chore(release): Add prepare release script

[mtodor]

Description

Adds a scripts/prepare-release.sh script that automates patch release preparation for existing Y-stream release branches. The script discovers the next Z version from git tags (e.g., if 0.2.1 exists, next is 0.2.2; if no tags exist, starts at X.Y.0), creates a release-X-Y-Z-prepare branch, bumps version and appVersion in charts/stackrox-mcp/Chart.yaml, and generates Konflux Release resource YAMLs for both stage and production environments.

Release resource files are generated from a single template (scripts/templates/release-resource.yaml) using yq path-targeted sub() substitutions with X.Y / X-Y / X.Y.Z / X-Y-Z placeholders. Output files are placed in releases/X.Y.Z/ at the repo root. The script does not commit or push — it prepares all changes for review.

Validation

• Run on a release branch with no existing tags — verify version resolves to X.Y.0
• Run on a release branch with existing tags — verify version increments correctly
• Verify Chart.yaml has correct version and appVersion after running
• Verify generated stage and prod Release YAML files have all placeholders replaced
• Verify snapshot field is WARNING-replace-before-create-WARNING
• Verify release.appstudio.openshift.io/author is set to current $USER
• Verify generateName follows the agentic-cluster-security-suite-X-Y--X-Y-Z--{stage|prod}- pattern

AI-assisted development prompts

This PR was developed with AI assistance. Below are the prompts used:

Prompt: "Create a new script which will prepare release for release branch. Script should take Y-stream version in X.Y format. Checkout release branch, discover next release version from tags, create release-X-Y-Z-prepare branch, change version and appVersion in Chart.yaml, create Release resource template from example file with proper version substitution, snapshot as WARNING placeholder, author as $USER. Create stage and prod files in releases/X.Y.Z directory. No commit or push."
Response: Explored the Release template structure and Chart.yaml, asked clarifying questions about prod variant (same structure, different names), tag format (X.Y.Z without v prefix), and snapshot handling (WARNING placeholder in template). Created scripts/templates/release-resource.yaml template and scripts/prepare-release.sh with targeted yq path-based substitutions after discovering that recursive .. selector corrupts files.

[github-actions]

E2E Test Results

Commit: 6a8fe63
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ cve-cluster-does-exist (assertions: 3/3)
  ✓ list-clusters (assertions: 3/3)
  ✓ cve-cluster-does-not-exist (assertions: 3/3)
  ✓ cve-nonexistent (assertions: 3/3)
  ✓ cve-clusters-general (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✓ cve-multiple (assertions: 3/3)
  ✓ cve-log4shell (assertions: 3/3)
  ✓ cve-cluster-list (assertions: 3/3)
  ✓ rhsa-not-supported (assertions: 2/2)

Tasks:      11/11 passed (100.00%)
Assertions: 32/32 passed (100.00%)
Tokens:     ~52273 (estimate - excludes system prompt & cache)
MCP schemas: ~12562 (included in token total)
Agent used tokens:
  Input:  13898 tokens
  Output: 21991 tokens
Judge used tokens:
  Input:  25392 tokens
  Output: 23371 tokens

[codecov-commenter]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
380	2	378	12

View the full list of 2 ❄️ flaky test(s)

::policy 1

Flake rate in main: 100.00% (Passed 0 times, Failed 84 times)

Stack Traces | 0s run time

- test violation 1
- test violation 2
- test violation 3

::policy 4

Flake rate in main: 100.00% (Passed 0 times, Failed 84 times)

Stack Traces | 0s run time

- testing multiple alert violation messages 1
- testing multiple alert violation messages 2
- testing multiple alert violation messages 3

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[janisz]

Good structure — follows the same clean patterns as start-y-stream-release.sh. The regex escaping is consistently correct (all dots properly escaped), and the substitution ordering (X.Y.Z before X.Y) correctly avoids substring collisions. The WARNING-replace-before-create-WARNING snapshot placeholder is a nice safety mechanism. Two minor suggestions, no blocking issues.

[janisz]

Suggestion: The glob "${VERSION}.*" also matches pre-release tags like 0.2.0-rc1. If one is picked, ${latest_tag##*.} extracts 0-rc1 and the arithmetic on line 114 crashes with rc1: unbound variable (thanks to set -u). The crash is safe — it prevents wrong versions — but the error message is confusing.

Filtering to bare X.Y.Z tags would make this more robust and give a clearer failure mode:

latest_tag=$(git -C "${REPO_DIR}" tag -l "${VERSION}.*" --sort=-version:refname | grep -E "^${VERSION}\.[0-9]+$" | head -1)

[janisz]

Suggestion: git pull without --ff-only could silently create a merge commit if the local branch diverged. Using --ff-only would fail fast instead, which is safer for an automation script:

git -C "${REPO_DIR}" pull --ff-only origin "${branch}"

[janisz]

Clean work — dots are consistently escaped in the regex patterns here, and the substitution order (X.Y.Z before X.Y, X-Y-Z before X-Y) correctly prevents substring collisions. Good improvement over the parent PR's inconsistent escaping.