Skip to content

RELEASE_CHECKLIST.md

Latest commit

 

History

History
105 lines (69 loc) · 2.95 KB

RELEASE_CHECKLIST.md

File metadata and controls

105 lines (69 loc) · 2.95 KB
Raw

Release Checklist

Use this checklist every time you publish a new release to the organization.

1. Pre-release quality gate

# Full CI-equivalent gate — must pass with zero warnings
prek run cargo-qa

# Supply-chain gate — advisories, licenses, bans, sources
prek run cargo-supply-chain

Both must succeed on a clean working tree before continuing.

2. CHANGELOG

  • Move entries from [Unreleased] to a new versioned section, e.g. ## [0.2.0] --- YYYY-MM-DD.
  • Update the comparison URLs at the bottom of CHANGELOG.md.

3. Version bump

Bump version in [workspace.package] inside the root Cargo.toml. All crates inherit this version automatically via workspace = true.

# Verify consistency
grep -r '^version' apps/*/Cargo.toml crates/*/Cargo.toml

4. Commit, tag, push

git add -A
git commit -m "chore: release vX.Y.Z"
git tag -s vX.Y.Z -m "Release vX.Y.Z"   # signed tag (preferred)
git push origin main --follow-tags

Annotated, signed tags (-s) are required for org-policy compliance.

5. CI green light

Wait for all CI jobs to pass on the tagged commit: - native (check + test + doc) - wasm (wasm32 type-check) - clippy - fmt - supply-chain

Do not publish Docker images or Pages artifacts until all jobs are green.

6. Docker image (lotus-api)

The pipeline builds and pushes automatically on main. Verify the image tag exists before advertising it:

docker pull codeberg.org/YOUR_ORG/lotus-api:vX.Y.Z
docker pull ghcr.io/YOUR_ORG/lotus-api:vX.Y.Z

7. GitHub / Codeberg release

  • Create a new release on the forge, pointing at the signed tag.
  • Title: vX.Y.Z
  • Body: paste the relevant CHANGELOG.md section.
  • Attach any binary artifacts if applicable.

8. Post-release

  • Update [Unreleased] in CHANGELOG.md to start accumulating the next cycle's entries.
  • Announce internally / in the project channel.
  • If the release addressed security issues, make sure SECURITY.md advisory notes are published.

Dependency update cycle

After each release, run:

cargo update
prek run cargo-qa
prek run cargo-supply-chain

Review and commit Cargo.lock with any intentional updates. Treat each lock-file commit as a mini release validation.