From 7f3f43ed5aa406587e1031e963edb944b4534bae Mon Sep 17 00:00:00 2001
From: Russell Spitzer <russell.spitzer@gmail.com>
Date: Thu, 10 Sep 2026 10:09:20 -0500
Subject: [PATCH] Prepare RC: push the RC tag only after staging succeeds

prepare-rc.sh created and pushed the RC tag at step 5, then did the work
that can actually fail -- Nexus deploy, source tarball, SVN staging -- in
steps 6-8. Every failure in that window left a published tag and consumed
an RC number; 1.19.0 accumulated eight orphaned tags (rc0-rc7, all on the
same commit) that way, and cancel-rc.sh cannot clean them up because it
requires a live staging repository.

Keep `git tag -a` at step 5 so local consumers still resolve it -- step 7
reads it via `git rev-list -1` and `git archive`, both local -- and move
only `git push origin <tag>` to step 9, immediately before the GitHub
pre-release that needs it on the remote. A failure in steps 6-8 now
leaves the tag only on the runner, so a retry reuses the same RC number
with no ref surgery.

The branch push stays at step 5: it publishes the version-bump commit, is
idempotent, and is what lets a retry skip the version update.

Trade-off: staged artifacts are briefly visible before the tag exists,
and a tag push failing after staging succeeds leaves a staged RC with no
tag. Recovery there is one idempotent `git push origin <tag>`, which is
cheaper than deleting a published ref.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 release/bin/prepare-rc.sh | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/release/bin/prepare-rc.sh b/release/bin/prepare-rc.sh
index 259c22eba2..eb1b213998 100755
--- a/release/bin/prepare-rc.sh
+++ b/release/bin/prepare-rc.sh
@@ -237,17 +237,16 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# Step 5: Create RC tag and push
+# Step 5: Create RC tag locally (pushed in step 9)
 # ---------------------------------------------------------------------------
 step_summary ""
-step_summary "### Tag and Push"
+step_summary "### Tag Creation"
 
 exec_process git tag -a "${rc_tag}" -m "Apache Parquet ${version} RC${rc_number}"
 exec_process git push origin "${release_branch}"
-exec_process git push origin "${rc_tag}"
 
 tag_commit=$(git rev-parse HEAD)
-step_summary "Created tag \`${rc_tag}\` at \`${tag_commit}\`"
+step_summary "Created tag \`${rc_tag}\` at \`${tag_commit}\` (pushed in step 9)"
 
 # ---------------------------------------------------------------------------
 # Step 6: Deploy to Nexus
@@ -316,8 +315,16 @@ svn_stage_rc "${version}" "${rc_number}" \
 step_summary "Staged source tarball to \`${APACHE_DIST_URL}${APACHE_DIST_DEV_PATH}/${rc_tag}\`"
 
 # ---------------------------------------------------------------------------
-# Step 9: Create GitHub pre-release
+# Step 9: Push RC tag and create GitHub pre-release
 # ---------------------------------------------------------------------------
+step_summary ""
+step_summary "### Tag Push"
+
+# Pushed here rather than with the tag creation in step 5: a failure in steps
+# 6-8 would otherwise leave a published tag and consume the RC number.
+exec_process git push origin "${rc_tag}"
+step_summary "Pushed tag \`${rc_tag}\`"
+
 step_summary ""
 step_summary "### GitHub Pre-Release"