Document release instructions

[znewman01]

CC @asraa who was interested in having another minor release version cut.

I realized that I don't actually know how to cut a release (or whether I have the appropriate permissions).

@rdimitrov , I think you cut the last one---if you try to outline the instructions quickly in this issue, I can go through them to troubleshoot, and then I'll add the instructions to docs/MAINTAINERS.md.

[joshuagl]

AFAIK everything should happen automatically when a tag matching the format v* is pushed.

• Pushing the tag triggers the CI workflow

  go-tuf/.github/workflows/ci.yml

  Line 7 in 0d40b25

  - "v*"

• which in turn triggers the release workflow

  go-tuf/.github/workflows/ci.yml

  Line 14 in 0d40b25

  if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')

  go-tuf/.github/workflows/ci.yml

  Line 20 in 0d40b25

  if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')

• which runs goreleaser

  go-tuf/.github/workflows/release.yml

  Lines 25 to 30 in 0d40b25

  	- name: Run GoReleaser
  	uses: goreleaser/goreleaser-action@68acf3b1adf004ac9c2f0a4259e85c5f66e99bef
  	with:
  	distribution: goreleaser
  	version: "v1.7.0"
  	args: release --config ./.goreleaser/${{ inputs.cli-name }}.yml --rm-dist

[znewman01]

Oh, excellent.

That leaves two questions:

1. Who has/should have the privileges to push a tag?
2. What is the process for deciding to cut a release?

[joshuagl]

Anyone with write access to the repository can push tags at present. We might want to set up protected tags in future, though.

I don't think we have a formal process for when to cut a release today. There's a project board building to the next release, but I'm OK with inserting a release sooner. Especially as @asraa needs one.

Let's go ahead and make a release.

[znewman01]

Great! I pushed v0.3.1: https://github.com/theupdateframework/go-tuf/tree/v0.3.1

I will keep an eye on it, and document something reflecting this process before resolving this issue.

[trishankatdatadog]

The release process and changelog is excellent. Thanks, everyone, especially @rdimitrov