Release v0.7.4 checklist

[matthewfeickert]

Release Checklist

Before Release

• Update the checklist Issue template in the .github/ISSUE_TEMPLATE directory if there are revisions.
• Migrate any unresolved Issues or PRs from the release GitHub project board to a new project board.
  • c.f. https://github.com/orgs/scikit-hep/projects/13
• Verify that there is a release notes file for the release under docs/release-notes.
  • c.f. docs: Add v0.7.4 release notes #2322
• Verify that the release notes files correctly summarize all development changes since the last release.
• Add any new use citations or published statistical models to the Use and Citations page.
  • c.f. docs: Add ATLAS s-channel single top cross-section statistical model record #2324
• Verify that the citations on the Use and Citations page are up to date with their current INSPIRE record. Checking the Dimensions listing of publication citations can be helpful to catch citations that are now journal publications.
  • c.f. docs: Update citations references with journal pubs through 2023-08 #2323
• Update the codemeta.json file in the release PR if its requirements have updated.
• Update the pypa/gh-action-pypi-publish GitHub Action used for deployment to TestPyPI and PyPI to the latest stable release.
• Make a release to TestPyPI using the workflow dispatch event trigger.
  • c.f. https://test.pypi.org/project/pyhf/0.7.4.dev6/
• Verify that the project README is displaying correctly on TestPyPI.
• Draft email to pyhf-announcements mailing list that summarizes the main points of the release notes and circulate it for development team approval.

Create Release Tag

For a video walkthrough consult the pyhf v0.7.1 release recording on YouTube.

• Use the bump version GitHub Actions workflow perform a dry run of the bump version to the new release tag.
• Check the annotated tag in the dry run workflow logs to make sure it looks correct.
• If the dry run passes as expected, run the same workflow with the dry run option set to false to bump the release tag version and push the new tag back to GitHub.
• Verify the release tag was pushed to the correct branch.
• Verify the release tag commit has bumped the correct versions.
• Watch the CI to verify all tag based jobs finish correctly.
• Verify the release for the tag on TestPyPI looks correct.
  • c.f. https://test.pypi.org/project/pyhf/0.7.4/

After Release Tag Pushed To GitHub

• Create a GitHub release from the new release tag and copy the release notes published to the GitHub release page. The creation of the GitHub release triggers all other release related activities.
  • Before pasting in the release notes copy the changes that the GitHub bot has already queued up and pasted into the tag and place them in the "Changes" section of the release notes. If the release notes are published before these are copied then they will be overwritten and you'll have to add them back in by hand.
  • Create a corresponding announcement GitHub Discussion for the release.
  • c.f. v0.7.4 #2326
• Watch the CI to ensure that the deployment to PyPI is successful.
  • c.f. https://pypi.org/project/pyhf/0.7.4/
• Verify Docker images with the correct tags have been deployed to all container image registries.
  • Docker Hub
  • OSG Harbor (crane cp docker.io/pyhf/pyhf:v0.7.4 hub.opensciencegrid.org/pyhf/pyhf:v0.7.4)
  • CERN Harbor (crane cp docker.io/pyhf/pyhf:v0.7.4 registry.cern.ch/pyhf/pyhf:v0.7.4)
• Verify there is a new Zenodo DOI minted for the release.
  • Verify that the new release archive metadata on Zenodo matches is being picked up as expected from CITATION.cff.
• Verify that a Binder has properly built for the new release.
• Watch for a GitHub notification that there is an automatic PR to the Conda-forge feedstock. This may take multiple hours to happen. If there are any changes needed to the Conda-forge release make them from a personal account and not from an organization account to have workflows properly trigger.
  • Verify the requirements in the Conda-forge feedstock recipe meta.yaml match those in pyproject.toml.
  • c.f. pyhf v0.7.4 conda-forge/pyhf-feedstock#20

After Release

• Verify that the release is installable from both PyPI and Conda-forge.
• Send the drafted pyhf-announcements email out from the pyhf-announcements account email.
  • c.f. https://groups.google.com/g/pyhf-announcements/c/jHv_5KkLnGA
• Tweet the release out on both personal and team Twitter accounts.
  • https://x.com/pyhf_/status/1702702124369379328?s=20
• Forward port the release notes and bumpversion information from the release branch to the default branch.
  • c.f. PR docs: Bump version: 0.7.1 → 0.7.2 #2217 and PR docs: Add v0.7.2 release notes #2218 as examples from pyhf v0.7.2.
  • docs: Add v0.7.4 release notes #2330
  • docs: Bump version: 0.7.3 → 0.7.4 #2331
• Announce the release on the Scikit-HEP community Gitter.
• Make a release for the pyhf tutorial corresponding to the previous release number. This release represents the last version of the tutorial that is guaranteed to work with previous release API.
  • c.f. https://github.com/pyhf/pyhf-tutorial/releases/tag/v0.7.3
• Update the tutorial to use the new release number and API.
• Make a PR to use the new release in the CUDA enabled Docker images.
• Open a ticket on the CERN Software Process and Infrastructure JIRA to update the version of pyhf available in the next LCG release.
  • c.f. the v0.7.3 request ticket as an example.
  • c.f. https://sft.its.cern.ch/jira/browse/SPI-2419
• Make a MR to use the new release in ATLAS StatAnalysis.
• Close the release GitHub Project board.

[matthewfeickert]

Issues with using environments for deployments to PyPI using v*

are coming from changes in GitHub's security covered in https://github.com/orgs/community/discussions/62991#discussioncomment-6718696

[matthewfeickert]

Issues with using environments for deployments to PyPI using v*

This is resolved now as the environment protection rules now apply to branches and tags

cc @kratsg.

This was resolved on October 3rd, 2023:

• https://github.com/orgs/community/discussions/62991#discussioncomment-7233691
• October 6, 2024 GitHub Blog: Actions – Secure deployment rollouts to protected environments based on select tag patterns