Separate procedures for both releases.

2 files changed, 146 insertions, 0 deletions

diff --git a/doc/release/monthly.md b/doc/release/monthly.md
new file mode 100644
index 00000000000..1e56e080675
--- /dev/null
+++ b/doc/release/monthly.md
@@ -0,0 +1,76 @@
+# Things to do when creating new monthly minor or major release
+NOTE: This is a guide for GitLab developers. If you are trying to install GitLab see the latest stable [installation guide](install/installation.md) and if you are trying to upgrade, see the [upgrade guides](update).
+
+## Install guide up to date?
+
+* References correct GitLab branch `x-x-stable` and correct GitLab shell tag?
+
+## Make upgrade guide
+
+### From x.x to x.x
+
+#### 0. Any major changes? Database updates? Web server change? File structure changes?
+
+#### 1. Make backup
+
+#### 2. Stop server
+
+#### 3. Do users need to update dependencies like `git`?
+
+#### 4. Get latest code
+
+#### 5. Does GitLab shell need to be updated?
+
+#### 6. Install libs, migrations, etc.
+
+#### 7. Any config files updated since last release?
+
+Check if any of these changed since last release (~22nd of last month depending on when last release branch was created):
+
+* https://github.com/gitlabhq/gitlabhq/commits/master/lib/support/nginx/gitlab
+* https://github.com/gitlabhq/gitlab-shell/commits/master/config.yml.example
+* https://github.com/gitlabhq/gitlabhq/commits/master/config/gitlab.yml.example
+* https://github.com/gitlabhq/gitlabhq/commits/master/config/unicorn.rb.example
+* https://github.com/gitlabhq/gitlabhq/commits/master/config/database.yml.mysql
+* https://github.com/gitlabhq/gitlabhq/commits/master/config/database.yml.postgresql
+
+#### 8. Need to update init script?
+
+Check if changed since last release (~22nd of last month depending on when last release branch was created): https://github.com/gitlabhq/gitlabhq/commits/master/lib/support/init.d/gitlab
+
+#### 9. Start application
+
+#### 10. Check application status
+
+## Make sure the code quality indicatiors are good
+
+* [![build status](http://ci.gitlab.org/projects/1/status.png?ref=master)](http://ci.gitlab.org/projects/1?ref=master) on ci.gitlab.org (master branch)
+
+* [![build status](https://secure.travis-ci.org/gitlabhq/gitlabhq.png)](https://travis-ci.org/gitlabhq/gitlabhq) on travis-ci.org (master branch)
+
+* [![Code Climate](https://codeclimate.com/github/gitlabhq/gitlabhq.png)](https://codeclimate.com/github/gitlabhq/gitlabhq)
+
+* [![Dependency Status](https://gemnasium.com/gitlabhq/gitlabhq.png)](https://gemnasium.com/gitlabhq/gitlabhq) this button can be yellow (small updates are available) but must not be red (a security fix or an important update is available)
+
+* [![Coverage Status](https://coveralls.io/repos/gitlabhq/gitlabhq/badge.png?branch=master)](https://coveralls.io/r/gitlabhq/gitlabhq)
+
+## Make a release branch
+
+After making the release branch new commits are cherry-picked from master. When the release gets closer we get more selective what is cherry-picked.
+
+* 5 days before release: feature freeze
+* 3 days before release: UI freeze
+* 1 day before release: code freeze
+
+# Write a blog post
+
+* Mention what GitLab is on the second line: GitLab is open source software to collaborate on code.
+* Select and thank the the Most Valuable Person (MVP) of this release.
+* Note if there are security fixes: This release fixes an important security issue and we advise everyone to upgrade as soon as possible.
+
+## Last actions
+
+1. Update VERSION and CHANGELOG
+1. Create a git tag vX.X.X
+1. Publish the blog post
+1. Tweet about the release
diff --git a/doc/release/security.md b/doc/release/security.md
new file mode 100644
index 00000000000..68857ea5d9b
--- /dev/null
+++ b/doc/release/security.md
@@ -0,0 +1,70 @@
+# Things to do when doing an out-of-bound security release
+NOTE: This is a guide for GitLab developers. If you are trying to install GitLab see the latest stable [installation guide](install/installation.md) and if you are trying to upgrade, see the [upgrade guides](update).
+
+## When to do a security release
+
+Do a security release when there is a critical issue that needs to be adresses before the next monthly release. Otherwise include it in the monthly release and note there was a security fix in the release announcement.
+
+## Security vulnerability disclosure
+
+Please report suspected security vulnerabilities in private to support@gitlab.com, also see the [disclosure section on the GitLab.com website](http://www.gitlab.com/disclosure/). Please do NOT create publicly viewable issues for suspected security vulnerabilities.
+
+## Release Procedure
+
+1. Verify that the issue can be repoduced
+1. Acknowledge the issue to the researcher that disclosed it
+1. Fix the issue on a feature branch, do this on the private dev.gitlab.org server and update the VERSION and CHANGELOG
+1. Consider creating and testing workarounds
+1. Create feature branches for the blog posts on GitLab.org and GitLab.com and link them from the code branch
+1. Merge the code feature branch
+1. Create a git tag vX.X.X for CE and another one for EE
+1. Push the code and the tags to all the CE and EE repositories
+1. Merge and publish the blog posts
+1. Send tweets about the release from @gitlabhq and @git_lab
+1. Send out an email to the subscribers mailing list on MailChimp
+1. Send out an email to [the community google mailing list](https://groups.google.com/forum/#!forum/gitlabhq)
+1. Send out an email to [the GitLab newsletter list](http://gitlab.us5.list-manage.com/subscribe?u=498dccd07cf3e9482bee33ba4&id=98a9a4992c)
+1. Post a signed copy of our announcement to [oss-security](http://www.openwall.com/lists/oss-security/) and request a CVE number
+1. Add the security researcher to the [Security Researcher Acknowledgments list](http://www.gitlab.com/vulnerability-acknowledgements/)
+1. Thank the security researcher in an email for their cooperation
+1. Update the blogposts when we receive a CVE number
+
+## Blog post template
+
+XXX Security Advisory for GitLab
+
+A recently discovered critical vulnerability in GitLab allows [unauthenticated API access|remote code execution|unauthorized access to repositories|XXX|PICKSOMETHING]. All users should update GitLab and gitlab-shell immediately.
+
+### Version affected
+
+GitLab Community Edition XXX and lower
+GitLab Enterprise Edition XXX and lower
+
+### Fixed versions
+
+GitLab Community Edition XXX and up
+GitLab Enterprise Edition XXX and up
+
+### Impact
+
+On GitLab installations which use MySQL as their database backend it is possible for an attacker to assume the identity of any existing GitLab user in certain API calls. This attack can be performed by [unauthenticated|authenticated|XXX|PICKSOMETHING] users.
+
+### Workarounds
+
+If you are unable to upgrade you should apply the following patch and restart GitLab.
+
+XXX
+
+### Credit
+
+We want to thank XXX of XXX for the reponsible disclosure of this vulnerability.
+
+## Email template
+
+We just announced a security advisory for GitLab at XXX
+
+Please contact us at support@gitlab.com if you have any questions.
+
+## Tweet template
+
+We just announced a security advisory for GitLab at XXX