Cut release branches first, land cherry-picks, release from branch

.github/workflows/cut-release-candidate.yaml

@@ -7,15 +7,10 @@ on:
         description: 'Version (e.g. 0.1.1rc2)'
         required: true
         type: string
-      commit_id:
-        description: 'Commit ID for "cut" (default: origin/main)'
+      commit_hash:
+        description: 'Optional: specific commit override (will be validated)'
         required: false
         type: string
-      inference_provider:
-        description: 'Inference provider (fireworks, together)'
-        required: false
-        type: string
-        default: 'fireworks'
       cut_mode:
         description: 'Mode to run the script in (test-and-cut, cut-only)'
         type: string
@@ -40,13 +35,9 @@ jobs:
     - uses: ./actions/test-and-cut
       with:
         version: ${{ inputs.version }}
-        commit_id: ${{ inputs.commit_id }}
-        inference_provider: ${{ inputs.inference_provider }}
+        commit_hash: ${{ inputs.commit_hash }}
         cut_mode: ${{ inputs.cut_mode }}
         llama_stack_only: ${{ inputs.llama_stack_only }}
-        fireworks_api_key: ${{ secrets.FIREWORKS_API_KEY }}
-        together_api_key: ${{ secrets.TOGETHER_API_KEY }}
-        tavily_search_api_key: ${{ secrets.TAVILY_SEARCH_API_KEY }}
         # TODO: this will expire in 90 days; we should figure out a
         # GitHub App setup that can be used instead
         github_token: ${{ secrets.LLAMA_REPOS_PAT }}
@@ -80,7 +71,3 @@ jobs:
     - uses: ./actions/test-published-package
       with:
         version: ${{ inputs.version }}
-        inference_provider: ${{ inputs.inference_provider }}
-        together_api_key: ${{ secrets.TOGETHER_API_KEY }}
-        tavily_search_api_key: ${{ secrets.TAVILY_SEARCH_API_KEY }}
-        fireworks_api_key: ${{ secrets.FIREWORKS_API_KEY }}

.github/workflows/nightly-build-publish.yml

@@ -7,15 +7,10 @@ on:
         description: 'Version (e.g. 0.2.21-dev.20250911)'
         required: false
         type: string
-      commit_id:
-        description: 'Commit ID for "cut" (default: origin/main)'
+      commit_hash:
+        description: 'Optional: specific commit hash to use'
         required: false
         type: string
-      inference_provider:
-        description: 'Inference provider (fireworks, together)'
-        required: false
-        type: string
-        default: 'fireworks'
       cut_mode:
         description: 'Mode to run the script in (test-and-cut, cut-only)'
         type: string
@@ -75,13 +70,9 @@ jobs:
     - uses: ./actions/test-and-cut
       with:
         version: ${{ needs.generate-version.outputs.version }}
-        commit_id: ${{ inputs.commit_id }}
-        inference_provider: ${{ inputs.inference_provider }}
+        commit_hash: ${{ inputs.commit_hash }}
         cut_mode: ${{ inputs.cut_mode }}
         llama_stack_only: ${{ inputs.llama_stack_only }}
-        fireworks_api_key: ${{ secrets.FIREWORKS_API_KEY }}
-        together_api_key: ${{ secrets.TOGETHER_API_KEY }}
-        tavily_search_api_key: ${{ secrets.TAVILY_SEARCH_API_KEY }}
         # TODO: this will expire in 90 days; we should figure out a
         # GitHub App setup that can be used instead
         github_token: ${{ secrets.LLAMA_REPOS_PAT }}
@@ -117,7 +108,3 @@ jobs:
     - uses: ./actions/test-published-package
       with:
         version: ${{ needs.generate-version.outputs.version }}
-        inference_provider: ${{ inputs.inference_provider }}
-        together_api_key: ${{ secrets.TOGETHER_API_KEY }}
-        tavily_search_api_key: ${{ secrets.TAVILY_SEARCH_API_KEY }}
-        fireworks_api_key: ${{ secrets.FIREWORKS_API_KEY }}

.github/workflows/release-final-package.yaml

@@ -45,9 +45,6 @@ jobs:
     - uses: ./actions/test-published-package
       with:
         version: ${{ inputs.release_version }}
-        together_api_key: ${{ secrets.TOGETHER_API_KEY }}
-        tavily_search_api_key: ${{ secrets.TAVILY_SEARCH_API_KEY }}
-        fireworks_api_key: ${{ secrets.FIREWORKS_API_KEY }}
 
   publish-docker-images:
     needs:

.github/workflows/test-maybe-cut.yaml

@@ -3,28 +3,19 @@ name: Test and Possibly Cut a Branch
 on:
   workflow_dispatch:
     inputs:
-      commit_id:
-        description: 'llama-stack commit ID'
-        required: true
-      client_python_commit_id:
-        description: 'llama-stack-client-python commit ID'
+      commit_hash:
+        description: 'Optional: specific commit hash to test'
         required: false
         type: string
-        default: 'origin/main'
       version:
-        description: 'Version (e.g. 0.1.1rc2); if optional, will not cut a branch'
+        description: 'Version (e.g. 0.1.1rc2); if empty, will use dev version'
         required: false
         type: string
       cut_mode:
         description: 'Mode to run the script in (test-and-cut, test-only, cut-only)'
         required: false
         type: string
         default: 'test-and-cut'
-      inference_provider:
-        description: 'Inference provider to use for testing'
-        required: false
-        type: string
-        default: 'fireworks'
   schedule:
     - cron: "0 0 * * *"  # Run every day at midnight
 
@@ -37,17 +28,15 @@ jobs:
       contents: read
     steps:
     - uses: actions/checkout@v4
-    - name: Set commit ID and version for scheduled runs
+    - name: Set inputs for scheduled runs
       id: inputs
       run: |
         if [[ "${{ github.event_name }}" == "schedule" ]]; then
-          echo "commit_id=origin/main" >> $GITHUB_OUTPUT
+          echo "commit_hash=" >> $GITHUB_OUTPUT
           echo "version=" >> $GITHUB_OUTPUT
-          echo "client_python_commit_id=origin/main" >> $GITHUB_OUTPUT
         else
-          echo "commit_id=${{ inputs.commit_id }}" >> $GITHUB_OUTPUT
+          echo "commit_hash=${{ inputs.commit_hash }}" >> $GITHUB_OUTPUT
           echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT
-          echo "client_python_commit_id=${{ inputs.client_python_commit_id }}" >> $GITHUB_OUTPUT
         fi
       shell: bash
     - name: Set version if not provided
@@ -64,13 +53,8 @@ jobs:
     - uses: ./actions/test-and-cut
       with:
         version: ${{ steps.version.outputs.value }}
-        commit_id: ${{ steps.inputs.outputs.commit_id }}
-        client_python_commit_id: ${{ steps.inputs.outputs.client_python_commit_id }}
-        inference_provider: ${{ inputs.inference_provider }}
+        commit_hash: ${{ steps.inputs.outputs.commit_hash }}
         cut_mode: ${{ steps.version.outputs.cut_mode }}
-        fireworks_api_key: ${{ secrets.FIREWORKS_API_KEY }}
-        together_api_key: ${{ secrets.TOGETHER_API_KEY }}
-        tavily_search_api_key: ${{ secrets.TAVILY_SEARCH_API_KEY }}
         # TODO: this will expire in 90 days; we should figure out a
         # GitHub App setup that can be used instead
         github_token: ${{ secrets.LLAMA_REPOS_PAT }}

.github/workflows/test-published-package.yaml

@@ -7,11 +7,6 @@ on:
         description: 'Version number (e.g. 0.1.1rc2, 0.1.1.dev20250201)'
         required: true
         type: string
-      inference_provider:
-        description: 'Inference provider to use for the release candidate (fireworks, together) (default: fireworks)'
-        required: false
-        type: string
-        default: 'fireworks'
 
 jobs:
   test-published-package:
@@ -21,7 +16,3 @@ jobs:
     - uses: ./actions/test-published-package
       with:
         version: ${{ inputs.version }}
-        inference_provider: ${{ inputs.inference_provider }}
-        together_api_key: ${{ secrets.TOGETHER_API_KEY }}
-        tavily_search_api_key: ${{ secrets.TAVILY_SEARCH_API_KEY }}
-        fireworks_api_key: ${{ secrets.FIREWORKS_API_KEY }}

RELEASE_PROCESS.md

@@ -0,0 +1,51 @@
+# Release Process
+
+Releases are managed through long-lived release branches. Each minor version (e.g., `0.1.x`) has one branch containing all patch releases for that series.
+
+```
+main
+  ↓
+release-0.1.x ← v0.1.0rc1, v0.1.0rc2, v0.1.0, v0.1.1rc1, v0.1.1, ...
+  ↓
+release-0.2.x ← v0.2.0rc1, v0.2.0, ...
+```
+
+## Workflows
+
+**Cut Release Candidate** (`cut-release-candidate.yaml`)
+
+Creates an RC for testing. Provide the RC version (e.g., `0.1.0rc1`) and optionally a specific commit hash. The workflow derives the release branch from the version (`0.1.0rc1` → `release-0.1.x`). If the branch exists, it uses HEAD; otherwise it creates the branch from main (or the specified commit). It then bumps the version, builds packages, runs tests, and publishes to test.pypi.
+
+**Release Final Package** (`release-final-package.yaml`)
+
+Promotes an RC to final. Provide the RC version to promote (e.g., `0.1.0rc2`) and the final version name (e.g., `0.1.0`). The workflow checks out the RC tag, bumps version strings, updates lockfiles, publishes to PyPI/npm, and creates a PR to bump main to the next dev version (`0.1.1.dev0`).
+
+**Test Published Package** (`test-published-package.yaml`)
+
+Manually tests any published package version.
+
+## Examples
+
+**New minor version (0.1.0):**
+
+1. Cut first RC: `version=0.1.0rc1` (creates `release-0.1.x` from main)
+2. Test, find bugs, cherry-pick fixes to `release-0.1.x`
+3. Cut another RC: `version=0.1.0rc2` (uses HEAD of `release-0.1.x`)
+4. Promote to final: `rc_version=0.1.0rc2`, `release_version=0.1.0`
+
+**Patch release (0.1.1):**
+
+1. Cherry-pick fixes to `release-0.1.x`
+2. Cut RC: `version=0.1.1rc1`
+3. Promote to final: `rc_version=0.1.1rc1`, `release_version=0.1.1`
+
+## Version Naming
+
+- RC: `X.Y.Zrc1`, `X.Y.Zrc2` (manual, sequential)
+- Final: `X.Y.Z`
+- Dev: `X.Y.Z.dev0` (auto-generated for main)
+- Branches: `release-X.Y.x`
+
+## Notes
+
+Release branches are created on the first RC, not on final release. Main is automatically bumped via PR after each final release (patch + 1). Cherry-picking is done manually between RCs. The `commit_hash` parameter is optional and validates against branch ancestry if provided.

actions/common.sh

@@ -1,10 +1,5 @@
 github_org() {
-  repo=$1
-  if [ "$repo" == "stack" ]; then
-    echo "meta-llama"
-  else
-    echo "llamastack"
-  fi
+  echo "llamastack"
 }
 
 run_integration_tests() {