Update releasing workflow

Makefile

@@ -3,7 +3,7 @@
 #
 # Makefile for kustomize CLI and API.
 
-LATEST_V4_RELEASE=v4.5.7
+LATEST_RELEASE=v5.0.0
 
 SHELL := /usr/bin/env bash
 GOOS = $(shell go env GOOS)
@@ -101,7 +101,7 @@ verify-kustomize-repo: \
 	build-non-plugin-all \
 	test-go-mod \
 	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-v4-release
+	test-examples-kustomize-against-latest-release
 
 # The following target referenced by a file in
 # https://github.com/kubernetes/test-infra/tree/master/config/jobs/kubernetes-sigs/kustomize
@@ -112,7 +112,7 @@ prow-presubmit-check: \
 	test-go-mod \
 	build-non-plugin-all \
 	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-v4-release
+	test-examples-kustomize-against-latest-release
 
 .PHONY: license
 license: $(MYGOBIN)/addlicense
@@ -153,7 +153,7 @@ functions-examples-all:
 	done
 
 test-go-mod:
-	./hack/for-each-module.sh "\$$KUSTOMIZE_ROOT/hack/with-unpinned-kust-dev.sh 'go mod tidy -v'"
+	./hack/for-each-module.sh "go mod tidy -v"
 
 .PHONY:
 verify-kustomize-e2e: $(MYGOBIN)/mdrip $(MYGOBIN)/kind
@@ -170,8 +170,8 @@ test-examples-kustomize-against-HEAD: $(MYGOBIN)/kustomize $(MYGOBIN)/mdrip
 	./hack/testExamplesAgainstKustomize.sh HEAD
 
 .PHONY:
-test-examples-kustomize-against-v4-release: $(MYGOBIN)/mdrip
-	./hack/testExamplesAgainstKustomize.sh v4@$(LATEST_V4_RELEASE)
+test-examples-kustomize-against-latest-release: $(MYGOBIN)/mdrip
+	./hack/testExamplesAgainstKustomize.sh v5@$(LATEST_RELEASE)
 
 
 # --- Cleanup targets ---

README.md

@@ -20,7 +20,7 @@ This tool is sponsored by [sig-cli] ([KEP]).
 
 ## kubectl integration
 
-To find the kustomize version embedded in recently version of kubectl, run `kubectl version`:
+To find the kustomize version embedded in recent versions of kubectl, run `kubectl version`:
 
 ```sh
 > kubectl version --short --client

cmd/gorepomod/internal/arguments/args.go

@@ -36,7 +36,6 @@ var (
 		"docs",
 		"examples",
 		"hack",
-		"plugin",
 		"releasing",
 		"site",
 	}

cmd/gorepomod/internal/edit/editor.go

@@ -34,7 +34,7 @@ func (e *Editor) run(args ...string) error {
 	if e.doIt {
 		out, err := c.CombinedOutput()
 		if err != nil {
-			return fmt.Errorf("%s out=%q", err.Error(), out)
+			return fmt.Errorf("failed to run go mod command in %s: %w (stdout=%q)", e.module.ShortName(), err, out)
 		}
 	} else {
 		fmt.Printf("in %-60s; %s\n", c.Dir, c.String())
@@ -57,6 +57,8 @@ func (e *Editor) Tidy() error {
 func (e *Editor) Pin(target misc.LaModule, oldV, newV semver.SemVer) error {
 	err := e.run(
 		"edit",
+		"-dropreplace="+target.ImportPath(),
+		"-dropreplace="+target.ImportPath()+"@"+oldV.String(),
 		"-require="+target.ImportPath()+"@"+newV.String(),
 	)
 	if err != nil {

cmd/gorepomod/internal/repo/dotgitdata.go

@@ -45,8 +45,9 @@ func (dg *DotGitData) AbsPath() string {
 
 // NewDotGitDataFromPath wants the incoming path to hold dotGit
 // E.g.
-//   ~/gopath/src/sigs.k8s.io/kustomize
-//   ~/gopath/src/github.com/monopole/gorepomod
+//
+//	~/gopath/src/sigs.k8s.io/kustomize
+//	~/gopath/src/github.com/monopole/gorepomod
 func NewDotGitDataFromPath(path string) (*DotGitData, error) {
 	if !utils.DirExists(filepath.Join(path, dotGitFileName)) {
 		return nil, fmt.Errorf(
@@ -126,7 +127,7 @@ func (dg *DotGitData) checkModules(modules []*protoModule) error {
 			}
 		} else {
 			// Do the relative path and short name make sense?
-			if !strings.HasSuffix(pm.PathToGoMod(), string(shortName)) {
+			if !strings.HasPrefix(string(shortName), "plugin/") && !strings.HasSuffix(pm.PathToGoMod(), string(shortName)) {
 				return fmt.Errorf(
 					"in %q, the module name %q doesn't match the file's pathToGoMod %q",
 					file, shortName, pm.PathToGoMod())

plugin/builtin/iampolicygenerator/go.mod

@@ -1,4 +1,4 @@
-module sigs.k8s.io/kustomize/plugin/builtin/iampolicypgenerator
+module sigs.k8s.io/kustomize/plugin/builtin/iampolicygenerator
 
 go 1.19
 

plugin/builtin/patchjson6902transformer/go.sum

@@ -670,8 +670,8 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/kustomize/api v0.11.5 h1:vLDp++YAX7iy2y2CVPJNy9pk9CY8XaUKgHkjbVtnWag=
 sigs.k8s.io/kustomize/api v0.11.5/go.mod h1:2UDpxS6AonWXow2ZbySd4AjUxmdXLeTlvGBC46uSiq8=
 sigs.k8s.io/kustomize/kyaml v0.13.7/go.mod h1:6K+IUOuir3Y7nucPRAjw9yth04KSWBnP5pqUTGwj/qU=
-sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk=
-sigs.k8s.io/kustomize/kyaml v0.13.9/go.mod h1:QsRbD0/KcU+wdk0/L0fIp2KLnohkVzs6fQ85/nOXac4=
+sigs.k8s.io/kustomize/kyaml v0.14.0 h1:uzH0MzMtYypHW09LbMDk8k/lT/LSsUuCoZIuEGhIBNE=
+sigs.k8s.io/kustomize/kyaml v0.14.0/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=

plugin/builtin/patchtransformer/go.sum

@@ -670,8 +670,8 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/kustomize/api v0.11.5 h1:vLDp++YAX7iy2y2CVPJNy9pk9CY8XaUKgHkjbVtnWag=
 sigs.k8s.io/kustomize/api v0.11.5/go.mod h1:2UDpxS6AonWXow2ZbySd4AjUxmdXLeTlvGBC46uSiq8=
 sigs.k8s.io/kustomize/kyaml v0.13.7/go.mod h1:6K+IUOuir3Y7nucPRAjw9yth04KSWBnP5pqUTGwj/qU=
-sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk=
-sigs.k8s.io/kustomize/kyaml v0.13.9/go.mod h1:QsRbD0/KcU+wdk0/L0fIp2KLnohkVzs6fQ85/nOXac4=
+sigs.k8s.io/kustomize/kyaml v0.14.0 h1:uzH0MzMtYypHW09LbMDk8k/lT/LSsUuCoZIuEGhIBNE=
+sigs.k8s.io/kustomize/kyaml v0.14.0/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=

plugin/builtin/prefixtransformer/go.sum

@@ -670,8 +670,8 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/kustomize/api v0.11.5 h1:vLDp++YAX7iy2y2CVPJNy9pk9CY8XaUKgHkjbVtnWag=
 sigs.k8s.io/kustomize/api v0.11.5/go.mod h1:2UDpxS6AonWXow2ZbySd4AjUxmdXLeTlvGBC46uSiq8=
 sigs.k8s.io/kustomize/kyaml v0.13.7/go.mod h1:6K+IUOuir3Y7nucPRAjw9yth04KSWBnP5pqUTGwj/qU=
-sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk=
-sigs.k8s.io/kustomize/kyaml v0.13.9/go.mod h1:QsRbD0/KcU+wdk0/L0fIp2KLnohkVzs6fQ85/nOXac4=
+sigs.k8s.io/kustomize/kyaml v0.14.0 h1:uzH0MzMtYypHW09LbMDk8k/lT/LSsUuCoZIuEGhIBNE=
+sigs.k8s.io/kustomize/kyaml v0.14.0/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=

plugin/builtin/replicacounttransformer/go.sum

@@ -670,8 +670,8 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/kustomize/api v0.11.5 h1:vLDp++YAX7iy2y2CVPJNy9pk9CY8XaUKgHkjbVtnWag=
 sigs.k8s.io/kustomize/api v0.11.5/go.mod h1:2UDpxS6AonWXow2ZbySd4AjUxmdXLeTlvGBC46uSiq8=
 sigs.k8s.io/kustomize/kyaml v0.13.7/go.mod h1:6K+IUOuir3Y7nucPRAjw9yth04KSWBnP5pqUTGwj/qU=
-sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk=
-sigs.k8s.io/kustomize/kyaml v0.13.9/go.mod h1:QsRbD0/KcU+wdk0/L0fIp2KLnohkVzs6fQ85/nOXac4=
+sigs.k8s.io/kustomize/kyaml v0.14.0 h1:uzH0MzMtYypHW09LbMDk8k/lT/LSsUuCoZIuEGhIBNE=
+sigs.k8s.io/kustomize/kyaml v0.14.0/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=

plugin/builtin/suffixtransformer/go.sum

@@ -670,8 +670,8 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/kustomize/api v0.11.5 h1:vLDp++YAX7iy2y2CVPJNy9pk9CY8XaUKgHkjbVtnWag=
 sigs.k8s.io/kustomize/api v0.11.5/go.mod h1:2UDpxS6AonWXow2ZbySd4AjUxmdXLeTlvGBC46uSiq8=
 sigs.k8s.io/kustomize/kyaml v0.13.7/go.mod h1:6K+IUOuir3Y7nucPRAjw9yth04KSWBnP5pqUTGwj/qU=
-sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk=
-sigs.k8s.io/kustomize/kyaml v0.13.9/go.mod h1:QsRbD0/KcU+wdk0/L0fIp2KLnohkVzs6fQ85/nOXac4=
+sigs.k8s.io/kustomize/kyaml v0.14.0 h1:uzH0MzMtYypHW09LbMDk8k/lT/LSsUuCoZIuEGhIBNE=
+sigs.k8s.io/kustomize/kyaml v0.14.0/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=

releasing/README.md

@@ -73,6 +73,9 @@ We use the `release-blocker` tag to track issues that need to be solved before t
 It is also a good idea to scan any [untriaged issues](https://github.com/kubernetes-sigs/kustomize/issues?q=is%3Aissue+is%3Aopen+label%3Aneeds-triage) for potential blockers we haven't labelled yet before proceeding.
 
 ### Consider fetching new OpenAPI data
+
+Ideally, Kustomize's embedded openapi data would cover a wide range of Kubernetes releases. But today, we only embed a specific version. This means updating that version can be disruptive to people who still use older Kubernetes versions and depend on API versions that were removed in later releases. However, by remaining out of date, we will not support GVKs introduced in more recent releases. So far, we have leaned in favour of the older versions, because some removed GVs are for very popular APIs. This should be constantly reevaluated until a better solution is in place. See issue https://github.com/kubernetes-sigs/kustomize/issues/5016.
+
 The Kubernetes OpenAPI data changes no more frequently than once per quarter.
 You can check the current builtin versions that kustomize is using with the
 following command.
@@ -105,10 +108,7 @@ source releasing/helpers.sh
 #### Authenticate to github using [gh](https://github.com/cli/cli) (version [1.8.1](https://github.com/cli/cli/releases/tag/v1.8.1) or higher).
 
 ```
-# Use your own token
-GITHUB_TOKEN=deadbeefdeadbeef
-
-echo $GITHUB_TOKEN | gh auth login --scopes repo --with-token
+gh auth login
 ```
 
 ## Release `kyaml`
@@ -158,12 +158,7 @@ Undraft the release on the [kustomize repo release page]:
 #### Pin to the most recent kyaml
 
 ```
-gorepomod pin kyaml --doIt &&
-go mod edit -require=sigs.k8s.io/kustomize/kyaml@$versionKyaml plugin/builtin/prefixtransformer/go.mod &&
-go mod edit -require=sigs.k8s.io/kustomize/kyaml@$versionKyaml plugin/builtin/suffixtransformer/go.mod &&
-go mod edit -require=sigs.k8s.io/kustomize/kyaml@$versionKyaml plugin/builtin/replicacounttransformer/go.mod &&
-go mod edit -require=sigs.k8s.io/kustomize/kyaml@$versionKyaml plugin/builtin/patchtransformer/go.mod &&
-go mod edit -require=sigs.k8s.io/kustomize/kyaml@$versionKyaml plugin/builtin/patchjson6902transformer/go.mod
+gorepomod pin kyaml --doIt
 ```
 
 Create the PR:
@@ -174,20 +169,9 @@ createBranch pinToKyaml "Update kyaml to $versionKyaml"
 createPr
 ```
 
-Run local tests while GH runs tests in the cloud:
-```
-testKustomizeRepo
-```
-
-Wait for tests to pass, then merge the PR:
-```
-gh pr status
-```
-```
-gh pr merge -m
-```
+Review the resulting PR and get a collaborator to LGTM. Wait for CI to pass.
 
-Get back on master and do paranoia test:
+Once the PR merges, get back on master and do paranoia test:
 ```
 refreshMaster &&
 testKustomizeRepo
@@ -238,20 +222,9 @@ createBranch pinToCmdConfig "Update cmd/config to $versionCmdConfig" &&
 createPr
 ```
 
-Run local tests while GH runs tests in the cloud:
-```
-testKustomizeRepo
-```
+Review the resulting PR and get a collaborator to LGTM. Wait for CI to pass.
 
-Wait for tests to pass, then merge the PR:
-```
-gh pr status  # rinse, repeat
-```
-```
-gh pr merge -m
-```
-
-Get back on master and do paranoia test:
+Once the PR merges, get back on master and do paranoia test:
 ```
 refreshMaster &&
 testKustomizeRepo
@@ -287,6 +260,14 @@ Undraft the release on the [kustomize repo release page]:
 
 ## Release the kustomize CLI
 
+#### For major releases: increment the module version
+
+Update `module sigs.k8s.io/kustomize/kustomize/vX` in `kustomize/go.mod` to the version you're about to release, and then update all the `require` statements across the module to match.
+
+Search for uses of the version number across the codebase and update them as needed.
+
+Example: https://github.com/kubernetes-sigs/kustomize/pull/5021
+
 #### Pin to the new API
 
 ```
@@ -299,20 +280,9 @@ createBranch pinToApi "Update api to $versionApi" &&
 createPr
 ```
 
-Run local tests while GH runs tests in the cloud:
-```
-testKustomizeRepo
-```
+Review the resulting PR and get a collaborator to LGTM. Wait for CI to pass.
 
-Wait for tests to pass, then merge the PR:
-```
-gh pr status  # rinse, repeat
-```
-```
-gh pr merge -m
-```
-
-Get back on master and do paranoia test:
+Once the PR merges, get back on master and do paranoia test:
 ```
 refreshMaster &&
 testKustomizeRepo
@@ -351,30 +321,39 @@ Undraft the release on the [kustomize repo release page]:
 
 * Visit the [release page] and edit the release notes as desired.
 
-## Update example test target
+## Return the repo to development mode
+
+Go back into development mode, where all modules depend on in-repo code:
+
+```
+gorepomod unpin api         --doIt &&
+gorepomod unpin cmd/config  --doIt &&
+gorepomod unpin kyaml       --doIt
+```
 
 [Makefile]: https://github.com/kubernetes-sigs/kustomize/blob/master/Makefile
 
 Edit the `prow-presubmit-target` in the [Makefile]
-to test examples against your new release.
+to test examples against your new release. For example:
 
 ```
-sed -i "" "s/LATEST_V4_RELEASE=.*/LATEST_V4_RELEASE=v4.3.0/" Makefile
+sed -i "" "s/LATEST_V5_RELEASE=.*/LATEST_V5_RELEASE=v4.3.0/" Makefile
 ```
+
+Create the PR:
 ```
-createBranch updateProwExamplesTarget "Test examples against latest release" &&
+createBranch unpinEverything "Back to development mode; unpin the modules" &&
 createPr
 ```
 
-Wait for tests to pass, then merge the PR:
-```
-gh pr status  # rinse, repeat
-```
+Review the resulting PR and get a collaborator to LGTM. Wait for CI to pass.
+
+Once the PR merges, get back on master and do paranoia test:
 ```
-gh pr merge -m
+refreshMaster &&
+testKustomizeRepo
 ```
 
-
 ## Publish Official Docker Image
 
 [k8s.io]: https://github.com/kubernetes/k8s.io