docs: add RELEASE.md

CHANGELOG.md

@@ -5,12 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+We follow semver.  More notes about versioning and our release policies are [here](./RELEASE.md).
+
+Legend:
+
+* 🛠 - BREAKING CHANGE.  Action is required if you use this functionality.
+* ✨ - Noteworthy change to aware of.
+
 ## [Unreleased]
 
 ## [0.8.0] - 2023-04-05
 ### Added
 
-- Migrated repositories into Boxo
+- ✨ Migrated repositories into Boxo (https://github.com/ipfs/boxo/pull/220)
   - github.com/ipfs/interface-go-ipfs-core => ./coreiface
   - github.com/ipfs/go-pinning-service-http-client => ./pinning/remote/client
   - github.com/ipfs/go-path => ./path
@@ -35,16 +42,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - github.com/ipfs/go-unixfs => ./ipld/unixfs
   - github.com/ipfs/go-merkledag => ./ipld/merkledag
   - github.com/ipld/go-car => ./ipld/car
-- Added a migration tool to aid in migrating from the migrated repositories to Boxo, see the documentation here: https://github.com/ipfs/boxo/blob/main/README.md#migrating-to-boxo
+- ✨ Added a migration tool to aid in migrating from the migrated repositories to Boxo, see the documentation here: https://github.com/ipfs/boxo/blob/main/README.md#migrating-to-boxo (https://github.com/ipfs/boxo/pull/226)
   - Added a check to ensure the migration tool is only run in a Git repository (with an optional override flag)
-- Added tracing and metrics to the refactored gateway for its IPFS backend
+- ✨ Added tracing and metrics to the refactored gateway for its IPFS backend
 
 
 ### Changed
 
 - Removed a mention of "bitswap" in blockservice debug logs
-- Changed the Bitswap message package from "bitswap.message.pb" to "bitswap.message.v1.pb" to avoid protobuf panics due to duplicate registration with [go-bitswap](https://github.com/ipfs/go-bitswap)
-- Remove a busyloop in blockservice getBlocks by removing batching when caching
+- Changed the Bitswap message package from "bitswap.message.pb" to "bitswap.message.v1.pb" to avoid protobuf panics due to duplicate registration with [go-bitswap](https://github.com/ipfs/go-bitswap) (https://github.com/ipfs/boxo/pull/212)
+- ✨ Remove a busyloop in blockservice getBlocks by removing batching when caching (https://github.com/ipfs/boxo/pull/232)
 
 ### Deprecated
 
@@ -56,9 +63,9 @@ None
 
 ### Fixed
 
-- Ensure dag-cbor/json codecs are registered in the gateway handler
-- Refactor the Gateway API to operate on higher level semantics
-- Fixed a panic in the gateway handler when returning errors
+- Ensure dag-cbor/json codecs are registered in the gateway handler (https://github.com/ipfs/boxo/pull/223)
+- ✨ Refactor the Gateway API to operate on higher level semantics (https://github.com/ipfs/boxo/pull/176)
+- Fixed a panic in the gateway handler when returning errors (https://github.com/ipfs/boxo/pull/255)
 
 ### Security
 

README.md

@@ -97,6 +97,9 @@ We recommend upgrading to v0.8.0 first, and _then_ upgrading to the latest Boxo
 
 If you encounter any challenges, please [open an issue](https://github.com/ipfs/boxo/issues/new/choose) and Boxo maintainers will help you.
 
+## Deprecations & Breaking Changes
+See [RELEASE.md](./RELEASE.md).
+
 ## Should I add my IPFS component to Boxo?
 We happily accept external contributions! However, Boxo maintains a high quality bar, so code accepted into Boxo must meet some minimum maintenance criteria:
 
@@ -122,7 +125,7 @@ If you have questions, feel free to open an issue. You can also find the Boxo ma
 See [CODEOWNERS](./docs/CODEOWNERS) for the current maintainers list.  Governance for graduating additional maintainers hasn't been established.  Repo permissions are all managed through [ipfs/github-mgmt](https://github.com/ipfs/github-mgmt).
 
 ## Release Process
-To be documented: https://github.com/ipfs/boxo/issues/170
+See [RELEASE.md](./RELEASE.md).
 
 ## Related Items
 * [Initial proposal for "Consolidate IPFS Repositories" that spawned this project](https://github.com/ipfs/kubo/issues/8543)

RELEASE.md

@@ -0,0 +1,92 @@
+# Boxo Releases
+
+## Release Policies
+### Breaking Changes
+TLDR: APIs may break between changes.
+
+There are two kinds of breaking changes to consider:
+
+1. **API refactors/changes**. There is equivalent functionality, but the API has changed. Generally adapting to these changes is trivial, and release notes will contain information about how to adapt.
+
+1. **Removal of a module or functionality**. In this case, Boxo maintainers will deprecate the relevant types in at least one release prior to their removal, and users will be forewarned in release notes. We strive to remove functionality as rarely as possible.
+
+We know that breaking changes may cause short-term pain, and we only make breaking changes when we believe the long-term gain is much greater than the short-term pain.
+
+Feedback from users helps us in this determination, so *please* provide feedback on any GitHub issues or PRs that may affect you, and let us know when we're wrong! We believe there's *a lot* of innovation and growth for IPFS in the future, so we don't want Boxo to ossify.
+
+### Versioning
+Boxo only releases minor and patch versions, and has no plans to change major versions from v0.
+
+Minor versions contain new or removed functionality, or significant changes in dependencies.
+
+Patch versions contain "fixes", which are generally small, targeted, and involve limited changes in functionality (such as bug fixes, security fixes, etc.). 
+
+### Backporting
+The amount of backporting of a fix depends on the severity of the issue and the impact on users. Most non-critical fixes won't be backported.
+
+As a result, Boxo maintainers recommend that consumers stay up-to-date with Boxo releases.
+
+### Go Compatibility
+At any given point, the Go team supports only the latest two versions of Go released (see https://go.dev/doc/devel/release). Boxo maintainers will strive to maintain compatibilty with the older of the two supported versions, so that Boxo is also compatible with the latest two versions of Go.
+
+### Release Criteria
+Boxo releases occur _at least_ on every Kubo release. Releases can also be initiated on-demand, regardless of Kubo's release cadence, whenever there are significant changes (new features, refactorings, deprecations, etc.).
+
+The [release process](#release-process) below describes how maintainers perform a release.
+
+Boxo may release on Fridays or even weekends. This is in contrast to Kubo, which does not release on Fridays since it is a deployable binary, to avoid weekend surprises.
+
+### Testing
+Boxo maintainers are in the process of moving tests into Boxo from Kubo (see [#275](https://github.com/ipfs/boxo/issues/275)) . Until that's done, Boxo releases rely on Kubo tests for extra confidence. So releases must plumb Boxo into Kubo and ensure its tests pass. See [Release Process](#release-process) for details.
+
+### Changelogs
+Boxo loosely follows the [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) format. New commits should add changelog entries into the `[Unreleased]` section so that there is no changelog scramble when a new version needs to be released.
+
+We intend to use the standardized changelog to automate releases by onboarding with [Changelog Driven Release](https://github.com/pl-strflt/changelog-driven-release) (see [#269](https://github.com/ipfs/boxo/issues/269)).
+
+### Related Work
+Below are links of related/adjacent work that has informed some of the decisions in this document:
+1. https://github.com/ipfs/boxo/issues/170
+2. https://pl-strflt.notion.site/Kubo-Release-Process-5a5d066264704009a28a79cff93062c4
+3. https://github.com/ipfs/kubo/blob/master/docs/RELEASE_ISSUE_TEMPLATE.md
+
+## Release Process
+1. Create an issue for the version: https://github.com/ipfs/boxo/issues/new?title=Release+X.Y.Z (can be blank for now)
+2. Pin the issue
+3. Copy-paste the following checklist into the description:
+
+- [ ] Verify your [GPG signature](https://docs.github.com/en/authentication/managing-commit-signature-verification) is configured in local git and GitHub
+- [ ] Ensure Boxo and Kubo are checked out on your system
+- [ ] Create a release branch called `release-vX.Y.Z` and push it
+  * Use `master` as base if `Z == 0`
+  * Use `release` as base if `Z > 0`
+- [ ] Tidy the changelog and push any changelog changes to `release-vX.Y.Z`
+- [ ] Create a draft PR merging `release-vX.Y.Z` into `release`
+  - [ ] Name it "Release vX.Y.Z"
+  - [ ] Reference this release issue
+- [ ] If `Z > 0`, then cherry-pick the necessary commits from `master` into `release-vX.Y.Z` using `git cherry-pick -x <commit>`
+- [ ] Ensure Boxo tests are passing
+- [ ] Ensure Kubo tests are passing
+  - [ ] Go to Kubo dir and run `go get github.com/ipfs/boxo@<commit_hash>` using the commit hash of the `release-vX.Y.Z` branch
+  - [ ] Run `go mod tidy` in repo root and in `docs/examples/kubo-as-a-library`
+  - [ ] Commit the changes and open a draft PR in Kubo
+  - [ ] Name the PR "Upgrade to Boxo vX.Y.Z"
+  - [ ] Paste a link to the Kubo PR in the Boxo PR, so reviewers can verify the Kubo test run
+  - [ ] Verify the CI passes
+- [ ] Add a commit in `release-vX.Y.Z` bumping the version in `version.json` to `vX.Y.Z`
+- [ ] Add a "release" label to the Boxo PR
+- [ ] After the release checker creates a draft release, copy-paste the changelog into the draft
+- [ ] Wait for approval from another Boxo maintainer
+- [ ] Merge the PR into `release`, _using "Create a Merge Commit"_, and do not delete the `release-vX.Y.X` branch
+  - [ ] Verify the tag is created
+- [ ] Announce the release
+  - [ ] Create an [IPFS Discourse](https://discuss.ipfs.tech) topic
+    - [ ] use `Boxo vX.Y.Z is out!` as the title
+    - [ ] use `boxo` as the topic
+    - [ ] repeat the title as a heading (`##`) in the description
+    - [ ] link to the GitHub Release and release notes in the description
+- [ ] Create a PR merging `release` into `main`
+  - [ ] Name it "Merge release vX.Y.Z"
+  - [ ] Wait for approval
+  - [ ] Merge it _using "Create a Merge Commit"_, and do not delete the `release` branch
+- [ ] Update the Kubo PR to use the newly released version, mark it as "Ready for Review", get approval, and merge into Kubo