Apache Beam Release Guide

Introduction

The Apache Beam project periodically declares and publishes releases. A release is one or more packages of the project artifact(s) that are approved for general public distribution and use. They may come with various degrees of caveat regarding their perceived quality and potential for change, such as “alpha”, “beta”, “incubating”, “stable”, etc.

The Beam community treats releases with great importance. They are a public face of the project and most users interact with the project only through the releases. Releases are signed off by the entire Beam community in a public vote.

Each release is executed by a Release Manager, who is selected among the Beam committers. This document describes the process that the Release Manager follows to perform a release. Any changes to this process should be discussed and adopted on the dev@ mailing list.

Please remember that publishing software has legal consequences. This guide complements the foundation-wide Product Release Policy and Release Distribution Policy.

Overview

Alt text

The release process consists of several steps:

  1. Decide to release
  2. Prepare for the release
  3. Investigate performance regressions
  4. Create a release branch
  5. Verify release branch
  6. Build a release candidate
  7. Vote on the release candidate
  8. During vote process, run validation tests
  9. If necessary, fix any issues and go back to step 3.
  10. Finalize the release
  11. Promote the release

1. Decide to release

Deciding to release and selecting a Release Manager is the first step of the release process. This is a consensus-based decision of the entire community.

Anybody can propose a release on the dev@ mailing list, giving a solid argument and nominating a committer as the Release Manager (including themselves). There’s no formal process, no vote requirements, and no timing requirements. Any objections should be resolved by consensus before starting the release.

In general, the community prefers to have a rotating set of 3-5 Release Managers. Keeping a small core set of managers allows enough people to build expertise in this area and improve processes over time, without Release Managers needing to re-learn the processes for each release. That said, if you are a committer interested in serving the community in this way, please reach out to the community on the dev@ mailing list.

Checklist to proceed to the next step

  1. Community agrees to release
  2. Community selects a Release Manager

2. Prepare for the release

Before your first release, you should perform one-time configuration steps. This will set up your security keys for signing the release and access to various release repositories.

To prepare for each release, you should audit the project status in the JIRA issue tracker, and do necessary bookkeeping. Finally, you should create a release branch from which individual release candidates will be built.

NOTE: If you are using GitHub two-factor authentication and haven’t configure HTTPS access, please follow the guide to configure command line access.

Accounts

Please have these credentials ready at hand, you will likely need to enter them multiple times:

One-time setup instructions

GPG Key

You need to have a GPG key to sign the release artifacts. Please be aware of the ASF-wide release signing guidelines. If you don’t have a GPG key associated with your Apache account, please create one according to the guidelines.

There are 2 ways to configure your GPG key for release, either using release automation script(which is recommended), or running all commands manually.

Use preparation_before_release.sh to setup GPG

NOTE: When generating the key, please make sure you choose the key type as RSA and RSA (default) and key size as 4096 bit.

Key ID

Access to Apache Nexus repository

Configure access to the Apache Nexus repository, which enables final deployment of releases to the Maven Central Repository.

  1. You log in with your Apache account.

  2. Confirm you have appropriate access by finding org.apache.beam under Staging Profiles.

  3. Navigate to your Profile (top right dropdown menu of the page).

  4. Choose User Token from the dropdown, then click Access User Token. Copy a snippet of the Maven XML configuration block.

  5. Insert this snippet twice into your global Maven settings.xml file, typically ${HOME}/.m2/settings.xml. The end result should look like this, where TOKEN_NAME and TOKEN_PASSWORD are your secret tokens:

     <!-- make sure you have the root `settings node: -->
 <settings>
   <servers>
     <server>
       <id>apache.releases.https</id>
       <username>TOKEN_NAME</username>
       <password>TOKEN_PASSWORD</password>
     </server>
     <server>
       <id>apache.snapshots.https</id>
       <username>TOKEN_NAME</username>
       <password>TOKEN_PASSWORD</password>
     </server>
   </servers>
 </settings>

Submit your GPG public key into MIT PGP Public Key Server

In order to make yourself have right permission to stage java artifacts in Apache Nexus staging repository, please submit your GPG public key into MIT PGP Public Key Server.

If MIT doesn’t work for you (it probably won’t, it’s slow, returns 502 a lot, Nexus might error out not being able to find the keys), use a keyserver at ubuntu.com instead: https://keyserver.ubuntu.com/.

Website development setup

Updating the Beam website requires submitting PRs to both the main apache/beam repo and the apache/beam-site repo. The first contains reference manuals generated from SDK code, while the second updates the current release version number.

You should already have setup a local clone of apache/beam. Setting up a clone of apache/beam-site is similar:

$ git clone -b release-docs https://github.com/apache/beam-site.git
$ cd beam-site
$ git remote add <GitHub_user> git@github.com:<GitHub_user>/beam-site.git
$ git fetch --all
$ git checkout -b <my-branch> origin/release-docs

Further instructions on website development on apache/beam is here. Background information about how the website is updated can be found in Beam-Site Automation Reliability.

Register to PyPI

Release manager needs to have an account with PyPI. If you need one, register at PyPI. You also need to be a maintainer (or an owner) of the apache-beam package in order to push a new release. Ask on the mailing list for assistance.

Login to DockerHub

Run following command manually. It will ask you to input your DockerHub ID and password if authorization info cannot be found from ~/.docker/config.json file.

docker login docker.io

After successful login, authorization info will be stored at ~/.docker/config.json file. For example,

"https://index.docker.io/v1/": {
   "auth": "xxxxxx"
}

Release managers should have push permission; request membership in the beammaintainers team by filing a JIRA with the Apache Infrastructure team, like INFRA-20900.

Create a new version in JIRA

When contributors resolve an issue in JIRA, they are tagging it with a release that will contain their changes. With the release currently underway, new issues should be resolved against a subsequent future release. Therefore, you should create a release item for this subsequent release, as follows:

Attention: Only PMC has permission to perform this. If you are not a PMC, please ask for help in dev@ mailing list.

  1. In JIRA, navigate to Beam > Administration > Versions.
  2. Add a new release. Choose the next minor version number after the version currently underway, select the release cut date (today’s date) as the Start Date, and choose Add.
  3. At the end of the release, go to the same page and mark the recently released version as released. Use the ... menu and choose Release.

3. Investigate performance regressions

Check the Beam load tests for possible performance regressions. Measurements are available on metrics.beam.apache.org.

All Runners which publish data should be checked for the following, in both batch and streaming mode:

If regressions are found, the release branch can still be created, but the regressions should be investigated and fixed as part of the release process. The role of the release manager is to file JIRA issues for each regression with the ‘Fix Version’ set to the to-be-released version. The release manager oversees these just like any other JIRA issue marked with the ‘Fix Version’ of the release.

The mailing list should be informed to allow fixing the regressions in the course of the release.

4. Create a release branch in apache/beam repository

Attention: Only committer has permission to create release branch in apache/beam.

Release candidates are built from a release branch. As a final step in preparation for the release, you should create the release branch, push it to the Apache code repository, and update version information on the original branch.

There are 2 ways to cut a release branch: either running automation script(recommended), or running all commands manually.

After following one of these processes you should manually update CHANGES.md on master by adding a new section for the next release.

Use cut_release_branch.sh to cut a release branch

(Alternative) Run all steps manually

Start a snapshot build

Start a build of the nightly snapshot against master branch. Some processes, including our archetype tests, rely on having a live SNAPSHOT of the current version from the master branch. Once the release branch is cut, these SNAPSHOT versions are no longer found, so builds will be broken until a new snapshot is available.

There are 2 ways to trigger a nightly build, either using automation script(recommended), or perform all operations manually.

Run start_snapshot_build.sh to trigger build

(Alternative) Do all operations manually

5. Verify release branch

After the release branch is cut you need to make sure it builds and has no significant issues that would block the creation of the release candidate. There are 2 ways to perform this verification, either running automation script(recommended), or running all commands manually.

! Dataflow tests will fail if Dataflow worker container is not created and published by this time. (Should be done by Google)

Run automation script (verify_release_build.sh)

Jenkins job beam_Release_Gradle_Build basically run ./gradlew build -PisRelease. This only verifies that everything builds with unit tests passing.

Verify the build succeeds

There are some projects that don’t produce the artifacts, e.g. beam-test-tools, you may be able to ignore failures there.

To triage the failures and narrow things down you may want to look at settings.gradle and run the build only for the projects you’re interested at the moment, e.g. ./gradlew :runners:java-fn-execution.

(Alternative) Run release build manually (locally)

Create release-blocking issues in JIRA

The verify_release_build.sh script may include failing or flaky tests. For each of the failing tests create a JIRA with the following properties:

Inform the mailing list

The dev@beam.apache.org mailing list should be informed about the release branch being cut. Alongside with this note, a list of pending issues and to-be-trigated issues should be included. Afterwards, this list can be refined and updated by the release manager and the Beam community.

6. Triage release-blocking issues in JIRA

There could be outstanding release-blocking issues, which should be triaged before proceeding to build a release candidate. We track them by assigning a specific Fix version field even before the issue resolved.

The list of release-blocking issues is available at the version status page. Triage each unresolved issue with one of the following resolutions:

The release manager should triage what does and does not block a release. An issue should not block the release if the problem exists in the current released version or is a bug in new functionality that does not exist in the current released version. It should be a blocker if the bug is a regression between the currently released version and the release in progress and has no easy workaround.

For all JIRA issues:

For JIRA issues with type “Bug” or labeled “flaky”:

For all other JIRA issues:

If there is a bug found in the RC creation process/tools, those issues should be considered high priority and fixed in 7 days.

Review cherry-picks

Check if there are outstanding cherry-picks into the release branch, e.g. for 2.14.0. Make sure they have blocker JIRAs attached and are OK to get into the release by checking with community if needed.

As the Release Manager you are empowered to accept or reject cherry-picks to the release branch. You are encouraged to ask the following questions to be answered on each cherry-pick PR and you can choose to reject cherry-pick requests if these questions are not satisfactorily answered:

It is important to accept major/blocking fixes to isolated issues to make a higher quality release. However, beyond that each cherry pick will increase the time required for the release and add more last minute code to the release branch. Neither late releases nor not fully tested code will provide positive user value.

Tip: Another tool in your toolbox is the known issues section of the release blog. Consider adding known issues there for minor issues instead of accepting cherry picks to the release branch.

7. Build a release candidate

Checklist before proceeding

The core of the release process is the build-vote-fix cycle. Each cycle produces one release candidate. The Release Manager repeats this cycle until the community approves one release candidate, which is then finalized.

For this step, we recommend you using automation script to create a RC, but you still can perform all steps manually if you want.

Run build_release_candidate.sh to create a release candidate

Tasks you need to do manually

  1. Verify the script worked.
    1. Verify that the source and Python binaries are present in dist.apache.org.
    2. Verify Docker images are published. How to find images:
      1. Visit https://hub.docker.com/u/apache
      2. Visit each repository and navigate to tags tab.
      3. Verify images are pushed with tags: ${RELEASE}_rc{RC_NUM}
    3. Verify that third party licenses are included in Docker containers by logging in to the images.
      • For Python SDK images, there should be around 80 ~ 100 dependencies. Please note that dependencies for the SDKs with different Python versions vary. Need to verify all Python images by replacing ${ver} with each supported Python version X.Y.
      docker run -it --entrypoint=/bin/bash apache/beam_python${ver}_sdk:${RELEASE}_rc{RC_NUM}
ls -al /opt/apache/beam/third_party_licenses/ | wc -l
      • For Java SDK images, there should be around 200 dependencies.
      docker run -it --entrypoint=/bin/bash apache/beam_java${ver}_sdk:${RELEASE}_rc{RC_NUM}
ls -al /opt/apache/beam/third_party_licenses/ | wc -l
  2. Publish staging artifacts
    1. Log in to the Apache Nexus website.
    2. Navigate to Build Promotion -> Staging Repositories (in the left sidebar).
    3. Select repository orgapachebeam-NNNN.
    4. Click the Close button.
    5. When prompted for a description, enter “Apache Beam, version X, release candidate Y”.
    6. Review all staged artifacts on https://repository.apache.org/content/repositories/orgapachebeam-NNNN/. They should contain all relevant parts for each module, including pom.xml, jar, test jar, javadoc, etc. Artifact names should follow the existing format in which artifact name mirrors directory structure, e.g., beam-sdks-java-io-kafka. Carefully review any new artifacts.

8. Prepare documents

Update and Verify Javadoc

The build with -PisRelease creates the combined Javadoc for the release in sdks/java/javadoc.

The file sdks/java/javadoc/build.gradle contains a list of modules to include in and exclude, plus a list of offline URLs that populate links from Beam’s Javadoc to the Javadoc for other modules that Beam depends on.

Build the Pydoc API reference

Make sure you have tox installed:

pip install tox

Create the Python SDK documentation using sphinx by running a helper script.

cd sdks/python && pip install -r build-requirements.txt && tox -e py37-docs

By default the Pydoc is generated in sdks/python/target/docs/_build. Let ${PYDOC_ROOT} be the absolute path to _build.

Propose pull requests for website updates

Beam publishes API reference manuals for each release on the website. For Java and Python SDKs, that’s Javadoc and PyDoc, respectively. The final step of building the candidate is to propose website pull requests that update these manuals.

Merge the pull requests only after finalizing the release. To avoid invalid redirects for the ‘current’ version, merge these PRs in the order listed. Once the PR is merged, the new contents will get picked up automatically and served to the Beam website, usually within an hour.

PR 1: apache/beam-site

This pull request is against the apache/beam-site repo, on the release-docs branch (example). It is created by build_release_candidate.sh (see above).

PR 2: apache/beam

This pull request is against the apache/beam repo, on the master branch (example).

Blog post

Write a blog post similar to beam-2.23.0.md.

Tip: Use git log to find contributors to the releases. (e.g: git log --pretty='%aN' ^v2.10.0 v2.11.0 | sort | uniq). Make sure to clean it up, as there may be duplicate or incorrect user names.

NOTE: Make sure to include any breaking changes, even to @Experimental features, all major features and bug fixes, and all known issues.

Template:

e>

Checklist to proceed to the next step

  1. Maven artifacts deployed to the staging repository of repository.apache.org
  2. Source distribution deployed to the dev repository of dist.apache.org
  3. Website pull request proposed to list the release, publish the Java API reference manual, and publish the Python API reference manual.
  4. Docker images are published to DockerHub with tags: {RELEASE}_rc{RC_NUM}.

You can (optionally) also do additional verification by:

  1. Check that Python zip file contains the README.md, NOTICE, and LICENSE files.
  2. Check hashes (e.g. md5sum -c *.md5 and sha1sum -c *.sha1)
  3. Check signatures (e.g. gpg --verify apache-beam-1.2.3-python.zip.asc apache-beam-1.2.3-python.zip)
  4. grep for legal headers in each file.
  5. Run all jenkins suites and include links to passing tests in the voting email.
  6. Pull docker images to make sure they are pullable.
docker pull {image_name}
docker pull apache/beam_python3.5_sdk:2.16.0_rc1

9. Vote and validate release candidate

Once you have built and individually reviewed the release candidate, please share it for the community-wide review. Please review foundation-wide voting guidelines for more information.

Start the review-and-vote thread on the dev@ mailing list. Here’s an email template; please adjust as you see fit.

From: Release Manager
To: dev@beam.apache.org
Subject: [VOTE] Release 1.2.3, release candidate #3

Hi everyone,
Please review and vote on the release candidate #3 for the version 1.2.3, as follows:
[ ] +1, Approve the release
[ ] -1, Do not approve the release (please provide specific comments)


Reviewers are encouraged to test their own use cases with the release candidate, and vote +1 if
no issues are found.

The complete staging area is available for your review, which includes:
* JIRA release notes [1],
* the official Apache source release to be deployed to dist.apache.org [2], which is signed with the key with fingerprint FFFFFFFF [3],
* all artifacts to be deployed to the Maven Central Repository [4],
* source code tag "v1.2.3-RC3" [5],
* website pull request listing the release [6], publishing the API reference manual [7], and the blog post [8].
* Java artifacts were built with Maven MAVEN_VERSION and OpenJDK/Oracle JDK JDK_VERSION.
* Python artifacts are deployed along with the source release to the dist.apache.org [2].
* Validation sheet with a tab for 1.2.3 release to help with validation [9].
* Docker images published to Docker Hub [10].

The vote will be open for at least 72 hours. It is adopted by majority approval, with at least 3 PMC affirmative votes.

Thanks,
Release Manager

[1] https://jira.apache.org/jira/secure/ReleaseNote.jspa?projectId=...
[2] https://dist.apache.org/repos/dist/dev/beam/1.2.3/
[3] https://dist.apache.org/repos/dist/release/beam/KEYS
[4] https://repository.apache.org/content/repositories/orgapachebeam-NNNN/
[5] https://github.com/apache/beam/tree/v1.2.3-RC3
[6] https://github.com/apache/beam/pull/...
[7] https://github.com/apache/beam-site/pull/...
[8] https://github.com/apache/beam/pull/...
[9] https://docs.google.com/spreadsheets/d/1qk-N5vjXvbcEk68GjbkSZTR8AGqyNUM-oLFo_ZXBpJw/edit#gid=...
[10] https://hub.docker.com/search?q=apache%2Fbeam&type=image

If there are any issues found in the release candidate, reply on the vote thread to cancel the vote. There’s no need to wait 72 hours. Proceed to the Fix Issues step below and address the problem. However, some issues don’t require cancellation. For example, if an issue is found in the website pull request, just correct it on the spot and the vote can continue as-is.

If there are no issues, reply on the vote thread to close the voting. Then, tally the votes in a separate email thread. Here’s an email template; please adjust as you see fit.

From: Release Manager
To: dev@beam.apache.org
Subject: [RESULT] [VOTE] Release 1.2.3, release candidate #3

I'm happy to announce that we have unanimously approved this release.

There are XXX approving votes, XXX of which are binding:
* approver 1
* approver 2
* approver 3
* approver 4

There are no disapproving votes.

Thanks everyone!

Run validation tests

All tests listed in this spreadsheet

Since there are a bunch of tests, we recommend you running validations using automation script. In case of script failure, you can still run all of them manually.

Run validations using run_rc_validation.sh

Run validations manually

Note: -Prepourl and -Pver can be found in the RC vote email sent by Release Manager.

Fix any issues

Any issues identified during the community review and vote should be fixed in this step. Additionally, any JIRA issues created from the initial branch verification should be fixed.

Code changes should be proposed as standard pull requests to the master branch and reviewed using the normal contributing process. Then, relevant changes should be cherry-picked into the release branch. The cherry-pick commits should then be proposed as the pull requests against the release branch, again reviewed and merged using the normal contributing process.

Once all issues have been resolved, you should go back and build a new release candidate with these changes.

Checklist to proceed to the next step

  1. Issues identified during vote have been resolved, with fixes committed to the release branch.
  2. All issues tagged with Fix-Version for the current release should be closed.
  3. Community votes to release the proposed candidate, with at least three approving PMC votes

10. Finalize the release

Once the release candidate has been reviewed and approved by the community, the release should be finalized. This involves the final deployment of the release candidate to the release repositories, merging of the website changes, etc.

Deploy artifacts to Maven Central Repository

Use the Apache Nexus repository manager to release the staged binary artifacts to the Maven Central repository. In the Staging Repositories section, find the relevant release candidate orgapachebeam-XXX entry and click Release. Drop all other release candidates that are not being released. NOTE: If you are using GitHub two-factor authentication and haven’t configure HTTPS access, please follow the guide to configure command line access.

Deploy Python artifacts to PyPI

./beam/release/src/main/scripts/deploy_pypi.sh

Deploy SDK docker images to DockerHub

./beam/release/src/main/scripts/publish_docker_images.sh

Verify that:

Merge Website pull requests

Merge all of the website pull requests

Git tag

Create and push a new signed tag for the released version by copying the tag for the final release candidate, as follows:

VERSION_TAG="v${RELEASE}"
git tag -s "$VERSION_TAG" "$RC_TAG"
git push https://github.com/apache/beam "$VERSION_TAG"

After pushing the tag, the tag should be visible on Github’s Tags page.

Publish release to Github

Once the tag is uploaded, publish the release notes to Github, as follows:

cd beam/release/src/main/scripts && ./publish_github_release_notes.sh

Note this script reads the release notes from the blog post, so you should make sure to run this from master after merging the blog post PR.

After running the script, the release notes should be visible on Github’s Releases page.

PMC-Only Finalization

There are a few release finalization tasks that only PMC members have permissions to do. Ping dev@ for assistance if you need it.

Deploy source release to dist.apache.org

Copy the source release from the dev repository to the release repository at dist.apache.org using Subversion.

Make sure the last release’s artifacts have been copied from dist.apache.org to archive.apache.org. This should happen automatically: dev@ thread with context. The release manager should also make sure to change these links on the website (example).

Mark the version as released in JIRA

In JIRA, inside version management, hover over the current release and a settings menu will appear. Click Release, and select today’s date.

Recordkeeping with ASF

Use reporter.apache.org to seed the information about the release into future project reports.

Checklist to proceed to the next step

11. Promote the release

Once the release has been finalized, the last step of the process is to promote the release within the project and beyond.

Apache mailing lists

Announce on the dev@ mailing list that the release has been finished.

Announce on the release on the user@ mailing list, listing major improvements and contributions.

Announce the release on the announce@apache.org mailing list. NOTE: This can only be done from @apache.org email address.

Social media

Tweet, post on Facebook, LinkedIn, and other platforms. Ask other contributors to do the same.

Also, update the Wikipedia article on Apache Beam.

Checklist to declare the process completed

  1. Release announced on the user@ mailing list.
  2. Blog post published, if applicable.
  3. Release recorded in reporter.apache.org.
  4. Release announced on social media.
  5. Completion declared on the dev@ mailing list.
  6. Update Wikipedia Apache Beam article.

Improve the process

It is important that we improve the release processes over time. Once you’ve finished the release, please take a step back and look what areas of this process and be improved. Perhaps some part of the process can be simplified. Perhaps parts of this guide can be clarified.

If we have specific ideas, please start a discussion on the dev@ mailing list and/or propose a pull request to update this guide. Thanks!