Release process

1. Merge: a maintainer merges the automated Release Please pull request.
2. Draft release: Release Please opens a draft GitHub release for the version.
3. Tag: Release Please pushes the version tag.
4. Release creation: the tag push triggers GoReleaser to build the release artifacts.
5. Signing: GoReleaser signs and attests the artifacts with cosign.
6. Release ready: the pipeline publishes the release once it is signed and attested.

Note

Maintainers cannot create or update version tags (vX.Y.Z). If the version number needs correction, the standard Release Please mechanisms are available.

Creating a release

A maintainer creates a release by merging the current Release PR.

A release is ready to create when:

• main is stable and fully tested, and
• there are changes waiting to go out.

Prefer multiple, smaller releases over releases that have a greater number of changes.

Release signing

The Sigstore ecosystem is leveraged for signing executable release outputs. (Docs.)

• cosign is used as the signing CLI tool
• The fulcio public-good instance is used for ephemeral signing certificates
• The rekor public-good instance is used for Certificate Transparency record publishing.

The signing process allows some useful attributes of the binaries to be verified:

• the provider of the identity for the build process (i.e. GitHub Actions)
• the build process that was used to generate them (both scripts and compute)
• the Git reference of the code that was used to build the binary

Releases are signed with cosign, with transparency records published to the [public-good Rekor instance].

Testing the release process

It is possible to run GoReleaser locally to test some of the release processes. (goreleaser must be available.)

# from the root of the local working copy
goreleaser release --clean --verbose --skip "announce,validate"

This will run the binary and image builds, and publish a temporary image to ttl.sh. Temporary images can be used in local testing with docker compose.

Some processes are skipped when doing this:

• binary signing
• image signing
• changelog generation
• GitHub release creation

Thus release testing verifies a proportion of the GoReleaser configuration, and allows the image/binary builds to be integration tested.