Bundle release checklist #

This page is for whoever presses "publish" on a bundle. Work through it for every release; a published release cannot be taken back, only followed by the next one.

Contents #

1. Before you start
2. Contents of the bundle
3. Licenses and notices
4. Safety
5. Tests
6. Documentation
7. Publishing

Before you start #

• To do: The next version number is chosen from what is already published (your tags and releases, listed with a version sort: git tag -l 'v*' --sort=version:refname), not from memory.
• To do: The Exponential version is chosen from the published tags, also with a version sort (Versions, tags and pinning).
• To do: Release notes of every Exponential release since your last bundle are read, including upgrade notes.

Contents of the bundle #

• To do: Kernel pinned to a tag (or a recorded commit); composer.lock committed; built with composer install --no-dev.
• To do: Extensions added or removed on purpose and recorded (Adding and removing extensions).
• To do: Site package .ezpkg files are the tested ones, with checksums (Site packages in a bundle).
• To do: Runtime pinned: base image digest, PHP version, Velocity version.
• To do: Autoloads regenerated; no build caches shipped (Caches and autoloads).
• To do: Your version is written into your files in the commit you tag.

Licenses and notices #

• To do: LICENSE, LICENSE.md, COPYRIGHT.md from the shipped version included (License texts and notices).
• To do: Third-party list generated and checked (Third-party components).
• To do: Your own parts have consistent license fields (License fields).
• To do: The corresponding source is published or offered, and the release notes say where (GPL obligations).
• To do: Documentation keeps its GFDL notices (Documentation to ship).

Safety #

• To do: No settings/override/, settings/siteaccess/, kickstart.ini, logs or initial-admin-password from the build.
• To do: No fixed administrator password; hand-over documented (Default credentials).
• To do: No EXP_DEMO_MODE outside demo bundles (Demo mode in bundles).
• To do: Hardened file modes and ownership (File permissions).
• To do: Go-live items a bundle can settle are settled (Security defaults).

Tests #

• To do: Test matrix run and logged (Testing a bundle).
• To do: Upgrade from the previous bundle release tested.
• To do: php bin/php/checkmanifest.php --all result recorded (Integrity checks).
• To do: Working tree clean; the artifact matches the tagged sources.

Documentation #

• To do: Getting started, addresses, password hand-over.
• To do: What is inside, with versions.
• To do: How to update and what the database steps are (Updates and upgrade paths).
• To do: Support boundaries (Support boundaries).
• To do: Changelog with Added, Updated, Removed, Renamed.

Publishing #

• To do: The name and description follow the brand rules (Naming and branding).
• To do: Checksums (SHA256SUMS) published with the artifacts.
• To do: The tag is pushed after every check above passed. Never move, delete or re-cut it afterwards; a mistake is fixed by the next release, with a note about what was wrong.
• To do: The release is announced to your recipients, and, if you are a partner, logged with the partner team (Logging your partner activity).

Related pages #

• Bundle worksheet
• Testing a bundle
• Versions, tags and pinning
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.