Skip to content

Add instructions to the security release developer process

drew stachon requested to merge security-release-issue-instructions into master

I recently had a security patch stretch into the next security release cycle, making my backports one minor-version out of date and effectively skipping the most recent (12.1). I noticed this while adding issue and MR links to the security release issue, but really should have noticed this earlier because I should have added my issue to the release post earlier

I made some additions to the release-process guide for Developers to be very clear about when the security release issue update should happen, and how to make sure it happens correctly. Even if the release bot kicks the update back to me, as it did in this case, the update to the release issue will at least put the fix on the Release Manager's radar, and they can decide that the fix will not be included, rather than potentially leave behind a fix that should be included.

The guidance is written from my very specific perspective, so if there are other additions to this guide or those of the other security roles, they're very welcome here. It might make more sense to have developers update the security issue as soon as they open the Merge Requests, before maintainer approval and release-bot assignment.

Additions

  • Specify the timing of adding a security issue/MR links to the release issue
  • Mention the importance of your backports matching up with the version numbers being specified in the release issue.
Edited by drew stachon

Merge request reports