You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: .agent/workflows/cut-release.md
+16-16Lines changed: 16 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -49,45 +49,45 @@ Focus on `high` and `critical` severity — `moderate` and below can be noted bu
49
49
50
50
If vulnerabilities are found, present them to the user and discuss whether to fix, bump, or acknowledge before proceeding.
51
51
52
+
**Go version bump**: Always check the latest available Go patch version by looking up the [Go downloads page](https://go.dev/dl/) or probing `curl -sI https://go.dev/dl/go<version>.linux-amd64.tar.gz | head -1`. If a newer patch version exists than what `go.mod` currently specifies, propose bumping the `go.mod` Go directive. Include the `go.mod` change in the release commit and use the newer version in the changelog. This ensures the CI Docker image (`golang:1-bookworm`) builds with the latest patched Go version.
53
+
52
54
**⏸️ Present the vulnerability scan results. Wait for user confirmation before proceeding.**
53
55
54
56
### 2. Check dependency freshness
55
57
56
58
Run a dependency audit to identify available updates:
57
59
58
60
```bash
59
-
go list -m -u all 2>&1| grep '\[v'
61
+
go list -mod=mod -m -u all 2>&1| grep '\[v'
60
62
```
61
63
64
+
> [!IMPORTANT]
65
+
> The `-mod=mod` flag is required because Plik vendors its dependencies. Without it, `go list -u` silently fails in vendored projects.
66
+
62
67
Categorize the output:
63
68
-**Direct dependencies** — listed in `go.mod` with no `// indirect` comment
This step is **informational only** — it is not a release blocker. If significant updates are available (especially security-related), discuss with the user whether to address them before the release.
67
-
68
-
> [!TIP]
69
-
> `govulncheck` (from step 1) already flags dependencies with known CVEs. This step complements it by showing all available updates regardless of vulnerability status.
71
+
For each outdated **direct** dependency, check the release notes or changelog for breaking changes or notable behavior changes. Present a summary table of available updates (module, current version, available version, any breaking changes noted) and let the user decide which to bump. After bumping, run `go mod tidy && go mod vendor` and verify the build compiles.
70
72
71
73
**⏸️ Present the dependency audit summary. Wait for user confirmation before proceeding.**
72
74
73
75
### 3. Check build pipeline versions
74
76
75
-
Before starting the release, check if newer versions are available for the base images in the `Dockerfile`:
77
+
Before starting the release, actively check for newer versions of all base images in the `Dockerfile` and propose updates:
76
78
77
-
| Image |Current | Check|
78
-
|-------|---------|-------|
79
-
|`node:<major>-alpine`|`node:24-alpine`|[Node.js releases](https://nodejs.org/en/about/previous-releases) — check for new LTS major |
80
-
|`golang:1-bookworm`|Resolves to latest Go 1.x | Run `docker run --rm golang:1-bookworm go version` to see the current Go version|
81
-
|`alpine:<version>`|`alpine:3.21`|[Alpine releases](https://alpinelinux.org/releases/) — check for new stable|
79
+
| Image |How to check|
80
+
|-------|-------------|
81
+
|`node:<major>-alpine`|Search for the current Node.js LTS schedule. If a newer LTS major exists, propose updating the Dockerfile.|
82
+
|`golang:1-bookworm`|The Go version was already checked in Step 1. Ensure `go.mod` is bumped to the latest patch.|
83
+
|`alpine:<version>`|Search for the latest Alpine stable release. If a newer minor/patch exists, propose updating the Dockerfile.|
82
84
83
-
Also check:
84
-
-`go.mod` Go directive — does it match the Go version from the image?
85
-
- Locally installed Go: `go version`
85
+
**All three must be checked every release.** If any updates are available, propose the Dockerfile changes and include them in the release commit. Do not treat this step as informational — outdated base images should be bumped.
86
86
87
-
If any updates are available, propose a Dockerfile update and include it in the release commit.
87
+
Also verify that the `go.mod` Go directive matches the version that `golang:1-bookworm` will resolve to in CI.
88
88
89
89
> [!TIP]
90
-
> The Go version from this step is needed for the changelog ("Binaries will be built with Go X.Y.Z").
90
+
> The Go version from Step 1 is needed for the changelog ("Binaries will be built with Go X.Y.Z").
91
91
92
92
**⏸️ Present findings to the user. Wait for confirmation before proceeding.**
0 commit comments