Release Process

For Versions 5+

Perform a Milestone, RC or GA Release

NOTE: This release process uses the spring-build-conventions gradle plug-in.

Process Overview

1. Update dependencies
2. Update release version
3. Push the release commit
4. Announce the release on Slack
5. Tag the release
6. Update to next development version
7. Update version on project page
8. Close / Create Milestone
9. Announce the release on other channels

Detailed Steps

1. Update dependencies

• Dependencies are declared in gradle/dependency-management.gradle
• Update Spring Framework and Spring Data at a minimum
• Then find dependencies that need updating by running the following commands:
  • ./gradlew dependencyUpdates -Drevision=release
  • find . -name report.txt | xargs cat > dep-updates.txt
  • cat dep-updates.txt | fgrep ' ->' | sort | uniq

2. Update release version

• Update the version number in gradle.properties for the release, for example, 5.1.0.M1, 5.1.0.RC1, 5.1.0.RELEASE

3. Push the release commit

• Push the release commit and Jenkins will build and deploy the artifacts
• If you would like to be notified when the artifacts are deployed to Maven Central, modify the version in the following script and run it:
  • until http -h --check-status http://repo1.maven.org/maven2/org/springframework/security/spring-security-core/5.1.5.RELEASE/; do sleep 10; done; say "It is now uploaded";

4. Announce the release on Slack

• Announce via Slack on #spring-security and cc Andy Wilkinson, Gary Russell and Artem Bilan

5. Tag the release

• Tag the release and then push the tag

6. Update to next development version

• Update release version to next BUILD-SNAPSHOT version and then push

7. Update version on project page

• Update release version on projects.spring.io

8. Close / Create Milestone

• In GitHub Milestones, create a new milestone for the next release version and move any open issues from the existing milestone you just released to the new milestone and then close the milestone for the release.

9. Announce the release on other channels

• Create a Blog
• Tweet from @SpringSecurity
• Send email to spring-developer@pivotal.io

For Spring Security 4.2.x

• Visit https://build.spring.io/browse/SEC-B42X
• Log In
• Ensure you have admin permissions for the build
• Make sure last build is successful
• Then click on the build number of the last build

• Click the arrow on the left hand side below the details

• Click on Default Job

• Click on Artifactory Release & Promotion

• Fill out the form with the correct values. Use the screenshot below for an example

• Click Build and Release to Artifactory
• A build will start for the release. When it completes (will have "Manual run by ..." next to it) click on the build number

• Click on Artifactory Release & Promotion again
• Fill out form for release

• Click Update. Wait for it to complete.

• Click on Artifactory Build Info

• Invoke the the scripts in scripts/release/ to release with necessary arguments. Get all the secrets from LastPass

$ ./scripts/release/push-to-spring-distributions.sh $BUILD_NUMBER_FROM_BAMBOO
$ ./scripts/release/sync-to-central.sh $RELEASE_VERSION $BINTRAY_API_KEY $SONATYPE_USER_TOKEN $SONATYPE_TOKEN_PWD
$ ./scripts/release/wait-for-done.sh $RELEASE_VERSION

You will get a notification when the release is done.

NOTE: wait-for-done only works if you have spd-say installed.