This is not about the specification of semver itself (which is crystal clear), but rather about the best approach to implement it within a development pipeline when building libraries.
TL;DR: who/what sets the version and deploys the artifacts, and when?
We're planning to opensource some of our internal Maven-based GitHub-hosted Java libs as they might be useful for others. What we currently have:
- CI pipeline via GitHub Actions, running the tests on PRs going to
master, as well as
masterdirectly each time it's updated.
Now, what's the best approach to update the version and deliver the artifacts? I can see several:
Being "release-driven": each time a GitHub Release is manually created via the GitHub UI (github.com/owner/repo/releases), another pipeline starts, reads and fetches the created tag, runs
mvn deploy(put simply). The actual committed POM's version then doesn't need to change, e.g. can stay at
Being "merge-driven": each time a PR is merged to
master, roughly the same pipeline as above triggers, but uses the version of the POM (or auto increments the patch number by default, or something along those lines). A corresponding GitHub Release then needs to be created, either automatically or manually I guess.
Being entirely manual: some dev needs to
mvn deploymanually after having dealt with the versioning and the release somehow.
How do people proceed out there? Is there one best approach? For our internal services and libs, a successful merge to
master increments some version number and triggers a deployment, but is it the right approach if we want to follow semver strictly?
And because semver gives sense to versions, I guess it cannot be entirely automatic, can it? I believe some human must need to know and tell the system whether the coming release is a patch, a minor or a major one?
One case to keep in mind as well, is when a change (for instance a security patch) needs to be backported to an older version that is still maintained.
I originally asked this question on opensource.stackexchange.com, but I noticed it wasn't really related to OSS, but rather semver, so I'm trying my luck here instead.