PrivateBin Release Automation

[elrido]

I would like to simplify the release process for PrivateBin, which would then lower the barrier (for me) to release more frequently. I don't think it makes sense to go for a fixed schedule, but after new features get added, libraries updated (for example by dependabot) we could release these more rapidly.

Working towards this doesn't have to be done in a big risky step, but if you agree with the goal, we could incrementally work towards this.

Here are some of the pain points that make releases a manual and difficult process:

• Getting the CHANGELOG.md & CREDITS.md updated, because neither dependabot / crowdin pull request nor human submitted ones do update these. We can't easily fix this with the bots, but could make it a policy for submitted PRs to ask for these files to be updated, if it makes sense.
• Having to write a release note blog post - Sure, I'll usually copy-paste most of the previous release post, but still takes up to an hour to double check the textual change descriptions etc. I would like to limit these long form posts to major and security critical releases and skip these for the smaller patch releases. In the future we could maybe set up some automation that raises a PR in the blog-project with a templated release note including mostly the change log entries, but no free form prose?
• Having to manually update the version in the container image and helm chart projects. We can probably automate this to raise the relevant PRs over in these projects, whenever a release is tagged in the main PrivateBin project.
• Signing the release - We use a script for that and gpg keys, so we could automate this if the keys (and/or the password to unlock it) would get stored in a github secret. This is not too much of a hassle, I'd be fine with keeping this a manual step for now.

Longer term, with the above changes, cuttting a release could become as simple as pushing a signed tag into the master branch. We could let automation handle the creation of github release notes and PRs in the related projects.

Would anyone have an issue with any of the above changes? How do you learn about new PrivateBin releases? Is it an issue if we stopped releasing blog posts on privatebin.info (and it's RSS feed) or do you primarily use github notifications or container image related automation to get notified and PrivateBin updated?

[rugk]

We can't easily fix this with the bots

Depends. There is release-please, which seems to be the successor of standard-version (deprecated now), both generate changelogs out of commits, but you need to write conventional commits then.

[elrido]

Asking submitters to update the changelog in the PRs or using a certain style of commit messages is a policy thing that needs policing. And both would allow us to automate a step in the release process. I assume it is easier to get people to update the changelog rather having them rewrite commit messages. I'd even be willing to do the changelog update myself, right after merging someone elses change, when I still have a good understanding what that change included. In general I think all these things are not hard to do, just require a little diligence.

In any case, I take it that you don't mind if we gave this a try? No long form blog posts on smaller patch releases?

[rugk]

Yeah no, we could squatch commits, but I also don't like this.