kfaraz commented on code in PR #18681: URL: https://github.com/apache/druid/pull/18681#discussion_r4151572209
########## distribution/asf-release-process-guide.md: ########## @@ -17,46 +17,153 @@ ~ under the License. --> -## Getting Started +## 🚀 Release Checklist + +- [ ] [Prior to starting, initial setup for release access](#prior-to-starting-initial-setup-for-release-access) + - [ ] [SVN access](#SVN-access) + - [ ] [GPG key](#GPG-key) + - [ ] [Key propagation](#Key-propagation) + - [ ] [Maven credentials](#Maven-credentials) +- [ ] [Announce intention to release](#Announce-intention-to-release) +- [ ] [Security vulnerabilities](#Security-vulnerabilities) +- [ ] [Create a release branch](#Create-a-release-branch) + - [ ] [Preparing the release branch](#Preparing-the-release-branch) + - [ ] [Preparing the master branch for the next version after branching](#Preparing-the-master-branch-for-the-next-version-after-branching) + - [ ] [Backport PRs tagged with release milestone](#Backport-PRs-tagged-with-release-milestone) + - [ ] [Release branch hygiene](#Release-branch-hygiene) +- [ ] [LICENSE and NOTICE handling](#LICENSE-and-NOTICE-handling) +- [ ] [Release notes](#Release-notes) +- [ ] [Building a release candidate](#Building-a-release-candidate) + - [ ] [Update the release branch to have all commits needed](#Update-the-release-branch-to-have-all-commits-needed) + - [ ] [Set version and make a tag](#Set-version-and-make-a-tag) + - [ ] [Do a clean clone (so the source distribution does not pick up extra files)](#Do-a-clean-clone-so-the-source-distribution-does-not-pick-up-extra-files) + - [ ] [Switch to tag](#Switch-to-tag) + - [ ] [Build Artifacts](#Build-Artifacts) + - [ ] [Verify checksums](#Verify-checksums) + - [ ] [Verify GPG signatures](#Verify-GPG-signatures) + - [ ] [Commit artifacts to SVN repo](#Commit-artifacts-to-SVN-repo) + - [ ] [Update druid.staged.apache.org](#Update-druidstagedapacheorg) + - [ ] [Create staged Maven repo](#Create-staged-Maven-repo) + - [ ] [Release candidates and voting](#Release-candidates-and-voting) + - [ ] [Druid PMC vote result](#Druid-PMC-vote-result) +- [Final Release](#Final-Release) + - [ ] [Create git tag](#Create-git-tag) + - [ ] [Publish release artifacts to SVN](#Publish-release-artifacts-to-SVN) + - [ ] [Publish the staged Maven repo](#Publish-the-staged-Maven-repo) + - [ ] [Wait 24 hours then update druid.apache.org](#Wait-24-hours-then-update-druidapacheorg) + - [ ] [Draft a release on github](#draft-a-release-on-github) + - [ ] [Announce the release](#Announce-the-release) + - [ ] [Update Wikipedia](#Update-Wikipedia) + - [ ] [Remove old releases which are not 'active'](#remove-old-releases-which-are-not-active) + + +## Prior to starting, initial setup for release access -### Announce intention to release +### SVN access + +Make sure that you have Apache SVN access set up, as several steps in the release process will require you to make SVN commits. + +### GPG key + +First, make sure you've set up a GPG key according to ASF instructions: https://www.apache.org/dev/openpgp.html + +### Key propagation + +The Apache guide suggests using the MIT keyserver, but if there are availability issues consider using https://sks-keyservers.net/ or http://pgp.surfnet.nl/ + +After your key has been propagated to public key servers, add your key fingerprint as your `OpenPGP Public Key Primary Fingerprint` at https://id.apache.org. + +The key fingerprint can be seen with `gpg --list-keys`, e.g.: + +```plaintext +... +pub rsa4096 2019-02-28 [SC] + 0495E031C35D132479C241EC9283C4921AC4483E +uid [ultimate] Jonathan Wei (CODE SIGNING KEY) <[email protected]> +sub rsa4096 2019-02-28 [E] +... +``` + +`0495E031C35D132479C241EC9283C4921AC4483E` is the fingerprint in the example above. + +If all goes well, your Apache account will be associated with that key, which you can check at https://people.apache.org/committer-index.html + +You will also need to add your key to our project KEYS file: https://dist.apache.org/repos/dist/release/druid/KEYS, this repo can be pulled with: + +```bash +$ svn co https://dist.apache.org/repos/dist/release/druid +``` + +Add your entry to the file and commit: + +```bash +$ svn commit -m 'add key for [email protected]' +``` + +### Maven credentials + +You'll need to configure Maven with your Apache credentials by adding the following to `~/.m2/settings.xml`. Encrypt the password you store here, see https://maven.apache.org/guides/mini/guide-encryption.html for details. + +```xml +<settings> + <servers> + <!-- To publish a snapshot of some part of Maven --> + <server> + <id>apache.snapshots.https</id> + <username>your-apache-username</username> + <password>{your-encrypted-password}</password> + </server> + <!-- To stage a release of some part of Maven --> + <server> + <id>apache.releases.https</id> + <username>your-apache-username</username> + <password>{your-encrypted-password}</password> + </server> + </servers> +</settings> +``` + +## Announce intention to release First up in performing an official release of Apache Druid is to announce in the dev mailing list, [email protected], that it is about time for the next (approximately) quarterly release, or, that there is a critical bug that warrants doing a bug fix release, whatever the reason happens to be. Check for any critical bugs that are still open, or issues or PRs tagged with the release milestone, and give the community a bit of heads up to try and wrap up anything that _needs_ to be in the next release. -### Create a release branch +## Security vulnerabilities +The release manager should also keep an eye-out for `Cron Job ITS` failures: https://github.com/apache/druid/actions/workflows/cron-job-its.yml. If there are security vulnerabilities, we need to fix them before creating an RC. + +## Create a release branch Next up is creating the release branch off of master (or the previous release branch for a bug fix release). Be sure to do this from the apache git repo, _not your fork_. Name the branch for the release version that is being created, omitting the `druid` prefix that will appear on the release candidate and release tags: ```bash -$ git checkout origin/0.17.0 +$ git checkout origin/master ... -$ git checkout -b 0.17.1 +$ git checkout -b 37.0.0 ``` ```bash -$ git checkout origin/master +$ git checkout origin/37.0.0 Review Comment: Please add a line above mentioning that this is for hotfix/minor version releases. ########## distribution/bin/tag-missing-milestones.py: ########## @@ -53,12 +53,19 @@ continue if pr['milestone'] is None: print("Tagging Pull Request {} with milestone {}".format(pr_number, milestone)) - url = "https://api.github.com/repos/apache/druid/issues/{}".format(pr_number) - requests.patch(url, json=milestone_json, auth=(github_username, os.environ["GIT_TOKEN"])) + if os.environ.get("DRY_RUN", "true").lower() == "false": Review Comment: Please call out the DRY_RUN env variable in the help text of this script and maybe in the comments too. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
