From 5f7da31a4ecf1aae5df16b9b9d09280cf746b288 Mon Sep 17 00:00:00 2001 From: Levi Durfee Date: Fri, 16 Oct 2026 00:45:54 +0000 Subject: [PATCH] Run CI on development and document the branch workflow development now collects work for the next release, as in the rypt module: CI runs on pushes to it, CONTRIBUTING.md describes the main/development/feature-branch flow and the branch protection, and docs/releasing.md starts a release with a pull request into main. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01NTEjHbdKp83qgQgmqR1BJ6 --- .github/workflows/ci.yml | 2 +- CONTRIBUTING.md | 26 ++++++++++++++++++++++++++ docs/releasing.md | 17 +++++++++++------ 3 files changed, 38 insertions(+), 7 deletions(-) create mode 100644 CONTRIBUTING.md diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 043df80..ea145fd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,7 +2,7 @@ name: CI on: push: - branches: [main] + branches: [main, development] pull_request: permissions: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..3daa2ba --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,26 @@ +# Contributing + +## Branches + +- `main` is what has been released. It changes only through pull requests, + and every release is a tag on it. +- `development` collects the work for the next release. +- Work happens on a short-lived branch from `development`, named for what it + does: `feature/...`, `fix/...`, `docs/...`, `ci/...`. Open a pull request + into `development`, and delete the branch once it is merged. +- A release is a pull request from `development` into `main`, followed by a + tag on `main`; see [docs/releasing.md](docs/releasing.md). If `main` then + has commits `development` lacks, merge `main` back into `development`. +- An urgent fix branches from `main` as `hotfix/...`, merges into `main` and + is released as a patch, and is then merged into `development`. + +Both `main` and `development` are protected: a change needs a pull request +whose `test` and `build` checks pass, and nobody, admins included, can push +to them directly or force-push. + +Keep commits focused, with messages in the imperative. Rebase a branch onto +`development` rather than merging `development` into it. + +## Tests + +See [Development](README.md#development) in the README. diff --git a/docs/releasing.md b/docs/releasing.md index 8fe4523..f11db2f 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -1,5 +1,15 @@ # Releasing rypt +A release is a pull request from `development` into `main` (see +[CONTRIBUTING.md](../CONTRIBUTING.md)). Once it is merged, tag the merge +commit on `main`: + +```sh +git switch main && git pull +git tag -a v1.0.0 -m v1.0.0 +git push origin v1.0.0 +``` + Pushing a tag that starts with `v` runs [.github/workflows/release.yml](../.github/workflows/release.yml). It runs `make vet test race`, builds the six binaries with GoReleaser @@ -8,11 +18,6 @@ binaries, publishes a GitHub release with the binaries, `SHA256SUMS`, and a changelog of the commits since the previous tag, and then updates the Homebrew cask in [x6c-co/homebrew-tap](https://github.com/x6c-co/homebrew-tap). -```sh -git tag -a v1.0.0 -m v1.0.0 -git push origin v1.0.0 -``` - A tag with a pre-release suffix, such as `v1.1.0-rc.1`, is published as a pre-release and leaves the Homebrew cask alone. `rypt version` prints the tag. @@ -21,7 +26,7 @@ output: `rypt-linux-amd64`, `rypt-darwin-arm64`, `rypt-windows-amd64.exe`, and so on. [.github/workflows/ci.yml](../.github/workflows/ci.yml) runs the same tests on -every push to `main` and every pull request, and builds all six targets with +every push to `main` and `development` and every pull request, and builds all six targets with the release configuration, unsigned. To build locally with the release configuration, unsigned, install