From 44cdf656a338039e491082d91f96082b545a88eb Mon Sep 17 00:00:00 2001 From: Jon Gadsden Date: Mon, 28 Oct 2024 09:38:17 +0000 Subject: [PATCH] release version 2.3.0-RC1 --- README.md | 3 +- package-lock.json | 4 +-- package.json | 2 +- release-process.md | 67 +++++++++++++++++++++++++++---------- td.server/package-lock.json | 4 +-- td.server/package.json | 2 +- td.vue/package-lock.json | 4 +-- td.vue/package.json | 2 +- 8 files changed, 60 insertions(+), 28 deletions(-) diff --git a/README.md b/README.md index 72b06b5b2..361553590 100644 --- a/README.md +++ b/README.md @@ -152,7 +152,7 @@ There are some [developer notes][notes] to help get started with this project. We are trying to keep the test coverage relatively high so include tests in your pull requests. The easiest way to get in contact with the Threat Dragon community is via the OWASP Slack -[#project-threat-dragon](https://owasp.slack.com/messages/CURE8PQ68) project channel +[#project-threat-dragon][td-slack] project channel (you may need to [subscribe](https://owasp.org/slack/invite) first). ### Vulnerability disclosure @@ -180,3 +180,4 @@ Threat Dragon: _making threat modeling less threatening_ [owasp]: https://www.owasp.org [project]: https://owasp.org/www-project-threat-dragon [releases]: https://github.com/OWASP/threat-dragon/releases +[td-slack]: https://owasp.slack.com/messages/CURE8PQ68 diff --git a/package-lock.json b/package-lock.json index 59b860351..c5864cea0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "threat-dragon", - "version": "2.2.0", + "version": "v2.3.0-RC1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "threat-dragon", - "version": "2.2.0", + "version": "v2.3.0-RC1", "hasInstallScript": true, "license": "Apache-2.0", "devDependencies": { diff --git a/package.json b/package.json index 84041e34d..148ec0a86 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "threat-dragon", - "version": "2.2.0", + "version": "v2.3.0-RC1", "private": true, "scripts": { "audit": "npm-run-all -c audit:server audit:site", diff --git a/release-process.md b/release-process.md index 39d62bc60..c263824cf 100644 --- a/release-process.md +++ b/release-process.md @@ -1,42 +1,71 @@ The steps used during the release process +## Release candidate + +Before a release it is required that a release candidate version is created. +This allows the Threat Dragon community to review and feedback on the proposed release. +Changes that are agreed for the release should then be made available with a further release candidate. + +1. `git clone git@github.com:OWASP/threat-dragon.git` +2. `cd threat-dragon` +3. update version, for example `"version": "2.3.0-RC1",`, in `package.json`, `td.site/package.json` and `td.server/package.json` +4. ensure `buildState` in `td.vue/package.json` is `-latest` +5. update package lock files: `npm install` +6. `npm run build` +7. `npm test` +8. `npm run test:vue` +9. `git add --all; git status` +10. `git commit -m"release version 2.3.0-RC1"` +11. `git push` +12. tag the release `git tag v2.3.0-RC1` +13. `git push origin v2.3.0-RC1` + +repeat as necessary for further release candidates. + +The github release workflow will then create the release candidate along with the install images + +Ensure the release candidate is announced on the [OWASP Threat Dragon][td-slack] slack channel +and any other relevant channels + ## Tag the release +After the releases candidate has been agreed by the Threat Dragon community, a release version can be prepared: + 1. `git clone git@github.com:OWASP/threat-dragon.git` 2. `cd threat-dragon` -3. update version eg `"version": "2.2.0",`, in `package.json`, `td.site/package.json` and `td.server/package.json` -4. update `buildState` in `td.vue/package.json` away from `-demo`, usually '' +3. update version eg `"version": "2.3.0",`, in `package.json`, `td.site/package.json` and `td.server/package.json` +4. update `buildState` in `td.vue/package.json` away from `-latest` to '' 5. update package lock files: `npm install` 6. `npm run build` 7. `npm test` 8. `npm run test:vue` 9. `git add --all; git status` -10. `git commit -m"release version 2.2.0"` +10. `git commit -m"release version 2.3.0"` 11. `git push` -12. tag the release `git tag v2.2.0` -13. `git push origin v2.2.0` +12. tag the release `git tag v2.3.0` +13. `git push origin v2.3.0` The github release workflow then creates the draft release and the install images ### Publish docker image 1. once tagged, the github workflow pushes the docker image to docker hub -2. check using `docker pull threatdragon/owasp-threat-dragon:v2.2.0` +2. check using `docker pull threatdragon/owasp-threat-dragon:v2.3.0` 3. Test using the command to run a detached container: - `docker run -d -p 8080:3000 -v $(pwd)/.env:/app/.env threatdragon/owasp-threat-dragon:v2.2.0` + `docker run -d -p 8080:3000 -v $(pwd)/.env:/app/.env threatdragon/owasp-threat-dragon:v2.3.0` 4. Ideally test this release on Windows, linux and MacOS using `http://localhost:8080/#/` If the image tests correctly, promote the docker image -from dockerhub `threatdragon/` to dockerhub `OWASP/threat-dragon/v2.2.0`. +from dockerhub `threatdragon/` to dockerhub `OWASP/threat-dragon/v2.3.0`. There is _no going back_ on this last step, so it is deliberately left as a manual task: ```text -docker pull --platform linux/x86_64 threatdragon/owasp-threat-dragon:v2.2.0 -docker tag threatdragon/owasp-threat-dragon:v2.2.0 owasp/threat-dragon:v2.2.0 -docker push owasp/threat-dragon:v2.2.0 -docker pull owasp/threat-dragon:v2.2.0 -docker tag owasp/threat-dragon:v2.2.0 owasp/threat-dragon:stable +docker pull --platform linux/x86_64 threatdragon/owasp-threat-dragon:v2.3.0 +docker tag threatdragon/owasp-threat-dragon:v2.3.0 owasp/threat-dragon:v2.3.0 +docker push owasp/threat-dragon:v2.3.0 +docker pull owasp/threat-dragon:v2.3.0 +docker tag owasp/threat-dragon:v2.3.0 owasp/threat-dragon:stable docker push owasp/threat-dragon:stable ``` @@ -67,9 +96,9 @@ grep sha512 latest.yml | head -n 2 | tail -n 1 | cut -d ":" -f 2 | base64 -d | - Confirm SHA512 with: ```text -echo "$(cat checksum-linux.yml) Threat-Dragon-ng-2.2.0.AppImage" | sha512sum --check -echo "$(cat checksum-mac.yml) Threat-Dragon-ng-2.2.0.dmg" | sha512sum --check -echo "$(cat checksum.yml) Threat-Dragon-ng-Setup-2.2.0.exe" | sha512sum --check +echo "$(cat checksum-linux.yml) Threat-Dragon-ng-2.3.0.AppImage" | sha512sum --check +echo "$(cat checksum-mac.yml) Threat-Dragon-ng-2.3.0.dmg" | sha512sum --check +echo "$(cat checksum.yml) Threat-Dragon-ng-Setup-2.3.0.exe" | sha512sum --check ``` - upload `checksum*.yml` files @@ -82,7 +111,7 @@ Edit the 'What's Changed' to filter out any chores. Then update the release notes for the draft in the [Threat Dragon release area][area] using the release notes using markdown provided by `.release-note-template.md` as a template, -making sure to revise `2.x.x` to the correct version number such as `2.2.0` +making sure to revise `2.x.x` to the correct version number such as `2.3.0` Promote the release from draft to public once everything is in place @@ -90,7 +119,8 @@ Promote the release from draft to public once everything is in place Update the [releases tab][releases] and the [info pane][td-info] on the OWASP Threat Dragon project pages. -Finally ensure Threat Dragon announces the new release, for example on the OWASP slack channels +Finally ensure Threat Dragon announces the new release on the [OWASP Threat Dragon][td-slack] slack channel +and any other relevant channels [area]: https://github.com/OWASP/threat-dragon/releases [heroku]: https://id.heroku.com/login @@ -98,3 +128,4 @@ Finally ensure Threat Dragon announces the new release, for example on the OWASP [herokudash]: https://dashboard.heroku.com/apps [releases]: https://github.com/OWASP/www-project-threat-dragon/blob/main/tab_releases.md [td-info]: https://github.com/OWASP/www-project-threat-dragon/blob/main/info.md +[td-slack]: https://owasp.slack.com/messages/CURE8PQ68 diff --git a/td.server/package-lock.json b/td.server/package-lock.json index bbef3ab8e..f6b08aba5 100644 --- a/td.server/package-lock.json +++ b/td.server/package-lock.json @@ -1,12 +1,12 @@ { "name": "threat-dragon-server", - "version": "2.2.0", + "version": "v2.3.0-RC1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "threat-dragon-server", - "version": "2.2.0", + "version": "v2.3.0-RC1", "license": "Apache-2.0", "dependencies": { "@babel/runtime": "^7.21.0", diff --git a/td.server/package.json b/td.server/package.json index bf44d6294..a0ad776d1 100644 --- a/td.server/package.json +++ b/td.server/package.json @@ -1,6 +1,6 @@ { "name": "threat-dragon-server", - "version": "2.2.0", + "version": "v2.3.0-RC1", "private": true, "scripts": { "audit": "npm audit", diff --git a/td.vue/package-lock.json b/td.vue/package-lock.json index 79b065d5f..ee9a99204 100644 --- a/td.vue/package-lock.json +++ b/td.vue/package-lock.json @@ -1,12 +1,12 @@ { "name": "threat-dragon", - "version": "2.2.0", + "version": "v2.3.0-RC1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "threat-dragon", - "version": "2.2.0", + "version": "v2.3.0-RC1", "license": "Apache-2.0", "dependencies": { "@antv/x6": "^2.18.1", diff --git a/td.vue/package.json b/td.vue/package.json index 8b6b54bab..61934e831 100644 --- a/td.vue/package.json +++ b/td.vue/package.json @@ -1,7 +1,7 @@ { "name": "threat-dragon", "productName": "Threat Dragon", - "version": "2.2.0", + "version": "v2.3.0-RC1", "private": true, "scripts": { "audit": "npm audit",