If there is a security problem, the hotfix pipeline is as follows:
Create a milestone for a patch version.
Create an issue describing the security problem.
Fix the problem.
Close the issue.
Push.
Tag the resulting automatic commit, or after making human-readable changes.
If it is truly a very important security issue, it should be closed as soon as possible and a release made as soon as possible. I suggest an additional flag that allows a user to immediately perform work and release a fixed version, like so:
Fix the problem.
Push.
Tag the resulting automatic commit, or after making human-readable changes.
Preferred Solutions
The way to differentiate should be through the commit message: [hotfix] (configurable). When the script sees this, it should increment the patch version instead of using whatever was in the .github-changelog-generator file.
Workarounds
It's possible to add [skip-log] if using our skip-commit tool and manually manage the changelog, but that's not automated enough 😉!
Related to Problem
If there is a security problem, the hotfix pipeline is as follows:
If it is truly a very important security issue, it should be closed as soon as possible and a release made as soon as possible. I suggest an additional flag that allows a user to immediately perform work and release a fixed version, like so:
Preferred Solutions
The way to differentiate should be through the commit message:
[hotfix]
(configurable). When the script sees this, it should increment the patch version instead of using whatever was in the.github-changelog-generator
file.Workarounds
It's possible to add
[skip-log]
if using ourskip-commit
tool and manually manage the changelog, but that's not automated enough 😉!