Skip to content

RELEASING.md

Latest commit

 

History

History
27 lines (21 loc) · 1.62 KB

RELEASING.md

File metadata and controls

27 lines (21 loc) · 1.62 KB
Raw

Release policy and procedure

Volt-Base uses SemVer. Patch releases contain compatible fixes; minor releases add compatible generator/runtime features; major releases may change generated-project contracts. Deprecations should remain for at least one minor release and include a migration path. Existing generated bots are never updated automatically.

Prepare

  1. Start from a clean main protected by required CI, security checks, and review.
  2. Update CHANGELOG.md, version, migration notes, supported versions, and rollback notes.
  3. Run bun install --frozen-lockfile, bun run check, bun run audit, and bun run package:verify with Bun 1.3.14.
  4. Confirm git status --short is empty and bin/cli.js matches bun run build:check.
  5. Create an annotated vX.Y.Z tag and a GitHub release from the reviewed commit.

The Release workflow verifies tag/version parity, invokes npm pack once (whose prepack builds and tests), installs and runs the exact tarball in a clean directory, generates an SPDX SBOM, creates artifact/SBOM attestations, uploads evidence, and publishes that same tarball with npm provenance. The npm GitHub environment should require maintainer approval and expose only NPM_TOKEN.

Use manual workflow dispatch with publish=false for a repeatable dry run. Publishing is immutable; fix a bad release with a new version. Roll back consumers by pinning the previous verified generator release and follow the deployment rollback for generated runtimes.

Action pins are full commit SHAs. Dependabot may update them only through reviewed PRs that identify the upstream release tag and pass the Security workflow.