From 2bef583f26bc1ed9b46165db24b0d8c088880d89 Mon Sep 17 00:00:00 2001
From: Warren Gifford <warrenbruceg@gmail.com>
Date: Wed, 21 Oct 2026 10:29:55 -0700
Subject: [PATCH] release: Hand "Update main" PRs over to the releaseworker
 (#1443)

Promote finalize opens a draft "Update main: build vX" PR after every
release, but none has ever been merged, so `main` here lags many
releases behind. Its Buildkite build also always fails:
`promote/release-vX-update-main` matches the `^promote\/release-.*`
release steps, and `(promote) Release: test` stops with "did not find
serialized config" (for example, [deploy-sourcegraph-k8s build
1187](https://buildkite.com/sourcegraph/deploy-sourcegraph-k8s/builds/1187)).

The releaseworker now opens the "Update main" PR itself after the
promote build passes, with squash auto-merge enabled and the Platform
team requested as reviewers
([sourcegraph/sourcegraph#17347](https://github.com/sourcegraph/sourcegraph/pull/17347)).
This PR:

- removes the "Update main" steps from `promoteToPublic.finalize` in
`release.yaml`, so the releaseworker and Buildkite don't both create it;
- skips the `(promote) Release: test` and `(promote) Release: finalize`
steps on `*-update-main` branches in `.buildkite/pipeline.yaml`.

Ship this together with sourcegraph/sourcegraph#17347. Until both are
live, a release either gets no "Update main" PR or a duplicate attempt
that the releaseworker logs and skips.

Part of
[PLAT-881](https://linear.app/sourcegraph/issue/PLAT-881/close-release-generated-prs-when-release-is-complete).
Matching changes:
[k8s#492](https://github.com/sourcegraph/deploy-sourcegraph-k8s/pull/492),
[helm#972](https://github.com/sourcegraph/deploy-sourcegraph-helm/pull/972).

### Checklist

* [x] All images have a valid tag and SHA256 sum (no image changes)

### Test plan

Both YAML files parse, and `promoteToPublic.finalize` now contains only
the tag and release registry steps. The pipeline conditions still match
`promote/release-v8.1.0` and no longer match
`promote/release-v8.1.0-update-main`. The next release's promote build
and "Update main" PR will exercise this end to end.

(cherry picked from commit 4233a3e85509fc582d5513071aa815d87724a588)
---
 .buildkite/pipeline.yaml |  4 ++--
 release.yaml             | 36 ------------------------------------
 2 files changed, 2 insertions(+), 38 deletions(-)

diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml
index 852b496b9..2dbb8cc15 100644
--- a/.buildkite/pipeline.yaml
+++ b/.buildkite/pipeline.yaml
@@ -41,7 +41,7 @@ steps:
       sg release run test --workdir=. --config-from-commit
 
   - label: "(promote) Release: test"
-    if: build.branch =~ /^promote\/release-.*/
+    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/
     plugins:
       - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~
     command: |
@@ -58,7 +58,7 @@ steps:
 
 
   - label: "(promote) Release: finalize"
-    if: build.branch =~ /^promote\/release-.*/
+    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/
     plugins:
       - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~
     command: |
diff --git a/release.yaml b/release.yaml
index b043fe076..544879460 100644
--- a/release.yaml
+++ b/release.yaml
@@ -224,39 +224,3 @@ promoteToPublic:
           cat << EOF | buildkite-agent annotate --style info
           Promoted release is **publicly available** through a git tag at [\`{{version}}\`](https://github.com/sourcegraph/deploy-sourcegraph-docker/tree/{{version}}).
           EOF
-
-      - name: "update main with latest version"
-      - name: "git"
-        cmd: |
-          set -eu
-          branch="promote/release-{{version}}-update-main"
-          echo "Checking out origin/main"
-          git fetch origin main
-          git switch main
-          echo "Creating branch origin/${branch}"
-          git switch -c "${branch}"
-
-      - name: docker(compose):tags
-        cmd: |
-          set -eu
-          registry=index.docker.io/sourcegraph
-          sg ops update-images --registry ${registry} --kind compose --pin-tag {{inputs.server.tag}} --docker-username $DOCKER_USERNAME --docker-password $DOCKER_PASSWORD docker-compose/
-
-      - name: "git:branch"
-        cmd: |
-          set -eu
-          branch="promote/release-{{version}}-update-main"
-          git commit -am 'prep update main: {{version}}' -m 'update main with latest release'
-          git push origin "${branch}"
-
-      - name: "github:pr"
-        cmd: |
-          set -eu
-          # Create PR to merge release updates into main branch
-          gh pr create \
-            --fill \
-            --draft \
-            --base main \
-            --title "Update main: build {{version}}" \
-            --body "Test plan: automated release PR, CI will perform additional checks"
-          echo "🚢 Please check the associated CI build to ensure the process completed".