}/${VERSION}/g" api/version/version.go
     fi


     log_callout "Building etcd and checking --version output"
     run ./scripts/build.sh
     local etcd_version
     etcd_version=$(bin/etcd --version | grep "etcd Version" | awk '{ print $3 }')
     if [[ "${etcd_version}" != "${VERSION}" ]]; then
       log_error "Wrong etcd version in version/version.go. Expected ${etcd_version} but got ${VERSION}. Aborting."
       exit 1
     fi

     if [[ -n $(git status -s) ]]; then
       log_callout "Committing mods & api/version/version.go update."
       run git add api/version/version.go
       # shellcheck disable=SC2038,SC2046
       run git add $(find . -name go.mod ! -path './release/*'| xargs)
       run git diff --staged | cat
       run git commit --signoff --message "version: bump up to ${VERSION}"
       run git diff --staged | cat
     fi

     # Push the version change if it's not already been pushed.
     if [ "${DRY_RUN}" != "true" ] && [ "$(git rev-list --count "origin/${BRANCH}..${BRANCH}")" -gt 0 ]; then
       read -p "Push version bump up to ${VERSION} to '$(git remote get-url origin)' [y/N]? " -r confirm
       [[ "${confirm,,}" == "y" ]] || exit 1
       maybe_run git push
     fi

     # Tag release.
     if git tag --list | grep --quiet "^${RELEASE_VERSION}$"; then
       log_callout "Skipping tag step. git tag ${RELEASE_VERSION} already exists."
     else
       log_callout "Tagging release..."
       REMOTE_REPO="origin" push_mod_tags_cmd
     fi

     if [ "${IN_PLACE}" == 0 ]; then
       # Tried with `local branch=$(git branch -a --contains tags/"${RELEASE_VERSION}")`
       # so as to work with both current branch and main/release-3.X.
       # But got error below on current branch mode,
       # Error: Git tag v3.6.99 should be on branch '* (HEAD detached at pull/14860/merge)' but is on '* (HEAD detached from pull/14860/merge)'
       #
       # Verify the version tag is on the right branch
       # shellcheck disable=SC2155
       local branch=$(git for-each-ref --contains "${RELEASE_VERSION}" --format="%(refname)" 'refs/heads' | cut -d '/' -f 3)
       if [ "${branch}" != "${BRANCH}" ]; then
         log_error "Error: Git tag ${RELEASE_VERSION} should be on branch '${BRANCH}' but is on '${branch}'"
         exit 1
       fi
     fi
   fi

   log_callout "Verify the latest commit has the version tag"
   # Verify the latest commit has the version tag
   # shellcheck disable=SC2155
   local tag="$(git describe --exact-match HEAD)"
   if [ "${tag}" != "${RELEASE_VERSION}" ]; then
     log_error "Error: Expected HEAD to be tagged with ${RELEASE_VERSION}, but 'git describe --exact-match HEAD' reported: ${tag}"
     exit 1
   fi

   log_callout "Verify the work space is clean"
   # Verify the clean working tree
   # shellcheck disable=SC2155
   local diff="$(git diff HEAD --stat)"
   if [[ "${diff}" != '' ]]; then
     log_error "Error: Expected clean working tree, but 'git diff --stat' reported: ${diff}"
     exit 1
   fi

   # Build release.
   # TODO: check the release directory for all required build artifacts.
   if [ -d release ]; then
     log_warning "Skipping release build step. /release directory already exists."
   else
     log_callout "Building release..."
     REPOSITORY=$(pwd) ./scripts/build-release.sh "${RELEASE_VERSION}"
   fi

   # Sanity checks.
   "./release/etcd-${RELEASE_VERSION}-$(go env GOOS)-amd64/etcd" --version | grep -q "etcd Version: ${VERSION}" || true
   "./release/etcd-${RELEASE_VERSION}-$(go env GOOS)-amd64/etcdctl" version | grep -q "etcdctl version: ${VERSION}" || true
   "./release/etcd-${RELEASE_VERSION}-$(go env GOOS)-amd64/etcdutl" version | grep -q "etcdutl version: ${VERSION}" || true

   # Generate SHA256SUMS
   log_callout "Generating sha256sums of release artifacts."
   pushd ./release
   # shellcheck disable=SC2010
   ls . | grep -E '\.tar.gz$|\.zip$' | xargs shasum -a 256 > ./SHA256SUMS
   popd
   if [ -s ./release/SHA256SUMS ]; then
     cat ./release/SHA256SUMS
   else
     log_error "sha256sums is not valid. Aborting."
     exit 1
   fi

   # Upload artifacts.
   if [ "${DRY_RUN}" == "true" ] || [ "${NO_UPLOAD}" == 1 ]; then
     log_callout "Skipping artifact upload to gs://etcd. --no-upload flag is set."
   else
     read -p "Upload etcd ${RELEASE_VERSION} release artifacts to gs://etcd [y/N]? " -r confirm
     [[ "${confirm,,}" == "y" ]] || exit 1
     maybe_run gsutil -m cp ./release/SHA256SUMS "gs://etcd/${RELEASE_VERSION}/"
     maybe_run gsutil -m cp ./release/*.zip "gs://etcd/${RELEASE_VERSION}/"
     maybe_run gsutil -m cp ./release/*.tar.gz "gs://etcd/${RELEASE_VERSION}/"
     maybe_run gsutil -m acl ch -u allUsers:R -r "gs://etcd/${RELEASE_VERSION}/"
   fi

   # Push images.
   if [ "${DRY_RUN}" == "true" ] || [ "${NO_DOCKER_PUSH}" == 1 ]; then
     log_callout "Skipping docker push. --no-docker-push flag is set."
   else
     read -p "Publish etcd ${RELEASE_VERSION} docker images to quay.io [y/N]? " -r confirm
     [[ "${confirm,,}" == "y" ]] || exit 1
     # shellcheck disable=SC2034
     for i in {1..5}; do
       docker login quay.io && break
       log_warning "login failed, retrying"
     done

     for TARGET_ARCH in "amd64" "arm64" "ppc64le" "s390x"; do
       log_callout "Pushing container images to quay.io ${RELEASE_VERSION}-${TARGET_ARCH}"
       maybe_run docker push "quay.io/coreos/etcd:${RELEASE_VERSION}-${TARGET_ARCH}"
       log_callout "Pushing container images to gcr.io ${RELEASE_VERSION}-${TARGET_ARCH}"
       maybe_run docker push "gcr.io/etcd-development/etcd:${RELEASE_VERSION}-${TARGET_ARCH}"
     done

     log_callout "Creating manifest-list (multi-image)..."

     for TARGET_ARCH in "amd64" "arm64" "ppc64le" "s390x"; do
       maybe_run docker manifest create --amend "quay.io/coreos/etcd:${RELEASE_VERSION}" "quay.io/coreos/etcd:${RELEASE_VERSION}-${TARGET_ARCH}"
       maybe_run docker manifest annotate "quay.io/coreos/etcd:${RELEASE_VERSION}" "quay.io/coreos/etcd:${RELEASE_VERSION}-${TARGET_ARCH}" --arch "${TARGET_ARCH}"

       maybe_run docker manifest create --amend "gcr.io/etcd-development/etcd:${RELEASE_VERSION}" "gcr.io/etcd-development/etcd:${RELEASE_VERSION}-${TARGET_ARCH}"
       maybe_run docker manifest annotate "gcr.io/etcd-development/etcd:${RELEASE_VERSION}" "gcr.io/etcd-development/etcd:${RELEASE_VERSION}-${TARGET_ARCH}" --arch "${TARGET_ARCH}"
     done

     log_callout "Pushing container manifest list to quay.io ${RELEASE_VERSION}"
     maybe_run docker manifest push "quay.io/coreos/etcd:${RELEASE_VERSION}"

     log_callout "Pushing container manifest list to gcr.io ${RELEASE_VERSION}"
     maybe_run docker manifest push "gcr.io/etcd-development/etcd:${RELEASE_VERSION}"
   fi

   ### Release validation
   mkdir -p downloads

   # Check image versions
   for IMAGE in "quay.io/coreos/etcd:${RELEASE_VERSION}" "gcr.io/etcd-development/etcd:${RELEASE_VERSION}"; do
     if [ "${DRY_RUN}" == "true" ] || [ "${NO_DOCKER_PUSH}" == 1 ]; then
       IMAGE="${IMAGE}-amd64"
     fi
     # shellcheck disable=SC2155
     local image_version=$(docker run --rm "${IMAGE}" etcd --version | grep "etcd Version" | awk -F: '{print $2}' | tr -d '[:space:]')
     if [ "${image_version}" != "${VERSION}" ]; then
       log_error "Check failed: etcd --version output for ${IMAGE} is incorrect: ${image_version}"
       exit 1
     fi
   done

   # Check gsutil binary versions
   # shellcheck disable=SC2155
   local BINARY_TGZ="etcd-${RELEASE_VERSION}-$(go env GOOS)-amd64.tar.gz"
   if [ "${DRY_RUN}" == "true" ] || [ "${NO_UPLOAD}" == 1 ]; then
     cp "./release/${BINARY_TGZ}" downloads
   else
     gsutil cp "gs://etcd/${RELEASE_VERSION}/${BINARY_TGZ}" downloads
   fi
   tar -zx -C downloads -f "downloads/${BINARY_TGZ}"
   # shellcheck disable=SC2155
   local binary_version=$("./downloads/etcd-${RELEASE_VERSION}-$(go env GOOS)-amd64/etcd" --version | grep "etcd Version" | awk -F: '{print $2}' | tr -d '[:space:]')
   if [ "${binary_version}" != "${VERSION}" ]; then
     log_error "Check failed: etcd --version output for ${BINARY_TGZ} from gs://etcd/${RELEASE_VERSION} is incorrect: ${binary_version}"
     exit 1
   fi

   if [ "${DRY_RUN}" == "true" ] || [ "${NO_GH_RELEASE}" == 1 ]; then
     log_warning ""
     log_warning "WARNING: Skipping creating GitHub release, --no-gh-release is set."
     log_warning "WARNING: If not running on DRY_MODE, please do the GitHub release manually."
     log_warning ""
   else
     local gh_repo
     local release_notes_temp_file
     local release_url
     local gh_release_args=()

     # For the main branch (v3.6), we should mark the release as a prerelease.
     # The release-3.5 (v3.5) branch, should be marked as latest. And release-3.4 (v3.4)
     # should be left without any additional mark (therefore, it doesn't need a special argument).
     if [ "${BRANCH}" = "main" ]; then
       gh_release_args=(--prerelease)
     elif [ "${BRANCH}" = "release-3.5" ]; then
       gh_release_args=(--latest)
     fi

     if [ "${REPOSITORY}" = "$(pwd)" ]; then
       gh_repo=$(git remote get-url origin)
     else
       gh_repo="${REPOSITORY}"
     fi

     gh_repo=$(echo "${gh_repo}" | sed 's/^[^@]\+@//' | sed 's/https\?:\/\///' | sed 's/\.git$//' | tr ':' '/')
     log_callout "Creating GitHub release for ${RELEASE_VERSION} on ${gh_repo}"

     release_notes_temp_file=$(mktemp)

     local release_version=${RELEASE_VERSION#v} # Remove the v prefix from the release version (i.e., v3.6.1 -> 3.6.1)
     local release_version_major_minor
     release_version_major_minor=$(echo "${release_version}" | cut -d. -f1-2) # Remove the patch from the version (i.e., 3.6)
     local release_version_major=${release_version_major_minor%.*} # Extract the major (i.e., 3)
     local release_version_minor=${release_version_major_minor/*./} # Extract the minor (i.e., 6)

     # Disable sellcheck SC2016, the single quoted syntax for sed is intentional.
     # shellcheck disable=SC2016
     sed 's/${RELEASE_VERSION}/'"${RELEASE_VERSION}"'/g' ./scripts/release_notes.tpl.txt |
       sed 's/${RELEASE_VERSION_MAJOR_MINOR}/'"${release_version_major_minor}"'/g' |
       sed 's/${RELEASE_VERSION_MAJOR}/'"${release_version_major}"'/g' |
       sed 's/${RELEASE_VERSION_MINOR}/'"${release_version_minor}"'/g' > "${release_notes_temp_file}"

     if ! gh --repo "${gh_repo}" release view "${RELEASE_VERSION}" &>/dev/null; then
       maybe_run gh release create "${RELEASE_VERSION}" \
           --repo "${gh_repo}" \
           --draft \
           --title "${RELEASE_VERSION}" \
           --notes-file "${release_notes_temp_file}" \
           "${gh_release_args[@]}"
     fi

     # Upload files one by one, as gh doesn't support passing globs as input.
     maybe_run find ./release '(' -name '*.tar.gz' -o -name '*.zip' ')' -exec \
       gh --repo "${gh_repo}" release upload "${RELEASE_VERSION}" {} --clobber \;
     maybe_run gh --repo "${gh_repo}" release upload "${RELEASE_VERSION}" ./release/SHA256SUMS --clobber

     release_url=$(gh --repo "${gh_repo}" release view "${RELEASE_VERSION}" --json url --jq '.url')

     log_warning ""
     log_warning "WARNING: The GitHub release for ${RELEASE_VERSION} has been created as a draft, please go to ${release_url} and release it."
     log_warning ""
   fi

   log_success "Success."
   exit 0
 }

 POSITIONAL=()
 NO_UPLOAD=0
 NO_DOCKER_PUSH=0
 IN_PLACE=0
 NO_GH_RELEASE=0

 while test $# -gt 0; do
         case "$1" in
           -h|--help)
             shift
             help
             exit 0
             ;;
           --in-place)
             IN_PLACE=1
             shift
             ;;
           --no-upload)
             NO_UPLOAD=1
             shift
             ;;
           --no-docker-push)
             NO_DOCKER_PUSH=1
             shift
             ;;
           --no-gh-release)
             NO_GH_RELEASE=1
             shift
             ;;
           *)
             POSITIONAL+=("$1") # save it in an array for later
             shift # past argument
             ;;
         esac
 done
 set -- "${POSITIONAL[@]}" # restore positional parameters

 if [[ ! $# -eq 1 ]]; then
   help
   exit 1
 fi

 # Note that we shouldn't upload artifacts in --in-place mode, so it
 # must be called with DRY_RUN=true
 if [ "${DRY_RUN}" != "true" ] && [ "${IN_PLACE}" == 1 ]; then
    log_error "--in-place should only be called with DRY_RUN=true"
    exit 1
 fi

 main "$1"
	#!/usr/bin/env bash
	# Copyright 2025 The etcd Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	set -o errexit
	set -o nounset
	set -o pipefail

	source ./scripts/test_lib.sh
	source ./scripts/release_mod.sh

	DRY_RUN=${DRY_RUN:-true}

	# Following preparation steps help with the release process:

	# If you use password-protected gpg key, make sure the password is managed
	# by agent:
	#
	# % gpg-connect-agent reloadagent /bye
	# % gpg -s --default-key [git-email]@google.com -o /dev/null -s /dev/null
	#
	# Refresh your google credentials:
	# % gcloud auth login
	# or
	# % gcloud auth activate-service-account --key-file=gcp-key-etcd-development.json
	#
	# Make sure gcloud-docker plugin is configured:
	# % gcloud auth configure-docker


	help() {
	echo "$(basename "$0") [version]"
	echo "Release etcd using the same approach as the etcd-release-runbook (https://goo.gl/Gxwysq)"
	echo ""
	echo "WARNING: This does not perform the 'Add API capabilities', 'Performance testing' "
	echo " or 'Documentation' steps. These steps must be performed manually BEFORE running this tool."
	echo ""
	echo "WARNING: This script does not send announcement emails. This step must be performed manually AFTER running this tool."
	echo ""
	echo " args:"
	echo " version: version of etcd to release, e.g. 'v3.2.18'"
	echo " flags:"
	echo " --in-place: build binaries using current branch."
	echo " --no-docker-push: skip docker image pushes."
	echo " --no-gh-release: skip creating the GitHub release using gh."
	echo " --no-upload: skip gs://etcd binary artifact uploads."
	echo ""
	echo "One can perform a (dry-run) test release from any (uncommitted) branch using:"
	echo " DRY_RUN=true REPOSITORY=\`pwd\` BRANCH='local-branch-name' ./scripts/release 3.5.0-foobar.2"
	}

	main() {
	# Allow to receive the version with the "v" prefix, i.e. v3.6.0.
	VERSION=${1#v}
	if [[ ! "${VERSION}" =~ ^[0-9]+.[0-9]+.[0-9]+ ]]; then
	log_error "Expected 'version' param of the form '<major-version>.<minor-version>.<patch-version>' but got '${VERSION}'"
	exit 1
	fi
	RELEASE_VERSION="v${VERSION}"
	MINOR_VERSION=$(echo "${VERSION}" \| cut -d. -f 1-2)

	if [ "${IN_PLACE}" == 1 ]; then
	# Trigger release in current branch
	REPOSITORY=$(pwd)
	BRANCH=$(git rev-parse --abbrev-ref HEAD)
	else
	REPOSITORY=${REPOSITORY:-"git@github.com:etcd-io/etcd.git"}
	BRANCH=${BRANCH:-"release-${MINOR_VERSION}"}
	fi

	log_warning "DRY_RUN=${DRY_RUN}"
	log_callout "RELEASE_VERSION=${RELEASE_VERSION}"
	log_callout "MINOR_VERSION=${MINOR_VERSION}"
	log_callout "BRANCH=${BRANCH}"
	log_callout "REPOSITORY=${REPOSITORY}"
	log_callout ""

	# Required to enable 'docker manifest ...'
	export DOCKER_CLI_EXPERIMENTAL=enabled

	if ! command -v docker >/dev/null; then
	log_error "cannot find docker"
	exit 1
	fi

	# Expected umask for etcd release artifacts
	umask 022

	# Set up release directory.
	local reldir="/tmp/etcd-release-${VERSION}"
	log_callout "Preparing temporary directory: ${reldir}"
	if [ "${IN_PLACE}" == 0 ]; then
	if [ ! -d "${reldir}/etcd" ]; then
	mkdir -p "${reldir}"
	cd "${reldir}"
	run git clone "${REPOSITORY}" --branch "${BRANCH}" --depth 1
	fi
	run cd "${reldir}/etcd" \|\| exit 2
	run git checkout "${BRANCH}" \|\| exit 2
	run git pull origin

	git_assert_branch_in_sync \|\| exit 2
	fi

	# mark local directory as root for test_lib scripts executions
	set_root_dir

	# If a release version tag already exists, use it.
	local remote_tag_exists
	remote_tag_exists=$(run git ls-remote origin "refs/tags/${RELEASE_VERSION}" \| grep -c "${RELEASE_VERSION}" \|\| true)

	if [ "${remote_tag_exists}" -gt 0 ]; then
	log_callout "Release version tag exists on remote. Checking out refs/tags/${RELEASE_VERSION}"
	git checkout -q "tags/${RELEASE_VERSION}"
	fi

	# Check go version.
	log_callout "Check go version"
	local go_version current_go_version
	go_version="go$(cat .go-version)"
	current_go_version=$(go version \| awk '{ print $3 }')
	if [[ "${current_go_version}" != "${go_version}" ]]; then
	log_error "Current go version is ${current_go_version}, but etcd ${RELEASE_VERSION} requires ${go_version} (see .go-version)."
	exit 1
	fi

	if [ "${NO_GH_RELEASE}" == 1 ]; then
	log_callout "Skipping gh verification, --no-gh-release is set"
	else
	# Check that gh is installed and logged in.
	log_callout "Check gh installation"
	if ! command -v gh >/dev/null; then
	log_error "Cannot find gh. Please follow the installation instructions at https://github.com/cli/cli#installation"
	exit 1
	fi
	if ! gh auth status &>/dev/null; then
	log_error "GitHub authentication failed for gh. Please run gh auth login."
	exit 1
	fi
	fi

	# If the release tag does not already exist remotely, create it.
	log_callout "Create tag if not present"
	if [ "${remote_tag_exists}" -eq 0 ]; then
	# Bump version/version.go to release version.
	local source_version
	source_version=$(grep -E "\s+Version\s=" api/version/version.go \| sed -e "s/.\"\(.\)\"./\1/g")
	if [[ "${source_version}" != "${VERSION}" ]]; then
	source_minor_version=$(echo "${source_version}" \| cut -d. -f 1-2)
	if [[ "${source_minor_version}" != "${MINOR_VERSION}" ]]; then
	log_error "Wrong etcd minor version in api/version/version.go. Expected ${MINOR_VERSION} but got ${source_minor_version}. Aborting."
	exit 1
	fi
	log_callout "Updating modules definitions"
	TARGET_VERSION="v${VERSION}" update_versions_cmd

	log_callout "Updating version from ${source_version} to ${VERSION} in api/version/version.go"
	sed -i "s/${source_version}/${VERSION}/g" api/version/version.go
	fi


	log_callout "Building etcd and checking --version output"
	run ./scripts/build.sh
	local etcd_version
	etcd_version=$(bin/etcd --version \| grep "etcd Version" \| awk '{ print $3 }')
	if [[ "${etcd_version}" != "${VERSION}" ]]; then
	log_error "Wrong etcd version in version/version.go. Expected ${etcd_version} but got ${VERSION}. Aborting."
	exit 1
	fi

	if [[ -n $(git status -s) ]]; then
	log_callout "Committing mods & api/version/version.go update."
	run git add api/version/version.go
	# shellcheck disable=SC2038,SC2046
	run git add $(find . -name go.mod ! -path './release/*'\| xargs)
	run git diff --staged \| cat
	run git commit --signoff --message "version: bump up to ${VERSION}"
	run git diff --staged \| cat
	fi

	# Push the version change if it's not already been pushed.
	if [ "${DRY_RUN}" != "true" ] && [ "$(git rev-list --count "origin/${BRANCH}..${BRANCH}")" -gt 0 ]; then
	read -p "Push version bump up to ${VERSION} to '$(git remote get-url origin)' [y/N]? " -r confirm
	[[ "${confirm,,}" == "y" ]] \|\| exit 1
	maybe_run git push
	fi

	# Tag release.
	if git tag --list \| grep --quiet "^${RELEASE_VERSION}$"; then
	log_callout "Skipping tag step. git tag ${RELEASE_VERSION} already exists."
	else
	log_callout "Tagging release..."
	REMOTE_REPO="origin" push_mod_tags_cmd
	fi

	if [ "${IN_PLACE}" == 0 ]; then
	# Tried with `local branch=$(git branch -a --contains tags/"${RELEASE_VERSION}")`
	# so as to work with both current branch and main/release-3.X.
	# But got error below on current branch mode,
	# Error: Git tag v3.6.99 should be on branch '* (HEAD detached at pull/14860/merge)' but is on '* (HEAD detached from pull/14860/merge)'
	#
	# Verify the version tag is on the right branch
	# shellcheck disable=SC2155
	local branch=$(git for-each-ref --contains "${RELEASE_VERSION}" --format="%(refname)" 'refs/heads' \| cut -d '/' -f 3)
	if [ "${branch}" != "${BRANCH}" ]; then
	log_error "Error: Git tag ${RELEASE_VERSION} should be on branch '${BRANCH}' but is on '${branch}'"
	exit 1
	fi
	fi
	fi

	log_callout "Verify the latest commit has the version tag"
	# Verify the latest commit has the version tag
	# shellcheck disable=SC2155
	local tag="$(git describe --exact-match HEAD)"
	if [ "${tag}" != "${RELEASE_VERSION}" ]; then
	log_error "Error: Expected HEAD to be tagged with ${RELEASE_VERSION}, but 'git describe --exact-match HEAD' reported: ${tag}"
	exit 1
	fi

	log_callout "Verify the work space is clean"
	# Verify the clean working tree
	# shellcheck disable=SC2155
	local diff="$(git diff HEAD --stat)"
	if [[ "${diff}" != '' ]]; then
	log_error "Error: Expected clean working tree, but 'git diff --stat' reported: ${diff}"
	exit 1
	fi

	# Build release.
	# TODO: check the release directory for all required build artifacts.
	if [ -d release ]; then
	log_warning "Skipping release build step. /release directory already exists."
	else
	log_callout "Building release..."
	REPOSITORY=$(pwd) ./scripts/build-release.sh "${RELEASE_VERSION}"
	fi

	# Sanity checks.
	"./release/etcd-${RELEASE_VERSION}-$(go env GOOS)-amd64/etcd" --version \| grep -q "etcd Version: ${VERSION}" \|\| true
	"./release/etcd-${RELEASE_VERSION}-$(go env GOOS)-amd64/etcdctl" version \| grep -q "etcdctl version: ${VERSION}" \|\| true
	"./release/etcd-${RELEASE_VERSION}-$(go env GOOS)-amd64/etcdutl" version \| grep -q "etcdutl version: ${VERSION}" \|\| true

	# Generate SHA256SUMS
	log_callout "Generating sha256sums of release artifacts."
	pushd ./release
	# shellcheck disable=SC2010
	ls . \| grep -E '\.tar.gz$\|\.zip$' \| xargs shasum -a 256 > ./SHA256SUMS
	popd
	if [ -s ./release/SHA256SUMS ]; then
	cat ./release/SHA256SUMS
	else
	log_error "sha256sums is not valid. Aborting."
	exit 1
	fi

	# Upload artifacts.
	if [ "${DRY_RUN}" == "true" ] \|\| [ "${NO_UPLOAD}" == 1 ]; then
	log_callout "Skipping artifact upload to gs://etcd. --no-upload flag is set."
	else
	read -p "Upload etcd ${RELEASE_VERSION} release artifacts to gs://etcd [y/N]? " -r confirm
	[[ "${confirm,,}" == "y" ]] \|\| exit 1
	maybe_run gsutil -m cp ./release/SHA256SUMS "gs://etcd/${RELEASE_VERSION}/"
	maybe_run gsutil -m cp ./release/*.zip "gs://etcd/${RELEASE_VERSION}/"
	maybe_run gsutil -m cp ./release/*.tar.gz "gs://etcd/${RELEASE_VERSION}/"
	maybe_run gsutil -m acl ch -u allUsers:R -r "gs://etcd/${RELEASE_VERSION}/"
	fi

	# Push images.
	if [ "${DRY_RUN}" == "true" ] \|\| [ "${NO_DOCKER_PUSH}" == 1 ]; then
	log_callout "Skipping docker push. --no-docker-push flag is set."
	else
	read -p "Publish etcd ${RELEASE_VERSION} docker images to quay.io [y/N]? " -r confirm
	[[ "${confirm,,}" == "y" ]] \|\| exit 1
	# shellcheck disable=SC2034
	for i in {1..5}; do
	docker login quay.io && break
	log_warning "login failed, retrying"
	done

	for TARGET_ARCH in "amd64" "arm64" "ppc64le" "s390x"; do
	log_callout "Pushing container images to quay.io ${RELEASE_VERSION}-${TARGET_ARCH}"
	maybe_run docker push "quay.io/coreos/etcd:${RELEASE_VERSION}-${TARGET_ARCH}"
	log_callout "Pushing container images to gcr.io ${RELEASE_VERSION}-${TARGET_ARCH}"
	maybe_run docker push "gcr.io/etcd-development/etcd:${RELEASE_VERSION}-${TARGET_ARCH}"
	done

	log_callout "Creating manifest-list (multi-image)..."

	for TARGET_ARCH in "amd64" "arm64" "ppc64le" "s390x"; do
	maybe_run docker manifest create --amend "quay.io/coreos/etcd:${RELEASE_VERSION}" "quay.io/coreos/etcd:${RELEASE_VERSION}-${TARGET_ARCH}"
	maybe_run docker manifest annotate "quay.io/coreos/etcd:${RELEASE_VERSION}" "quay.io/coreos/etcd:${RELEASE_VERSION}-${TARGET_ARCH}" --arch "${TARGET_ARCH}"

	maybe_run docker manifest create --amend "gcr.io/etcd-development/etcd:${RELEASE_VERSION}" "gcr.io/etcd-development/etcd:${RELEASE_VERSION}-${TARGET_ARCH}"
	maybe_run docker manifest annotate "gcr.io/etcd-development/etcd:${RELEASE_VERSION}" "gcr.io/etcd-development/etcd:${RELEASE_VERSION}-${TARGET_ARCH}" --arch "${TARGET_ARCH}"
	done

	log_callout "Pushing container manifest list to quay.io ${RELEASE_VERSION}"
	maybe_run docker manifest push "quay.io/coreos/etcd:${RELEASE_VERSION}"

	log_callout "Pushing container manifest list to gcr.io ${RELEASE_VERSION}"
	maybe_run docker manifest push "gcr.io/etcd-development/etcd:${RELEASE_VERSION}"
	fi

	### Release validation
	mkdir -p downloads

	# Check image versions
	for IMAGE in "quay.io/coreos/etcd:${RELEASE_VERSION}" "gcr.io/etcd-development/etcd:${RELEASE_VERSION}"; do
	if [ "${DRY_RUN}" == "true" ] \|\| [ "${NO_DOCKER_PUSH}" == 1 ]; then
	IMAGE="${IMAGE}-amd64"
	fi
	# shellcheck disable=SC2155
	local image_version=$(docker run --rm "${IMAGE}" etcd --version \| grep "etcd Version" \| awk -F: '{print $2}' \| tr -d '[:space:]')
	if [ "${image_version}" != "${VERSION}" ]; then
	log_error "Check failed: etcd --version output for ${IMAGE} is incorrect: ${image_version}"
	exit 1
	fi
	done

	# Check gsutil binary versions
	# shellcheck disable=SC2155
	local BINARY_TGZ="etcd-${RELEASE_VERSION}-$(go env GOOS)-amd64.tar.gz"
	if [ "${DRY_RUN}" == "true" ] \|\| [ "${NO_UPLOAD}" == 1 ]; then
	cp "./release/${BINARY_TGZ}" downloads
	else
	gsutil cp "gs://etcd/${RELEASE_VERSION}/${BINARY_TGZ}" downloads
	fi
	tar -zx -C downloads -f "downloads/${BINARY_TGZ}"
	# shellcheck disable=SC2155
	local binary_version=$("./downloads/etcd-${RELEASE_VERSION}-$(go env GOOS)-amd64/etcd" --version \| grep "etcd Version" \| awk -F: '{print $2}' \| tr -d '[:space:]')
	if [ "${binary_version}" != "${VERSION}" ]; then
	log_error "Check failed: etcd --version output for ${BINARY_TGZ} from gs://etcd/${RELEASE_VERSION} is incorrect: ${binary_version}"
	exit 1
	fi

	if [ "${DRY_RUN}" == "true" ] \|\| [ "${NO_GH_RELEASE}" == 1 ]; then
	log_warning ""
	log_warning "WARNING: Skipping creating GitHub release, --no-gh-release is set."
	log_warning "WARNING: If not running on DRY_MODE, please do the GitHub release manually."
	log_warning ""
	else
	local gh_repo
	local release_notes_temp_file
	local release_url
	local gh_release_args=()

	# For the main branch (v3.6), we should mark the release as a prerelease.
	# The release-3.5 (v3.5) branch, should be marked as latest. And release-3.4 (v3.4)
	# should be left without any additional mark (therefore, it doesn't need a special argument).
	if [ "${BRANCH}" = "main" ]; then
	gh_release_args=(--prerelease)
	elif [ "${BRANCH}" = "release-3.5" ]; then
	gh_release_args=(--latest)
	fi

	if [ "${REPOSITORY}" = "$(pwd)" ]; then
	gh_repo=$(git remote get-url origin)
	else
	gh_repo="${REPOSITORY}"
	fi

	gh_repo=$(echo "${gh_repo}" \| sed 's/^[^@]\+@//' \| sed 's/https\?:\/\///' \| sed 's/\.git$//' \| tr ':' '/')
	log_callout "Creating GitHub release for ${RELEASE_VERSION} on ${gh_repo}"

	release_notes_temp_file=$(mktemp)

	local release_version=${RELEASE_VERSION#v} # Remove the v prefix from the release version (i.e., v3.6.1 -> 3.6.1)
	local release_version_major_minor
	release_version_major_minor=$(echo "${release_version}" \| cut -d. -f1-2) # Remove the patch from the version (i.e., 3.6)
	local release_version_major=${release_version_major_minor%.*} # Extract the major (i.e., 3)
	local release_version_minor=${release_version_major_minor/*./} # Extract the minor (i.e., 6)

	# Disable sellcheck SC2016, the single quoted syntax for sed is intentional.
	# shellcheck disable=SC2016
	sed 's/${RELEASE_VERSION}/'"${RELEASE_VERSION}"'/g' ./scripts/release_notes.tpl.txt \|
	sed 's/${RELEASE_VERSION_MAJOR_MINOR}/'"${release_version_major_minor}"'/g' \|
	sed 's/${RELEASE_VERSION_MAJOR}/'"${release_version_major}"'/g' \|
	sed 's/${RELEASE_VERSION_MINOR}/'"${release_version_minor}"'/g' > "${release_notes_temp_file}"

	if ! gh --repo "${gh_repo}" release view "${RELEASE_VERSION}" &>/dev/null; then
	maybe_run gh release create "${RELEASE_VERSION}" \
	--repo "${gh_repo}" \
	--draft \
	--title "${RELEASE_VERSION}" \
	--notes-file "${release_notes_temp_file}" \
	"${gh_release_args[@]}"
	fi

	# Upload files one by one, as gh doesn't support passing globs as input.
	maybe_run find ./release '(' -name '.tar.gz' -o -name '.zip' ')' -exec \
	gh --repo "${gh_repo}" release upload "${RELEASE_VERSION}" {} --clobber \;
	maybe_run gh --repo "${gh_repo}" release upload "${RELEASE_VERSION}" ./release/SHA256SUMS --clobber

	release_url=$(gh --repo "${gh_repo}" release view "${RELEASE_VERSION}" --json url --jq '.url')

	log_warning ""
	log_warning "WARNING: The GitHub release for ${RELEASE_VERSION} has been created as a draft, please go to ${release_url} and release it."
	log_warning ""
	fi

	log_success "Success."
	exit 0
	}

	POSITIONAL=()
	NO_UPLOAD=0
	NO_DOCKER_PUSH=0
	IN_PLACE=0
	NO_GH_RELEASE=0

	while test $# -gt 0; do
	case "$1" in
	-h\|--help)
	shift
	help
	exit 0
	;;
	--in-place)
	IN_PLACE=1
	shift
	;;
	--no-upload)
	NO_UPLOAD=1
	shift
	;;
	--no-docker-push)
	NO_DOCKER_PUSH=1
	shift
	;;
	--no-gh-release)
	NO_GH_RELEASE=1
	shift
	;;
	*)
	POSITIONAL+=("$1") # save it in an array for later
	shift # past argument
	;;
	esac
	done
	set -- "${POSITIONAL[@]}" # restore positional parameters

	if [[ ! $# -eq 1 ]]; then
	help
	exit 1
	fi

	# Note that we shouldn't upload artifacts in --in-place mode, so it
	# must be called with DRY_RUN=true
	if [ "${DRY_RUN}" != "true" ] && [ "${IN_PLACE}" == 1 ]; then
	log_error "--in-place should only be called with DRY_RUN=true"
	exit 1
	fi

	main "$1"