Procedure · Engineering Runbook

Cutting a Minor Release Candidate

Audience: Release engineers
Owner: Platform team
Doc ID: PROC-REL-014
Est. time: 25 minutes

1.0Purpose

This procedure produces a signed minor-release candidate build (for example, 2.7.0-rc.1) and stages it for QA verification. Follow it exactly — release candidates created outside this procedure are not accepted into certification.

2.0Before you begin

Prerequisite	How to verify
Release-manager role in the CI system	You can see the Release tab in the pipeline dashboard.
Milestone is code-complete	Zero open issues tagged `blocks-release` in the tracker.
Main branch is green	The last three pipeline runs on `main` passed.
Version bump approved	A product owner has approved the version in the release channel.

Warning Do not cut a candidate while a hotfix is in flight on the previous release branch. Merging order matters — finish the hotfix first or the candidate will miss it.

3.0Procedure

Create the release branch.
From main, create a branch named release/2.7. Use the exact release/<major>.<minor> pattern — the pipeline keys its release behavior off this name.
Bump the version.
Run the version script on the new branch and commit the result:
```
./scripts/bump-version.sh 2.7.0-rc.1
```
The script updates the manifest, changelog stub, and build metadata in one commit. Never edit these files by hand.
Trigger the candidate pipeline.
In the CI dashboard, open Release > New candidate, select the release/2.7 branch, and start the run. The pipeline compiles, signs, and uploads the build (about 15 minutes).
Verify the artifact.
When the run finishes, confirm all three checks on the run summary page:

· Signature check shows VALID
· Artifact version matches 2.7.0-rc.1 exactly
· Smoke-test stage passed
Stage for QA and announce.
Promote the artifact to the QA environment from the run summary, then post the candidate announcement template in the release channel with the build number and changelog link.

Result QA now sees build 2.7.0-rc.1 in their environment and certification begins. Subsequent fixes go to release/2.7 and produce -rc.2, -rc.3, and so on via this same procedure from step 2.

4.0If something goes wrong

Symptom	Likely cause	Action
Pipeline fails at the signing stage	Signing certificate expired	Escalate to Platform on-call. Do not retry — retries consume the build number.
Version mismatch on the artifact	Manual edit to the manifest	Revert the edit, re-run `bump-version.sh`, and start a new pipeline run.
Smoke tests fail	Genuine regression	File a `blocks-release` issue and notify the release channel. The candidate is dead; fix on the release branch and cut `-rc.2`.