docs: add the release process

Signed-off-by: Filipe Laíns <[email protected]>

docs/index.rst

@@ -43,6 +43,7 @@ environment, but this behavior can be disabled with ``--no-isolation``.
    :hidden:
 
    test_suite
+   release
 
 .. toctree::
    :caption: Project Links

docs/release.rst

@@ -0,0 +1,30 @@
+***************
+Release Process
+***************
+
+As this project is critical to the Python ecosystem's supply chain security, all
+releases are PGP signed with one of the keys listed in the `installation page`_.
+Before releasing please make sure your PGP key is listed there, and preferably
+signed by one of the other key holders. If your key is not signed by one of the
+other key holders, please make sure the PR that added your key to the
+`installation page`_ was approved by at least one other maintainer.
+
+After that is done, you may release the project by following these steps:
+
+#. Bump the versions in ``pyproject.toml`` and ``src/build/__init__.py``
+#. Update ``CHANGELOG.rst`` with the new version and current date
+#. Make a release commit with the changes made above
+    - The commit message should follow the ``release X.Y.Z`` format
+#. Make a signed tag (``git tag -s X.Y.Z``)
+    - The tag title should follow the ``build X.Y.Z`` format
+    - The tag body should be a plaintext version of the changelog for the current
+      release
+#. Push the commit and tag to the repository (``git push`` and ``git push --tags``)
+#. Build the Python artifacts (``python -m build``)
+#. Sign and push the artifacts to PyPI (``twine upload -s dist/*``)
+
+If you have any questions, please look at previous releases and/or ping the
+other maintainers.
+
+
+.. _installation page: installation