* ci(release): split channel pipelines and automate version transitions Introduce dedicated next/release orchestration workflows backed by a reusable publish pipeline with RC/final package version updates and post-release main dev bump PRs. Add a strict release process SOP with RC freeze, hotfix override, and mandatory backport rules. * ci(release): gate main-to-next promotion on green CI Add a dedicated workflow that validates main branch checks/statuses and block the promote-main-to-next flow unless main is green. Update the release SOP to reflect the enforced pre-promotion validation. * ci(release): fix channel promotion edge cases and policy gaps Switch channel promotions to reset-based snapshots with force-with-lease pushes, stop auto-merging channel nix-refresh PRs, and guard main dev bump against version downgrades. Add RC changelog fallback, require AUR release updates in SOP, and extend npmDepsHash sync to main/next/release pushes. * docs(release): clarify backport and nix refresh survivability rules Require RC fix backports to reach main before the next main-to-next promotion, and document that channel-local nix refresh PRs are advisory unless equivalent changes are merged into main.
7.8 KiB
Release Process (Strict SOP)
This document defines the only allowed release workflow for this repository. All maintainers should follow it exactly.
1) Branch roles
main:- primary development branch
- all regular feature/fix work lands here via PR
- should usually carry a development version (for example
X.Y.Z-dev)
next:- release-candidate (RC) stabilization branch
- receives promoted changes from
main - receives RC-only fixes during freeze
release:- stable release branch
- only receives promoted commits from
next
Direct push to these branches is not part of normal human workflow. Use PRs and promotion workflows.
2) Versioning rules (mandatory)
Version is authoritative in package.json and package-lock.json.
mainversion format:X.Y.Z-devnextversion format:X.Y.Z-rc.Nreleaseversion format:X.Y.Z
Rules:
- Never edit versions manually in random commits.
- Version transitions must happen through the defined promotion workflows.
- Tags must match package version:
- RC:
app-vX.Y.Z-rc.N - Stable:
app-vX.Y.Z
- RC:
3) Standard release flow
Step A: Prepare in main
- Merge ready PRs into
main. - Confirm CI is green on
main.
Step B: Promote to RC (next)
- Run workflow: Promote main to next.
- Workflow behavior:
- validates that
mainchecks are green before promotion - resets
nexttomainsnapshot - auto-bump package version in
nextto next-rc.N - commit and push version bump
- validates that
- Push on
nexttriggers Next Channel workflow:- build/publish RC artifacts for all platforms
- run Nix verification path
Step C: Stabilize RC
- Test RC artifacts.
- If fixes are needed, follow Section 5 (RC fix policy).
- Repeat Step B as needed until release candidate is accepted.
Step D: Promote to stable (release)
- Run workflow: Promote next to release.
- Workflow behavior:
- resets
releasetonextsnapshot - finalize version from
-rc.NtoX.Y.Z - commit and push finalized version
- resets
- Push on
releasetriggers Release Channel workflow:- stable artifact publish
- Nix verification
- opens PR to bump
mainto next minor-dev
Step E: Move main forward
- Merge the auto-generated PR that bumps
mainto next minor dev version. - Confirm
mainnow usesX.(Y+1).0-dev. - Update AUR package metadata for the same stable version:
- bump
pkgverinpackages/aur/PKGBUILD - regenerate
packages/aur/.SRCINFO - publish/update in AUR remote
- bump
4) Freeze policy (RC stabilization window)
When RC freeze starts:
- Do not run
Promote main to nextautomatically or casually. - Only approved release manager(s) may run promotion workflows.
nextaccepts only stabilization changes (fixes/docs/chore required for release quality).- New features remain in
mainand wait for next cycle.
Freeze ends after next -> release promotion is complete.
5) RC fix policy (strict backport/forward-port rules)
If a bug is discovered during RC stabilization:
- Create dedicated fix branch from
next:- example:
fix/rc-crash-login
- example:
- Open PR:
fix/rc-crash-login -> next - After merge to
next, create dedicated backport branch frommain:- example:
fix/backport-rc-crash-login-main
- example:
- Cherry-pick (or re-apply) same fix.
- Open PR:
fix/backport-rc-crash-login-main -> main - Merge this
mainbackport PR before the nextPromote main to nextrun.
This is mandatory. RC-only fixes may not stay only in next.
Alternative allowed order:
- implement first in
main, then promotemain -> next.
But if main is ahead with non-release features and promotion is frozen, use the next-first + mandatory main backport flow above.
6) Post-release critical hotfix policy (default path)
After a stable release X.Y.Z, critical fixes must be shipped as a patch release:
- next stable target is always
X.Y.(Z+1) - RC tags for hotfix cycle:
app-vX.Y.(Z+1)-rc.N - final stable tag:
app-vX.Y.(Z+1)
Never re-use or overwrite X.Y.Z tags/releases.
Case A: next is not yet used for the next minor
This case is uncommon in this repository but allowed.
- Create hotfix branch from
release. - Implement fix and open PR to
release. - Move patch line through
nextRC flow (X.Y.(Z+1)-rc.N). - Promote
next -> releasefor finalX.Y.(Z+1). - Backport fix to
mainvia dedicated PR (mandatory).
Case B (default): next already tracks next minor
This is the expected real-world case.
Assume:
releaseis1.9.0main/nextalready moved to1.10.0-*- critical bug requires
1.9.1
Required steps:
- Announce hotfix override window and freeze normal next-minor RC flow.
- Create hotfix branch from
release(1.9.0baseline). - Implement fix and merge into
releasebranch via PR. - Temporarily align
nextto the hotfix patch line for RC publication. - Publish hotfix RC(s):
1.9.1-rc.N. - Promote
next -> releaseto finalize1.9.1. - Backport/cherry-pick same fix into
mainvia dedicated PR (mandatory). - Restore
nextback to the normal next-minor line frommain. - Announce end of hotfix override and resume normal RC cycle.
Hard rule: no feature work may be merged into next during hotfix override.
7) Idempotency and rerun behavior
Manual workflow reruns should be safe:
- rerunning Promote main to next:
- no change if no new commits
- version bump occurs only when needed for next RC number
- rerunning Promote next to release:
- no change if release already matches next
- no extra version increment beyond
X.Y.Z
- rerunning release publish:
- main dev bump step should no-op when
mainalready has target dev version
- main dev bump step should no-op when
Rerun is allowed for recovery, but must be announced in release channel/chat.
8) Hard rules and prohibitions
Do:
- use PRs for all code changes
- keep channel promotions deterministic and force-push only through approved promotion workflows
- require green CI before promotions
- document exceptions in PR description
Do not:
- manually retag or overwrite release tags
- manually edit
package.jsonversion outside defined release flow - merge feature PRs into
nextduring freeze - skip the
next/release -> mainbackport for RC fixes or hotfixes - force-push
nextorreleasemanually outside promotion workflows
9) Incident handling
If an incorrect promotion happened:
- Stop further promotions immediately.
- Announce incident and current branch SHAs.
- Create corrective PRs (do not use destructive git history rewrites on protected branches).
- Re-run affected workflows only after corrective PRs are merged.
10) Operator checklist (quick)
Before main -> next:
mainCI green- freeze status known
- release manager approval
- branch rules allow workflow
--force-with-leaseonnext
Before next -> release:
- RC validation complete
- all RC fixes merged to
next - corresponding backports to
maincompleted or queued with owners - branch rules allow workflow
--force-with-leaseonrelease
After stable release:
- verify stable artifacts exist
- merge auto PR for next
-devbump inmain - publish AUR update (
PKGBUILD+.SRCINFO) - announce cycle close
For post-release hotfix:
- patch target decided:
X.Y.(Z+1) - hotfix override for
nextannounced - fix merged to release patch line
- hotfix backport PR to
mainmerged nextrestored to normal next-minor line
Nix note:
nix-npm-deps-hash-sync.ymlruns on pushes tomain,next, andrelease.verify-nixin channel publish still performs full lock/hash refresh verification for release artifacts.- Channel-local nix refresh PRs are advisory and can be overwritten by later reset-based promotions.
- If a nix refresh must survive release cycles, ensure the same change is merged into
main.