OWASP Threat Modeling: release process

The steps used during the release process, including release candidates

Note that the build process will not run if the version is only Major.Minor, for example 2.6,
and it needs to be in form Major.Minor.Patch, for example 2.6.1

## Create release candidate

Before a release it is required that a release candidate version is created.
This allows the Threat Dragon community to review and feedback on the proposed release.
Changes that are agreed for the release should then be made available with a further release candidate.

For example if RC1, but change for RC2 and so on :

1. `git clone git@github.com:OWASP/threat-dragon.git`
2. `cd threat-dragon`
3. update version, for example `"version": "2.6.1-RC1",`, in `td.vue/package.json`
4. ensure `buildState` in `td.vue/package.json` is "" (empty)
5. update version, for example `"version": "2.6.1-RC1",`, in `package.json` and `td.server/package.json`
6. update package lock files: `npm install`
7. `npm run build`
8. `npm test`
9. `npm run test:vue`
10. ensure that the package-lock files are up to date using `npm install`
11. `git add --all; git status`
12. sign the commit: `git commit -S -m"release candidate 2.6.1-RC1"; git status`
13. check for a good 'git' commit: `git verify-commit <sha from commit>`
14. `git push`
15. tag and sign the release `git tag -s v2.6.1-RC1`
16. check for a good 'git' signature : `git verify-tag v2.6.1-RC1`
17. `git push origin v2.6.1-RC1` && `git status`

repeat as necessary for further release candidates.

The github release workflow will then create the release candidate along with the install images

Ensure the release candidate is announced on the [OWASP Threat Dragon][td-slack] slack channel
and any other relevant channels

Reset the build state to 'latest'; this is displayed on the demo site:

1. revert `buildState` in `td.vue/package.json` back to `-latest`
2. revert version, for example `"version": "2.6.1",`, in `td.vue/package.json`,
    in `package.json` and `td.server/package.json`
3. ensure that the package-lock files are up to date using `npm install`
4. `git add --all; git status`
5. sign the commit: `git commit -S -m"set build version back to latest"`
6. check for a good 'git' commit: `git verify-commit <sha from commit>`
7. `git push`

## Create the release

### Tag the release

After the releases candidate has been agreed by the Threat Dragon community, a release version can be prepared:

1. `git clone git@github.com:OWASP/threat-dragon.git`
2. `cd threat-dragon`
3. update version eg `"version": "2.6.1",` in `package.json`, `td.vue/package.json` and `td.server/package.json`
4. update `buildState` in `td.vue/package.json` away from `"-latest"` to `""` (empty)
5. update package lock files: `npm install`
6. `npm run build`
7. `npm test`
8. `npm run test:vue`
9. ensure documentation is clean: `pyspelling --config .spellcheck.yaml` and `markdownlint-cli2  docs/**/*.md`
10. update the version in `title:` for the docs in file `docs/_config.yml`
11. ensure all package-lock files are up to date using `npm install`
12. `git add --all; git status`
13. sign the commit: `git commit -S -m"release version 2.6.1"`
14. check for a good 'git' commit: `git verify-commit <sha from commit>`
15. `git push` and wait for commit pipeline actions to complete
16. tag and sign the release `git tag -s v2.6.1`
17. check for a good 'git' signature : `git verify-tag v2.6.1`
18. `git push origin v2.6.1` && `git status`

The github release workflow automatically creates the draft release and the install images

### Publish docker image

Ensure the tag now exists within the [Threat Dragon Docker hub][td-dock].
Do this after logging into an active Docker account using `docker login` from the CLI and running Docker Desktop.

1. once tagged, the github workflow pushes the docker image to docker hub
2. pull image for an X86 platform using `docker pull --platform linux/x86_64 threatdragon/owasp-threat-dragon:v2.6.1`
3. pull image for an ARM platform using `docker pull --platform linux/arm64 threatdragon/owasp-threat-dragon:v2.6.1-arm64`
4. Test using the command to run a detached container:
    `docker run -d -p 8080:3000 -v $(pwd)/.env:/app/.env threatdragon/owasp-threat-dragon:v2.6.1`
5. Test the ARM container as well:
    `docker run -d -p 8080:3000 -v $(pwd)/.env:/app/.env threatdragon/owasp-threat-dragon:v2.6.1-arm64`
6. Ideally test these releases on Windows, linux and MacOS using `http://localhost:8080/#/`

If the image tests correctly, promote the docker image from dockerhub `threatdragon/`
to dockerhub `OWASP/threat-dragon/v2.6.1` and `OWASP/threat-dragon/v2.6.1-arm64`.
Note that the docker account (eg `threatdragon`) must have write permissions to the OWASP area of docker hub.

There is _no going back_ on these steps, so they are deliberately left as manual tasks:

```text
docker pull --platform linux/x86_64 threatdragon/owasp-threat-dragon:v2.6.1
docker tag threatdragon/owasp-threat-dragon:v2.6.1 owasp/threat-dragon:stable
docker push owasp/threat-dragon:stable
docker pull owasp/threat-dragon:stable

docker pull --platform linux/arm64 threatdragon/owasp-threat-dragon:v2.6.1-arm64
docker tag threatdragon/owasp-threat-dragon:v2.6.1-arm64 owasp/threat-dragon:v2.6.1-arm64
docker push owasp/threat-dragon:v2.6.1-arm64
docker pull owasp/threat-dragon:v2.6.1-arm64

docker pull --platform linux/x86_64 threatdragon/owasp-threat-dragon:v2.6.1
docker tag threatdragon/owasp-threat-dragon:v2.6.1 owasp/threat-dragon:v2.6.1
docker push owasp/threat-dragon:v2.6.1
docker pull owasp/threat-dragon:v2.6.1
```

Ensure the tag now exists within the [OWASP Docker hub][owasp-dock].
Do the (x86_64) `v2.6.1` last so that is shown as the latest one

### Check demo site

1. Install [Heroku CLI tools][herokucli] if necessary
2. Login to [Heroku][heroku]
3. Inspect logs using `heroku logs --app=threatdragon-v2 --tail`
4. Ensure no rollback shown in [dashboard][herokudash]
5. Observe correct version running for the [Heroku app][herokuapp]
6. Check correct version for the [demo site][demo]

### Checksum for Linux desktop AppImage

Download desktop AppImage for Linux `Threat-Dragon-ng-2.6.1.AppImage` and the `latest-linux.yml` auto-update checksum file.

Create SHA512 `checksum-linux.yml` file:

 ```bash
grep sha512 latest-linux.yml | tail -n 1 | cut -d " " -f 2 | base64 -d |  \
    hexdump -ve '1/1 "%.2x"' > checksum-linux.yml
echo -n " Threat-Dragon-ng-2.6.1.AppImage" >> checksum-linux.yml
```

Check correct using: `sha512sum --check checksum-linux.yml`
and upload `checksum-linux.yml` file to the release area.

### Check Snap images

Ensure that Threat Dragon is updated on [Snapcraft][snapcraft],
also accessible using [Ubuntu One][ubuntu].

Check the release is current on the [dashboard][snapdash],
if necessary use the dashboard to promote the latest release to 'stable'.

The token used in the Threat Dragon release pipeline is 'SNAPCRAFT_TOKEN' and this has to be refreshed annually.
Use commands to refresh creds:

- `snapcraft login`
- `