Skip to content

doc: remove CI lockdown steps from security releases #67116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nodejs-github-bot merged 1 commit into from
Oct 31, 2026
+3 −21
Merged

doc: remove CI lockdown steps from security releases #67116

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 0 additions & 12 deletions doc/contributing/releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -341,9 +341,6 @@ known, additionally include `CVE-ID: CVE-XXXX-XXXXX` in the commit metadata.
Make sure to sign and push to resulting commit to the private repository and not
the public one.

**Note**: Do not run CI on the PRs in `nodejs-private` until CI is locked down.
You can integrate the PRs into the proposal without running full CI.

</details>

### 2. Create a new branch for the release
Expand Down Expand Up @@ -714,15 +711,6 @@ A number of the modules tested by CitGM are not completely
reliable so differences shown by the comparison are not immediately cause
for concern.

<details>
<summary>Security release</summary>

If there are private security patches, do not run any CI jobs on the proposal
until CI has been locked down. The security steward should be coordinating this
with the Build Working Group.

</details>

#### 7.1 Updating the release _(optional)_

Sometimes a release might be deferred to the subsequent day due to several
Expand Down
12 changes: 3 additions & 9 deletions doc/contributing/security-release-process.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,20 +147,14 @@ security announcements for more information.

## Release day

* [ ] 1\. **Lock down the CI:**
* Lock down the CI to prevent public access to the CI machines, ping a member of `@nodejs/jenkins-admins`.

* [ ] 2\. **Release:**
* [ ] 1\. **Release:**
* Verify the CI is green on all release proposals (test-V8, CITGM, etc).
* Follow the [release process](https://github.com/nodejs/node/blob/main/doc/contributing/releases.md).

* [ ] 3\. **Unlock the CI:**
* Unlock the CI to allow public access to the CI machines, ping a member of `@nodejs/jenkins-admins`.

* [ ] 4\. **Publish Post-Release Blog Post:**
* [ ] 2\. **Publish Post-Release Blog Post:**
* Publish the post-release blog post on the `nodejs/nodejs.org` repository.

* [ ] 5\. **Notify the community:**
* [ ] 3\. **Notify the community:**
* Notify the community that the security release has gone out:
* [ ] Slack: `#nodejs-social`
* [ ] [docker-node](https://github.com/nodejs/docker-node/issues)
Expand Down
Loading