Feature: automated semver releases

[azeemshaikh38]

We use a webhook to create stable docker images when a release test run successfully completes. Similarly we should have a webhook, such that when prod cron job completes successfully, we use semver specification to automatically create a new tag and release. On a high-level this is what the webhook needs to do:

• We'll create and maintain a Scorecard GitHub app whose token/keys will be used for automated signing of tags/commits.
• Use the latestTag of Scorecard repo and the commitSHA of the successful run to get all commits in-between.
• Depending on the commit message headings (:sparkles:, :bug:, :book: etc.) decide whether to increase the PATCH version or the MINOR version. MAJOR version changes will be done manually and need not be handled through the webhook.
• Create a new tag in compliance with semver semantic and push this new tag to Scorecard repo. This should trigger a new release and our work is done.

https://github.com/go-git/go-git might come in handy for doing the Git operation in Golang.

[laurentsimon]

how do we handle automated release notes?

[azeemshaikh38]

There was a discussion about automated release note generation, can't seem to find the issue/thread for it. Gist was that Kubernetes does something like this already, so we could do it too. @naveensrinivasan may know more about this.

But, to your point, yes we should also consider adding support for automated release note generation also. Let's create a separate issue for automated release note generation? Scope of the issue can be:

• come up with a release template
• automate the generation of this template
• make this part of the release workflow

[laurentsimon]

My main concern/question is how we automate release notes that are human-consumable. A list of merged PRs is not very eligible for human. Unless we think it's overkill for minor releases. wdut?

[azeemshaikh38]

Sorry it was not Kubernetes, but sigstore/cosign - https://github.com/sigstore/cosign/releases, released by sigstore-bot. Like you said, the release notes should be human readable not just changelog. And it is possible to automate it that way.

[github-actions[bot]]

Stale issue message

[justaugustus]

There was a discussion about automated release note generation, can't seem to find the issue/thread for it. Gist was that Kubernetes does something like this already, so we could do it too. @naveensrinivasan may know more about this.

My team manages this tool: https://github.com/kubernetes/release/tree/master/cmd/release-notes Here are some examples of output from the tool:

• https://github.com/kubernetes/release/releases/tag/v0.12.0
• https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md

While I haven't personally used it, the tool also supports supplying your own go template to enable further formatting.

One thing to note is that it expects a code-fenced block in the PR description (with release-note as the code type):

A really great human-readable release note

The idea here being that while we can't always expect the commit history to be perfect (maybe lacking convention or from a new contributor with multiple commits that need squashing), as maintainers we have access to edit the PR descriptions to ensure the release-note is does a reasonable job describing the change.

Some examples: https://github.com/kubernetes/release/pull/2370, https://github.com/kubernetes/release/pull/2330, https://github.com/kubernetes/release/pull/2326

Similar to how PR titles are validated here, in several Kubernetes repos we automatically block PRs without either:

• A release-block that is populated
• A release-block that has NONE as the text

[justaugustus]

As for releasing:

• https://github.com/goreleaser/goreleaser
• https://github.com/goreleaser/goreleaser-action
• GoReleaser + cosign: https://github.com/goreleaser/goreleaser/issues/2659

[azeemshaikh38]

@justaugustus would the work that you are doing on #1677 make it feasible to generate automated release notes?