Fediversity

Make a release

The workflow .forgejo/workflows/release.yaml releases the head of main on the 8th of each month, one week after update.yaml opens the pull requests of the npins update. Merge these pull requests before that day. The workflow pushes a signed tag YYYY.MM and makes a release of the forge for it. The notes of the release are the titles of the pull requests since the previous release, and a link that tells how to get the SBOM of a node (.forgejo/workflows/release-notes.sh). SECURITY.md tells the release scheme and which releases get fixes.

To make a release out of schedule, for example for a fix of a vulnerability, merge the fix into main, then start the workflow release on main in "Actions" on the forge. The tag is then YYYY.MM.1, YYYY.MM.2, and so on. When the head of main is a release already, the workflow makes no tag. When a run fails after the push of the tag, start the workflow again: it makes the missing release of the forge.

Set up the signing key

Do these steps one time, and again when you replace the key:

  1. Make an SSH key without a passphrase, on a computer that you trust:

    ssh-keygen -t ed25519 -N "" -C "Fediversity release" -f release-signing-key

  2. Add the contents of release-signing-key (the private key) as the secret RELEASE_SIGNING_KEY of the repository: "Settings", "Actions", "Secrets". Then delete the file, or keep it in a password manager.

  3. Select an account of the forge for the releases. Use an account that has no write access to the repository: the forge also accepts the key for SSH access as that account. The account of the releases is fediversity-release. Add release-signing-key.pub to the SSH keys of that account, and verify the key: the forge shows a token, which you sign with the private key.

  4. Add the public key to .forgejo/workflows/release-allowed-signers, on the first line, with an email address of that account. The address <login>@noreply.git.fediversity.eu is applicable:

    <login>@noreply.git.fediversity.eu namespaces="git" ssh-ed25519 AAAA...

    Merge this change into main. The workflow uses that email address as the tagger, thus the forge shows the tags as verified. When you replace a key, keep the old key on a different line with valid-before="<YYYYMMDD>".

The workflow also needs the "Releases" unit of the repository: "Settings", "Units", "Releases".