FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

doc: minor updates to releases.md · nodejs/node@2532bf3 · GitHub

/ node Public

Commit 2532bf3

Browse files
BethGriggs
authored and
MylesBorins
committed
doc: minor updates to releases.md
PR-URL: #30636 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Anto Aravinth <anto.aravinth.cse@gmail.com> Reviewed-By: Yorkie Liu <yorkiefixer@gmail.com>
1 parent 8b60065 commit 2532bf3

1 file changed

Lines changed: 38 additions & 27 deletions

File tree

‎doc/releases.md‎

Lines changed: 38 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ official release builds for Node.js, hosted on <https://nodejs.org/>.
3232
* [17. Cleanup](#17-cleanup)
3333
* [18. Announce](#18-announce)
3434
* [19. Celebrate](#19-celebrate)
35-
* [Major Releases](#major-Releases)
35+
* [Major Releases](#major-releases)
3636

3737
## Who can make a release?
3838

@@ -81,11 +81,11 @@ access to individuals authorized by the TSC.
8181

8282
### 3. A Publicly Listed GPG Key
8383

84-
A SHASUMS256.txt file is produced for every promoted build, nightly, and
84+
A `SHASUMS256.txt` file is produced for every promoted build, nightly, and
8585
releases. Additionally for releases, this file is signed by the individual
8686
responsible for that release. In order to be able to verify downloaded binaries,
87-
the public should be able to check that the SHASUMS256.txt file has been signed
88-
by someone who has been authorized to create a release.
87+
the public should be able to check that the `SHASUMS256.txt` file has been
88+
signed by someone who has been authorized to create a release.
8989

9090
The GPG keys should be fetchable from a known third-party keyserver. The SKS
9191
Keyservers at <https://sks-keyservers.net> are recommended. Use the
@@ -179,12 +179,13 @@ Carefully review the list of commits:
179179
should only be cherry-picked when appropriate for the type of release being
180180
made.
181181
* If you think it's risky so should wait for a while, add the `baking-for-lts`
182-
tag.
182+
tag.
183183

184184
When cherry-picking commits, if there are simple conflicts you can resolve
185185
them. Otherwise, add the `backport-requested-vN.x` label to the original PR
186186
and post a comment stating that it does not land cleanly and will require a
187-
backport PR.
187+
backport PR. You can refer the owner of the PR to the "[Backporting to Release
188+
Lines](https://github.com/nodejs/node/blob/master/doc/guides/backporting-to-release-lines.md)" guide.
188189

189190
If commits were cherry-picked in this step, check that the test still pass and
190191
push to the staging branch to keep it up-to-date.
@@ -483,7 +484,14 @@ $ npm install -g git-secure-tag
483484
Create a tag using the following command:
484485

485486
```console
486-
$ git secure-tag <vx.y.z> <commit-sha> -sm 'YYYY-MM-DD Node.js vx.y.z (Release Type) Release'
487+
$ git secure-tag <vx.y.z> <commit-sha> -sm "YYYY-MM-DD Node.js vx.y.z (<release-type>) Release"
488+
```
489+
490+
`release-type` is either "Current" or "LTS". For LTS releases, you should also
491+
include the release codename, for example:
492+
493+
```txt
494+
2019-10-22 Node.js v10.17.0 'Dubnium' (LTS) Release
487495
```
488496

489497
The tag **must** be signed using the GPG key that's listed for you on the
@@ -541,18 +549,17 @@ formatting passes the lint rules on `master`.
541549
### 13. Promote and Sign the Release Builds
542550

543551
**The same individual who signed the release tag must be the one
544-
to promote the builds as the SHASUMS256.txt file needs to be signed with the
552+
to promote the builds as the `SHASUMS256.txt` file needs to be signed with the
545553
same GPG key!**
546554

547555
Use `tools/release.sh` to promote and sign the build. When run, it will perform
548556
the following actions:
549557

550558
**a.** Select a GPG key from your private keys. It will use a command similar
551559
to: `gpg --list-secret-keys` to list your keys. If you don't have any keys, it
552-
will bail. (Why are you releasing? Your tag should be signed!) If you have only
553-
one key, it will use that. If you have more than one key it will ask you to
554-
select one from the list. Be sure to use the same key that you signed your git
555-
tag with.
560+
will bail. If you have only one key, it will use that. If you have more than
561+
one key it will ask you to select one from the list. Be sure to use the same
562+
key that you signed your git tag with.
556563

557564
**b.** Log in to the server via SSH and check for releases that can be promoted,
558565
along with the list of artifacts. It will use the `dist-promotable` command on
@@ -563,29 +570,29 @@ shouldn't be), be sure to only promote the release you are responsible for.
563570
**c.** Log in to the server via SSH and run the promote script for the given
564571
release. The command on the server will be similar to: `dist-promote vx.y.z`.
565572
After this step, the release artifacts will be available for download and a
566-
SHASUMS256.txt file will be present. The release will still be unsigned,
573+
`SHASUMS256.txt` file will be present. The release will still be unsigned,
567574
however.
568575

569-
**d.** Use `scp` to download SHASUMS256.txt to a temporary directory on your
576+
**d.** Use `scp` to download `SHASUMS256.txt` to a temporary directory on your
570577
computer.
571578

572-
**e.** Sign the SHASUMS256.txt file using a command similar to: `gpg
579+
**e.** Sign the `SHASUMS256.txt` file using a command similar to: `gpg
573580
--default-key YOURKEY --clearsign /path/to/SHASUMS256.txt`. You will be prompted
574-
by GPG for your password. The signed file will be named SHASUMS256.txt.asc.
581+
by GPG for your password. The signed file will be named `SHASUMS256.txt.asc`.
575582

576583
**f.** Output an ASCII armored version of your public GPG key using a command
577584
similar to: `gpg --default-key YOURKEY --armor --export --output
578585
/path/to/SHASUMS256.txt.gpg`. This does not require your password and is mainly
579586
a convenience for users, although not the recommended way to get a copy of your
580587
key.
581588

582-
**g.** Upload the SHASUMS256.txt files back to the server into the release
589+
**g.** Upload the `SHASUMS256.txt` files back to the server into the release
583590
directory.
584591

585592
If you didn't wait for ARM builds in the previous step before promoting the
586593
release, you should re-run `tools/release.sh` after the ARM builds have
587594
finished. That will move the ARM artifacts into the correct location. You will
588-
be prompted to re-sign SHASUMS256.txt.
595+
be prompted to re-sign `SHASUMS256.txt`.
589596

590597
It is possible to only sign a release by running `./tools/release.sh -s
591598
vX.Y.Z`.
@@ -608,30 +615,29 @@ release. However, the blog post is not yet fully automatic.
608615
Create a new blog post by running the [nodejs.org release-post.js script][].
609616
This script will use the promoted builds and changelog to generate the post. Run
610617
`npm run serve` to preview the post locally before pushing to the
611-
[nodejs.org](https://github.com/nodejs/nodejs.org) repo.
618+
[nodejs.org repository][].
612619

613620
* You can add a short blurb just under the main heading if you want to say
614621
something important, otherwise the text should be publication ready.
615622
* The links to the download files won't be complete unless you waited for the
616623
ARMv6 builds. Any downloads that are missing will have `*Coming soon*` next to
617624
them. It's your responsibility to manually update these later when you have
618625
the outstanding builds.
619-
* The SHASUMS256.txt.asc content is at the bottom of the post. When you update
626+
* The `SHASUMS256.txt.asc` content is at the bottom of the post. When you update
620627
the list of tarballs you'll need to copy/paste the new contents of this file
621628
to reflect those changes.
622-
* Always use pull-requests on the nodejs.org repo. Be respectful of that working
623-
group, but you shouldn't have to wait for PR sign-off. Opening a PR and
624-
merging it immediately _should_ be fine. However, please follow the following
625-
commit message format:
629+
* Always use pull-requests on the [nodejs.org repository][]. Be respectful
630+
of the website team, but you do not have to wait for PR sign-off. Please
631+
use the following commit message format:
626632

627633
```console
628634
Blog: vX.Y.Z release post
629635

630636
Refs: <full URL to your release proposal PR>
631637
```
632638

633-
* Changes to `master` on the nodejs.org repo will trigger a new build of
634-
nodejs.org so your changes should appear in a few minutes after pushing.
639+
* Changes to `master` on the [nodejs.org repository][] will trigger a new build
640+
of nodejs.org so your changes should appear a few minutes after pushing.
635641

636642
### 16. Create the release on GitHub
637643

@@ -681,7 +687,7 @@ New Node.js Major releases happen twice per year:
681687
Major releases should be targeted for the third Tuesday of the release month.
682688

683689
A major release must not slip beyond the release month. In other words, major
684-
releases must not slip into May or November.
690+
releases must not slip into May or November.
685691

686692
The release date for the next major release should be announced immediately
687693
following the current release (e.g. the release date for 13.0.0 should be
@@ -709,6 +715,10 @@ separate `vN.x-proposal` branch should be created that tracks the `vN.x`
709715
branch. This branch will contain the draft release commit (with the draft
710716
changelog).
711717

718+
Notify the `@nodejs/npm` team in the release proposal PR to inform them of the
719+
upcoming release. `npm` maintains a list of [supported versions](https://github.com/npm/cli/blob/latest/lib/utils/unsupported.js#L3)
720+
that will need updating to include the new major release.
721+
712722
### Test Releases and Release Candidates
713723

714724
Test builds should be generated from the `vN.x-proposal` branch starting at
@@ -761,5 +771,6 @@ judgment there.
761771
[CI lockdown procedure]: https://github.com/nodejs/build/blob/master/doc/jenkins-guide.md#restricting-access-for-security-releases
762772
[Build issue tracker]: https://github.com/nodejs/build/issues/new
763773
[nodejs.org release-post.js script]: https://github.com/nodejs/nodejs.org/blob/master/scripts/release-post.js
774+
[nodejs.org repository]: https://github.com/nodejs/nodejs.org
764775
[Partner Communities]: https://github.com/nodejs/community-committee/blob/master/governance/PARTNER_COMMUNITIES.md
765776
[webchat.freenode.net]: https://webchat.freenode.net/

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL