sprout/RELEASING.md

Releasing Sprout

This describes how a maintainer cuts a release of Sprout. A release is a signed tag plus a GitHub release that holds the built EFI binaries and their attestations.

The release is built and published by the release workflow, so the release is never visible until its artifacts are attached.

Steps

1. Bump version in the [workspace.package] section of Cargo.toml to the new version, then run ./hack/assemble.sh to update Cargo.lock.

2. Open a pull request with the result. The commit and the PR title are sprout: version x.y.z, which is the one place we do not use a conventional commit. Once squashed, the commit on main is sprout: version x.y.z (#PR_NUMBER).

3. Once the PR has merged, create a signed tag on the merged commit. The tag message is just the tag name.

   git tag -s v0.0.8 -m v0.0.8
   git push origin v0.0.8
   

4. Draft a new release on GitHub for that tag, named after the tag, and click Generate Release Notes. Add a blank line after every section header, as GitHub does not always do that. Do not click Publish.

5. Run the release workflow from the Actions tab, selecting the tag as the ref to run from, and set the Release Tag input to the tag name (for example v0.0.8). The workflow builds the tagged commit, uploads the binaries to the draft release, attests them, and then publishes the release.

Notes

• The release workflow builds the tag, not the branch it was dispatched on, so check the tag points at the version bump commit before running it.
• Re-running the workflow for the same tag replaces the uploaded assets, and runs for one tag never overlap.