Release Checklist

One time changes as we make the 1st release:

• Update autogen-version to switch the Zeek naming scheme (prerelease="dev-${commit}")
• add source url and sha256 in Spicy Homebrew formula
• setup branch protection rules for release branches

General process:

• Update release version in doc/conf.py (we could put this information somewhere else, too).
• Make sure that Git submodules (at least zeek/spicy-plugin and zeek/spicy-analyzers) are up-to-date.
• if needed: cut release branch (naming scheme release/X.Y) and change to it
• tag a release with update-changes -R vX.Y.Z. _The commit message must not contain skip CI (from default template) as that would skip the release pipeline
  • If this is a major release cherry this commit into the main branch
• push tags (release, vX.Y.Z) and branch (release/X.Y)
• wait for release to be created. This might take some time as the release job waits for other jobs to pass first
• remove stray "releases" like release or beta produced by GH from tags
• confirm that release artifacts contain all artifacts; if a platform is missing download its release artifact from the Cirrus CI task artifacts and upload manually (rename if needed); you can use e.g., scripts/store_release_artifacts --commit vX.Y.Z to download all artifacts for a certain tag.
• check that source tarball spicy-X.Y.Z.tar.gz has correct name; else rename via edit of release
• if release branched from main:
  • add a new version skeleton to NEWS.rst and commit
  • create annotated tag for next version on that commit, e.g.,

    git tag -a vX.Y+1.Z -m 'Start of X.Y+1.Z development'
    

• if update to latest release:
  • update the spicy:latest Docker image

    docker pull zeekurity/spicy:X.Y.Z
    docker tag zeekurity/spicy:X.Y.Z zeekurity/spicy:latest
    docker push zeekurity/spicy:latest  # Requires `docker login` for 'zeekurity' user
    

  • update README to point the overview table near the top to point to the latest release
  • bump version in Spicy Homebrew formula