Hi Beam Dev List! This is to report on an issue that occurred with the v2.48.0 Go SDK release and it's resolution. While generally poor form, Ritesh, Jack, and I independently resolved the issue instead of first mailing the dev list about it first. We decided that fixing the error for the Go SDK was better for the community than delaying such a fix through a discussion and vote. We do believe the issue is resolved, and there are now sufficient guard rails against a recurrence.
However, it's still critical we email the community about it, so here it is. tl;dr; Due to an error in tagging, the v2.48.0 release was trying to use the wrong SDK container, and it was still trying to use the ".dev" version. We had to add a new Go SDK specific tag of `sdks/v2.48.2` to resolve the issue and ensure that tag was on the right RC commit. This was tracked in https://github.com/apache/beam/issues/27064, The longer story: This morning a user filed an issue [0]. Due to Go's unique package release strategy, it's not possible to simply "move the tag to a new commit", since the module proxy and similar would already have distributed the previous versions of the source. This property enables robust "supply chain" security, and avoids mismatches or maliciousness. The only resolution to a bad is to release a patch version, which for Go, is as simple as adding an appropriate tag. The Go SDK has its own "tag series" prefixed with "sdks/" since that folder is where the SDK's go.mod file lives. We judged that the cost of the Go SDK version being slightly out of sync with the main line version to be acceptable, given that Beam doesn't presently do Patch releases. No other changes were done to avoid a full container build. Adding a tag version of v2.48.0 to a working commit would unbreak the Go SDK release. The error occurred because with 2.48.0, the release manager was using the new Github Action to get the RC tags instead of the manual script. The action worked fine however and did that job correctly. Since the RC_TAG variable in the release guide [1] is unspecified in the guide, the Release Manager ended up running `git tag -s "sdks/v2.48.0"` which adds the tag to the HEAD commit of the current branch, instead of to the commit associated with the RC tag. So, the Release Manager ended up running the command again, leading to the same result. A bit of investigation showed that it was possible for Tags to get out of sync in the local branch, vs what the Github action did. However this burned the sdks/v2.48.1 tag. The sync issue was resolved by a ` git fetch --all --tags` and the RC tag commit confirmed `git rev-list ${RC_TAG} -n 1`, leading to the 2nd fix attempt with v2.48.2, which has resolved the Go SDK issue. The Release Guide has been updated [2] to make checking this explicit, though hopefully, this step will be obsolete when it's moved to github actions. But until then, we may as well avoid the error. The 2.48.0 release blog and notes have been updated to note the discrepancy as well. Thank you for your understanding and time, Robert Burke Beam Go Busybody [0] https://github.com/apache/beam/issues/27064 [1] https://beam.apache.org/contribute/release-guide/#git-tag [2] https://github.com/apache/beam/pull/27070