github.com/anchore/syft@v1.38.2/RELEASE.md (about)

     1  # Release
     2  
     3  A release of syft comprises:
     4  - a new semver git tag from the current tip of the main branch
     5  - a new [github release](https://github.com/anchore/syft/releases) with a changelog and archived binary assets
     6  - docker images published to `ghcr.io` and `dockerhub`, including multi architecture images + manifest
     7  - [`anchore/homebrew-syft`](https://github.com/anchore/homebrew-syft) tap updated to point to assets in the latest github release
     8  
     9  Ideally releasing should be done often with small increments when possible. Unless a
    10  breaking change is blocking the release, or no fixes/features have been merged, a good
    11  target release cadence is between every 1 or 2 weeks.
    12  
    13  
    14  ## Creating a release
    15  
    16  This release process itself should be as automated as possible, and has only a few steps:
    17  
    18  1. **Trigger a new release with `make release`**. At this point you'll see a preview
    19    changelog in the terminal. If you're happy with the changelog, press `y` to continue, otherwise
    20    you can abort and adjust the labels on the PRs and issues to be included in the release and
    21    re-run the release trigger command.
    22  
    23  1. A release admin must approve the release on the GitHub Actions [release pipeline](https://github.com/anchore/syft/actions/workflows/release.yaml) run page.
    24     Once approved, the release pipeline will generate all assets and publish a GitHub Release.
    25  
    26     
    27  ## Retracting a release
    28  
    29  If a release is found to be problematic, it can be retracted with the following steps:
    30  
    31  - Deleting the GitHub Release
    32  - Untag the docker images in the `ghcr.io` and `docker.io` registries
    33  - Revert the brew formula in [`anchore/homebrew-syft`](https://github.com/anchore/homebrew-syft) to point to the previous release
    34  - Add a new `retract` entry in the go.mod for the versioned release
    35  
    36  **Note**: do not delete release tags from the git repository since there may already be references to the release
    37  in the go proxy, which will cause confusion when trying to reuse the tag later (the H1 hash will not match and there
    38  will be a warning when users try to pull the new release).
    39