Open-Source Branching & Releases (Open Source)

Regular releases#

All releases come from the dev branch. The DefectDojo team aims to maintain the following cadence:

• Minor releases: at least once a month on the first Monday of the month.
• Patch releases: every week on Monday.
• Security releases: may be cut outside of our regular cadence depending on severity. They also come from dev.

There is no separate branch for bug fixes and no hotfix branch off master. Every pull request, bug fix or feature, targets dev.

GitHub Actions are the source of truth. The releases are semi-automated. The steps for every release are:

1. Create the release branch from dev and prepare a PR against master (details) –> A maintainer verifies and manually merges the PR
2. Tag, issue draft release and docker build+push (details) –> A maintainer massages the release-drafter notes and publishes the release
3. A PR to merge master back to dev is created to re-align the branches (details)

Security releases#

PRs that relate to security issues are done through security advisories which provide a way to work privately on code without prematurely disclosing vulnerabilities.

Release model#

Diagrams created with plantUML. Find a web-based editor for PlantUML at https://www.planttext.com.

</div>