Update stable branching instructions for v1.20

.github/templates/release_template_rc_branch.md

@@ -67,7 +67,6 @@ assignees: ''
 
       General exemptions to feature freeze:
       - Bug fixes
-      - Testing enhancements
       - Documentation enhancements
 
 - [ ] Mark all PRs that are not granted an exception with the GitHub label
@@ -97,17 +96,25 @@ assignees: ''
           skopeo copy -a docker://quay.io/cilium/$repo-ci:$COMMIT docker://quay.io/cilium/$repo-ci:vX.Y;
       done
 
-      skopeo logout
+      skopeo logout quay.io
       ```
-  - [ ] On the main branch, create a PR with a change in the `VERSION` file to
-        start the next development cycle as well as creating the necessary GH
-        workflows (renovate configuration, etc.
+  - [ ] From this new branch, create a new branch which will be submitted into
+        `main` in order to begin the development cycle for the next release.
+    - `git checkout -b pr/vX.Y+1-dev`
+  - [ ] Create a commit to update the release notes in preparation for the
+        upcoming stable and main branch development.
+    - `git mv Documentation/operations/upgrade-{next,current}.rst`
+    - `git cp Documentation/operations/upgrade-{template.rst.tmpl,next.inc}`
+    - `git commit -sam "Prepare for vX.Y branch"`
+  - [ ] Create commits that update the `VERSION` and other necessary GitHub
+        workflows changes for the new stable branch (renovate configuration, etc.
         see [24143732b616](https://github.com/cilium/cilium/commit/24143732b616bb6cd308564b0be33f13fc5613e6)
         for reference):
     - [ ] Check for any other .github workflow references to the current stable
           branch `X.Y-1`, and update those to include the new stable `X.Y`
           version as well.
       - `git grep "X.Y-1" .github/`
+      - `$EDITOR $(git grep -l "X.Y-1" .github/)`
     - [ ] Ensure that the `CustomResourceDefinitionSchemaVersion` uses a new minor schema version compared to the new `X.Y` release.
       - `git grep 'CustomResourceDefinitionSchemaVersion =' -- pkg/`
     - `echo "X.Y+1.0-dev" > VERSION`
@@ -119,14 +126,24 @@ assignees: ''
   - [ ] Sync the `vX.Y` branch up to the commit before preparing for the `X.Y+1` development cycle.
     - `git fetch upstream && git checkout vX.Y && git merge --ff-only upstream/main~1 && git log -5`
     - `git push upstream vX.Y`
+  - [ ] Check for any merged PRs with `needs-backport/X.Y` label set, and
+        remove the label. Sometimes contributors get confused around this time
+        whether a PR needs backporting or not, and they may prematurely set the
+        label.
+  - [ ] Check PRs with `release-note/bug` and `needs-backport/X.Y-1` label and
+        add the `needs-backport/X.Y` label to them.
+  - [ ] Check any open PRs with `release-blocker/X.Y` label and add the
+        `needs-backport/X.Y` label to them.
   - [ ] Protect the new stable branch with GitHub Settings [here](https://github.com/cilium/cilium/settings/branches)
     - Use the settings of the previous stable branch and main as sane defaults
   - [ ] On the `vX.Y` branch, prepare for stable release development:
+    - `git checkout -b pr/prep-vX.Y upstream/vX.Y
     - [ ] Update GitHub workflows for stable branch triggers:
       - Replace references to `main` branch with `X.Y` in the workflows.
         - `sed -i 's/- \(ft\/\)\?main/- \1vX.Y/g' .github/workflows/*`
         - `sed -i 's/\(renovate\/\)main/\1vX.Y/g' .github/workflows/*`
         - `sed -i 's/- v\[0-9\]+\.\[0-9\]+/- vX.Y/g' .github/workflows/build-images-releases.yaml`
+        - `sed -i 's/\(build-images-ci\)/\1-vX.Y/g' $(git grep -l build-images-ci .github/ariane-config.yaml)`
       - Double-check if there are any other new references to `main` in the
         workflows, and update them as needed.
         - `git grep 'main' .github/workflows/`
@@ -144,6 +161,9 @@ assignees: ''
         - `vim $(git grep -l CustomResourceDefinitionSchemaVersion)`
       - Remove `stable.txt` file
         - `git rm stable.txt`
+      - Remove upgrade notes for the next release
+        - `git rm Documentation/operations/upgrade-next.inc`
+        - `sed -i '/upgrade-next/d' Documentation/operations/upgrade-notes.inc`
       - Adjust `./.github/maintainers-little-helper.yaml` to set labels based
         on the new stable branch version. See [5b4934284d](https://github.com/cilium/cilium/commit/5b4934284dd525399aacec17c137811df9cf0f8b)
         for reference.
@@ -157,13 +177,18 @@ assignees: ''
         - `sed -i '/^\//,$d' CODEOWNERS`
         - `grep -v '#' ../cilium-X.Y-1/CODEOWNERS >> CODEOWNERS`
         - `make -C Documentation update-codeowners`
-      - Delete unnecessary GitHub configurations from the stable branch
       - Replace references to `bpf-next-*` lvh images in workflows with the
         newest LTS kernel from [quay.io](https://quay.io/repository/lvh-images/kind?tab=tags&tag=latest).
         If there is no newer LTS, delete the corresponding matrix entries.
         - `grep -R bpf-next- .github/workflows/`
+      - Move the image build workflow to a path based on the current branch.
+        Update the triggers for image builds to remove the `pull_request_target` trigger.
+        - `git mv .github/workflows/build-images-ci{,-vX.Y}.yaml`
+        - `sed -i '/pull_request_target:$/,/push:$/{ /push/!d }' .github/workflows/build-images-ci-vX.Y.yaml`
+        - `sed -i '/pull_request_target:$/,/workflow_.*$/{ /workflow_/!d }'  .github/workflows/build-images-base.yaml`
       - Commit the state up until now before the next step, so that it's easier
         to compare the diff vs. the previous stable release.
+        - `git commit -sam 'Prepare vX.Y stable branch'`
       - Copy-paste the `.github` directory from the previous stable branch and
         manually check the diff between the files from the current stable branch
         and modify the workflows to match the target stable branch. See
@@ -173,7 +198,7 @@ assignees: ''
         - `git diff --stat`
         - Ignore all stable branch changes under the `.github/actions` directory.
           `git checkout .github/actions`
-        - `git diff`
+        - `git diff --ignore-matching-lines '(X.Y-1|X.Y)'`
         - Yes this step is horribly painful. It's unrealistic for us to make
           reasonable decisions here when scanning thousands of lines of random
           CI changes for the past six months. Suggestions welcome: please
@@ -182,6 +207,11 @@ assignees: ''
           for the previous stable branch.
       - Update the preparation commit as needed.
       - `git reset --hard`
+    - [ ] Push a PR with those changes:
+      - `gh pr create -B vX.Y`
+    - [ ] Create a new PR for preparing file deletions. This PR is separate
+          from the one above to simplify review.
+      - `git checkout -b pr/prep-vX.Y-cleanup`
     - [ ] Remove any GitHub configuration from the stable branch that is only
           relevant for the main branch (Read the following before running
           this step).
@@ -190,9 +220,11 @@ assignees: ''
       - `git rm .github/workflows/lint-codeowners.yaml`
       - `git rm .github/workflows/release.yaml`
       - `git rm .github/workflows/renovate*`
+      - `git rm .github/workflows/*perf*`
+      - `git rm .github/workflows/*scale*`
     - [ ] Remove workflows that are exclusively triggered by `schedule`,
-      `issue_comment` or `pull_request_target` triggers, as they do not run
-      on stable branches.
+          `issue_comment` or `pull_request_target` triggers, as they do not run
+          on stable branches.
 
           ```
           for f in .github/workflows/*yaml; do
@@ -201,10 +233,6 @@ assignees: ''
               fi;
           done
           ```
-          - Remove scale and perf tests, as these are not maintained on stable
-            branches:
-            - `git rm .github/workflows/*perf*`
-            - `git rm .github/workflows/*scale*`
     - [ ] Commit the workflow changes
       - `git commit -sam ".github: Simplify configuration for stable branch"`
     - [ ] Remove the cilium-cli changes from the stable branch. This may take
@@ -218,9 +246,16 @@ assignees: ''
       - `make -C Documentation update-cmdref`
       - `go mod vendor && go mod tidy`
       - `git commit -sam "Remove cilium-cli in preparation for stable maintenance"`
-    - [ ] Push a PR with those changes:
-      - `gh pr create -B vX.Y`
-    - [ ] Merge the stable branch PR
+    - [ ] Push a PR with those changes, against the PR prepared earlier:
+      - `gh pr create -B pr/prep-vX.Y`
+    - [ ] Get each PR reviewed.
+    - [ ] Merge the CLI PR into the branch prep branch.
+    - [ ] Merge the branch prep branch PR into the vX.Y branch.
+    - [ ] Submit a PR to https://github.com/isovalent/corgi to start scraping
+          test results into the CI dashboard for the new branch.
+      - `git clone https://github.com/isovalent/corgi`
+      - `git grep vX.Y-1`
+      - Manually edit the files with matches.
 - [ ] Remove the `dont-merge/wait-until-release` label from [Blocked PRs].
 - [ ] Announce on Slack #development channel that the stable branch is
       created and developers must use `release-note/X.Y` labels in order to
@@ -307,9 +342,6 @@ assignees: ''
 - [ ] Announce the release in #general on Slack (do not use [@]channel).
       See below for templates.
 - [ ] Prepare post-release changes to main branch using `../release/internal/bump-readme.sh`.
-- [ ] Update the upgrade guide and [roadmap](https://github.com/cilium/cilium/blob/main/Documentation/community/roadmap.rst)
-      for any features that changed status. Usually do it after the RC1, once the
-      stability of features is known.
 
 ---
 Text template for the first RC:
@@ -343,7 +375,7 @@ Thank you for the testing and contributing to the previous pre-releases. There a
 [active versions]: https://readthedocs.org/projects/cilium/versions/?version_filter=vX.Y.Z-rc.W
 [Charts Workflow]: https://github.com/cilium/charts/actions/workflows/validate-cilium-chart.yaml
 [Cilium charts]: https://github.com/cilium/charts
-[Review feature PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+base%3Amain+is%3Apr+-label%3Arelease-note%2Fbug+-label%3Arelease-note%2Fci+-author%3Aapp%2Fcilium-renovate+-label%3Adont-merge%2Fwait-until-release+-label%3Adont-merge%2Fpreview-only+-label%3Aarea%2Fdocumentation+-label%3Acilium-cli-exclusive+-label%3Arelease-blocker%2FX.Y
+[Review feature PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+base%3Amain+is%3Apr+-label%3Arelease-note%2Fbug+-author%3Aapp%2Fcilium-renovate+-label%3Adont-merge%2Fwait-until-release+-label%3Adont-merge%2Fpreview-only+-label%3Aarea%2Fdocumentation+-label%3Acilium-cli-exclusive+-label%3Arelease-blocker%2FX.Y
 [Renovate PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+is%3Apr+author%3Aapp%2Fcilium-renovate+base%3Amain
 [Blocked PRs]: https://github.com/cilium/cilium/pulls?q=is%3Aopen+is%3Apr+label%3Adont-merge%2Fwait-until-release+base%3Amain
 [dependency dashboard]: https://github.com/cilium/cilium/issues/33550