BotFramework-WebChat icon indicating copy to clipboard operation
BotFramework-WebChat copied to clipboard
verified publisher icon microsoft

4.15.3 Release checklist

Open compulim opened this issue 3 years ago • 0 comments

Checklist

Build

  1. [x] ~Bump MockBot to Bot Framework SDK release 4.15.3~ (not needed for patch release)
    • https://www.npmjs.com/package/botbuilder/v/latest
  2. [x] ~Bump botframework-directlinejs to x.y.z~ (no newer version)
  3. [x] Bump to 4.15.3
    • [x] Update CHANGELOG.md to mark specific changes in 4.15.3
    • [x] Run npm version --no-git-tag-version 4.15.3
    • [x] Merged into main, the PR number is #4389
    • Commit is 5cd632b
    • Do not merge any other unrelated changes after this PR. Any other PR merged, will need to be re-tested
  4. [x] Run daily pipeline manually, set "generate release version number" to true
    • (This will not push to NPM or CDN)
    • Pipeline name is BotFramework-WebChat-daily
    • The build number is 316361 and commit is 5cd632bc
  5. [x] Wait for WebChat-release-testing pipeline to complete
    • Pipeline name is Push-Release-Testing-to-GitHub-Pages
    • The release ID is 418
  6. [x] Check component governance and make sure there are no high/critical related to code under /packages/ folder
    • There could be some for projects under /samples/ folder, as they are pointing to previous version of Web Chat
  7. [x] Add manual tests to WebChat-release-testing as needed

Test

The test should run against the build artifacts from Azure Pipelines.

  1. [x] Manual testing on major browsers using webchat-release-testing
    • [x] Before starting testing, update all the browser version to latest
    • [x] Chrome 104.0.5112.81
    • [x] Edge 106.0.1346.0
    • [x] Firefox 103.0.2
    • [x] IE11 (Windows 11 22H2 22622.450)
    • [x] macOS Safari 15.5 (17613.2.7.1.8)
    • [x] iOS Safari 15.5
    • [x] Android Chrome 104.0.5112.69
  2. [x] Test specific fixes related to 4.15.3 and previous releases

Release

  1. [x] Verify on WebChat-release-testing
  2. [x] Make sure you are on main ~or qfe~ branch, run git status to check
  3. [x] git pull
  4. [x] Verify /package.json, /package-lock.json, and CHANGELOG.md has a version of 4.15.3
  5. [x] git log
    • Verify the latest commit is 5cd632b
  6. [x] git tag v4.15.3
  7. [x] git push -u upstream v4.15.3
    • You do not need to kick off a build again, use the previous build
  8. [x] Create a new GitHub release, copy entries from CHANGELOG.md
    • [x] Subresource Integrity can be generated by
      • From local: cat webchat.js | openssl dgst -sha384 -binary | openssl base64 -A
      • From CDN: curl -H 'Accept-Encoding: gzip' https://cdn.botframework.com/botframework-webchat/4.15.3/webchat.js | gunzip - | openssl dgst -sha384 -binary | openssl base64 -A
    • [x] Attach assets including 3 JS files, stats.json and 5 tarballs
      • You can copy the artifacts from webchat-release-testing/drops
      • Tarballs download from npmjs 
        curl -LO https://registry.npmjs.org/botframework-directlinespeech-sdk/-/botframework-directlinespeech-sdk-4.15.3.tgz
curl -LO https://registry.npmjs.org/botframework-webchat/-/botframework-webchat-4.15.3.tgz
curl -LO https://registry.npmjs.org/botframework-webchat-core/-/botframework-webchat-core-4.15.3.tgz
curl -LO https://registry.npmjs.org/botframework-webchat-api/-/botframework-webchat-api-4.15.3.tgz
curl -LO https://registry.npmjs.org/botframework-webchat-component/-/botframework-webchat-component-4.15.3.tgz
  9. [x] Kick off release to NPM
    • Release name is [[PROD]]Push-WebChat-to-npmjs
    • The build number is 316361 release number is 40 and commit is 5cd632bc
    • [x] Verify package content then click Resume
    • [x] Retain the release indefinitely
  10. [x] Kick off release to CDN (cutoff at 2PM PST, Mon-Thu only)
    1. [x] Prepare the email for approval
      • [x] If there are any breaking changes, explain in the email if it will affect any customers
      • Release name is [[PROD]]Push-WebChat-to-Prod-CDN-with-approval
      • The build number is 316361, release number is 43 and commit is 5cd632bc
      • Script build number is 131156 (this is fixed)
    2. [x] Send reminder email to approvers
    3. [x] Retain the build indefinitely

Post-release verification - complete within 30 minutes after release to NPM

  • [x] Test using webchat-release-testing
    1. [x] Clone https://github.com/corinagum/WebChat-release-testing/
    2. [x] 01.create-react-app
      1. [x] Nuke 01.create-react-app/node_modules
      2. [x] npm install
      3. [x] npm install [email protected] (just install the bundle package)
      4. [x] npm run build
    3. [x] Others
      • Using script tags from https://github.com/microsoft/BotFramework-WebChat/releases/tag/v4.15.3, with subresource integrity 
        <script
  crossorigin="anonymous"
  integrity="sha384-"
  src="https://cdn.botframework.com/botframework-webchat/4.15.3/webchat.js"
></script>

<script
  crossorigin="anonymous"
  integrity="sha384-"
  src="https://cdn.botframework.com/botframework-webchat/4.15.3/webchat-es5.js"
></script>

<script
  crossorigin="anonymous"
  integrity="sha384-"
  src="https://cdn.botframework.com/botframework-webchat/4.15.3/webchat-minimal.js"
></script>
    4. [x] npx serve (at repo root)
    5. [x] Go to http://localhost:5000/ to test, including IE11

Notification to interested parties

  • [x] Update partner page on Adaptive Cards doc
    • https://docs.microsoft.com/en-us/adaptive-cards/resources/partners
    • PR at https://github.com/MicrosoftDocs/AdaptiveCards/pull/XXX
  • [x] Notify related parties for the following fixes
    • [x] SDK team
    • [x] Omnichannel
    • [x] Pooja/Zhipeng
  • [x] ~Update root README.md with feature notes -- Note: PR will be combined with post-release checklist PR~

Post-release checklist

These are chores that we should do before starting the cycle to reduce ripple effects if we do it in mid-cycle.

Tips:

  • Clean your repo before start
  • Remove node_modules from all folder
    • git clean -fdx
  • Never delete package-lock.json
  • If you mess it up, tableflip and redo
  • In component/package.json
    • Remove reference to botframework-webchat-core by hand-modifying package.json
    • Then, npm install (symlinks will be broken afterward)
    • Then, add those references back by hand-modifying package.json
    • This also applies for other packages with similar dependencies/symlinks
    • To build afterward, do tableflip to rebuild those symlinks

Applies to all releases

This list should be copied to versions in the future.

  • [x] ~If on QFE branch, make sure CHANGELOG.md and version number bump is cherry-picked to main~
    • [x] ~git checkout main~
    • [x] ~git cherry-pick XXX (the commitish for bumping version number and CHANGELOG.md)~
  • [x] ~If needed, correct the date for 4.15.3 in CHANGELOG.md in PR #XXX~
    • ~There could be last minute fixes that could push the planned date later than the one in CHANGELOG.md~
  • [x] Bump package.json to 4.15.4-0 in PR #4391
    • Run npm version prepatch --no-git-tag-version
  • [x] Update servicingPlan.json in PR #4391
    • Add deprecation notes for previous versions
    • Subresource integrity hash from https://github.com/microsoft/BotFramework-WebChat/releases/tag/v4.15.3
  • [x] ~Update all samples to use 4.15.3 in PR #XXXX~
    • Some samples are pointing to GitHub Releases because the sample need new features from daily build
    • Search "https://github.com/microsoft/BotFramework-WebChat/releases/download/"
      • And replace with "https://cdn.botframework.com/botframework-webchat/latest/"
  • [x] ~Clean up unnecessary branch on official repo~
  • [x] Understand production-hitting vulnerabilities
    • [x] Create a new folder
    • [x] Run npm init with default values
    • [x] Run npm install [email protected]
    • [x] Look at the result and see if there are any production-hitting vulnerabilities, investigate if needed
      • No vulnerabilities found
  • [ ] Bump in Power Virtual Agents

Applies to major/minor releases

Bump all dependencies to latest version

In PR #4392, we are bumping most dependencies to latest version.

After bumping, if a package broke compatibility, we should investigate:

  • Upgrade our code to use the latest package if possible, otherwise;
  • Add it to package.json/skipBump to prevent bumping deliberately:
    • Skipping bump incur unpredictable technical debts, say, security issue found in the unsupported version, causing us slow to react
    • Plausible reasons (non-exhaustive):
      • Package is not ES5;
      • Package is ESM and requires the whole dependency chain to be upgraded, however, it is technically impossible (unrelated to cost).
  • [x] Run npm run bump
  • [x] Run npm audit fix to make sure everything is fixed
  • [x] Test under IE11 to make sure all dependencies are working
  • [ ] List steps to verify bumping microsoft-cognitiveservices-speech-sdk

Obstacles to bump npm

Check if the followings are still valid. We should bump to npm@latest ([email protected]) as soon as possible.

As of writing, [email protected] (bundled by node@16) has issue on running postinstall script.

[email protected] is peer-depends on @angular/common, which npm@7 will automatically install missing peer dependencies. Track the issue here.

Update CI/CD pipeline to use latest images

Some pipelines are still using windows-2016 image which will be deprecated soon, we need to update them.

Bump Docker image

The Docker image can be found at root docker-compose.yml and Dockerfile*.

  • [x] ~Docker container for headless Chrome (#XXX)~
    • They recently moved from 3.14.159-xxx tag scheme to a more sensible 87.0 tag scheme
    • Tags can be found at https://hub.docker.com/r/selenium/node-chrome/tags
    • Preferably in separate PR because screenshots change can be large occasionally
    • Run tests locally, as the screenshots can be slightly different
    • Also consider bumping to Edge-based images

compulim avatar Aug 10 '22 20:08 compulim