Beam Go now has a v2.48.2 release.

[Robert Burke <lo...@apache.org>]

Hi Beam Dev List!

This is to report on an issue that occurred with the v2.48.0 Go SDK release
and it's resolution. While generally poor form, Ritesh, Jack, and I
independently resolved the issue instead of first mailing the dev list
about it first. We decided that fixing the error for the Go SDK was better
for the community than delaying such a fix through a discussion and vote.
We do believe the issue is resolved, and there are now sufficient guard
rails against a recurrence.

However, it's still critical we email the community about it, so here it is.

tl;dr;
Due to an error in tagging, the v2.48.0 release was trying to use the wrong
SDK container, and it was still trying to use the ".dev" version. We had to
add a new Go SDK specific tag of `sdks/v2.48.2` to resolve the issue and
ensure that tag was on the right RC commit.

This was tracked in https://github.com/apache/beam/issues/27064,

The longer story:

This morning a user filed  an issue [0]. Due to Go's unique package release
strategy, it's not possible to simply "move the tag to a new commit", since
the module proxy and similar would already have distributed the previous
versions of the source.  This property enables robust "supply chain"
security, and avoids mismatches or maliciousness.

The only resolution to a bad is to release a patch version, which for Go,
is as simple as adding an appropriate tag. The Go SDK has its own "tag
series" prefixed with "sdks/" since that folder is where the SDK's go.mod
file lives. We judged that the cost of the Go SDK version being slightly
out of sync with the main line version to be acceptable, given that Beam
doesn't presently do Patch releases. No other changes were done to avoid a
full container build. Adding a tag version of v2.48.0 to a working commit
would unbreak the Go SDK release.

The error occurred because with 2.48.0, the release manager was using the
new Github Action to get the RC tags instead of the manual script. The
action worked fine however and did that job correctly.

Since the RC_TAG variable in the release guide [1] is unspecified in the
guide, the Release Manager ended up running `git tag -s "sdks/v2.48.0"`
which adds the tag to the HEAD commit of the current branch, instead of to
the commit associated with the RC tag.

So, the Release Manager ended up running the command again, leading to the
same result. A bit of investigation showed that it was possible for Tags to
get out of sync in the local branch, vs what the Github action did. However
this burned the sdks/v2.48.1 tag.

The sync issue was resolved by a ` git fetch --all --tags` and the RC tag
commit confirmed `git rev-list ${RC_TAG}  -n 1`, leading to the 2nd fix
attempt with v2.48.2, which has resolved the Go SDK issue.

The Release Guide has been updated [2] to make checking this explicit,
though hopefully, this step will be obsolete when it's moved to github
actions. But until then, we may as well avoid the error.

The 2.48.0 release blog and notes have been updated to note the discrepancy
as well.

Thank you for your understanding and time,
Robert Burke
Beam Go Busybody

[0] https://github.com/apache/beam/issues/27064
[1] https://beam.apache.org/contribute/release-guide/#git-tag
[2] https://github.com/apache/beam/pull/27070