> ## Documentation Index
> Fetch the complete documentation index at: https://grandcentral.backbase.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Release workflow

> Production release publishing for AI agents

The release workflow publishes production releases when a GitHub release is published, building and publishing artifacts with full quality gates enabled.

The production release workflow:

* **Trigger**: When a GitHub release is published (not draft)
* **Build and Publish**: Full build with all quality gates enabled
* **Artifact Publishing**: Packages and Docker images published to registries
* **Quality Checks**: SonarQube, Promptfoo, and Redteam tests

## Workflow flowchart

```mermaid theme={"system"}
%%{init: {
  'theme': 'base',
  'themeVariables': {
    'primaryColor': '#ffffff',
    'primaryBorderColor': '#295eff',
    'primaryTextColor': '#091c35',
    'lineColor': '#091c35',
    'secondaryColor': '#f3f6f9',
    'tertiaryColor': '#ebf0f5',
    'fontFamily': 'Libre Franklin, sans-serif'
  }
}}%%
flowchart TD
    Start([GitHub release<br/>published]) --> CheckDraft{Is<br/>draft?}
    CheckDraft -->|Yes| End([End])
    CheckDraft -->|No| BuildPublish[Build and publish workflow<br/>Full quality gates enabled]
    BuildPublish --> Setup[Setup project]
    Setup --> CheckPin[Check action pinning]
    CheckPin --> CodeQuality[Code quality checks<br/>pylint, pytest, hadolint]
    CodeQuality --> SetupPromptfoo[Setup Promptfoo]
    SetupPromptfoo --> PromptfooEval[Promptfoo evaluation]
    PromptfooEval --> Redteam[Redteam testing]
    Redteam --> Sonar[SonarQube analysis]
    Sonar --> Build[Build Docker image]
    Build --> Security[Security check<br/>Trivy image scan]
    Security --> Push[Push Docker image<br/>to Azure ACR]
    Push --> End([Release published])
```

## Workflow configuration

The production release workflow is defined in `.github/workflows/release.yaml`:

```yaml theme={"system"}
name: Release
on:
    release:
        types:
            - published

permissions:
    contents: read

jobs:
    publish:
        name: Publish new version ${{ github.event.release.tag_name }}
        if: github.event.release.draft == false
        uses: backbase-common/gc-ai-workflows/.github/workflows/build-publish.yaml@main
        secrets: inherit
        with:
            timeout: 600
            enableSonar: true
            sourcePath: "src/"
            enablePromptfoo: true
            promptfooConfig: "promptfoo_config/*.yaml"
            enableRedteam: true
            redteamConfig: "redteam.yaml"
            redteamNumTests: "5"
```

## Release process

### 1. Release publication

When a GitHub release is published:

* The workflow is automatically triggered
* Only non-draft releases trigger the workflow
* The workflow uses the release tag name for versioning

### 2. Build and publish

The workflow uses the reusable `build-publish.yaml` workflow with:

* **Full Quality Gates**: All quality checks enabled
* **SonarQube**: Code quality and security analysis
* **Promptfoo**: LLM prompt evaluation
* **Redteam**: Security and adversarial testing
* **Docker Build**: Container image building
* **Security Scan**: Trivy vulnerability scanning
* **Publish**: Artifacts published to Azure Container Registry

### 3. Artifact publishing

The workflow publishes:

* **Docker Images**: Tagged with release version
* **Packages**: Agent packages published to registry
* **Quality Reports**: SonarQube and test reports

## Release artifacts

The release workflow creates and publishes:

<CardGroup cols={2}>
  <Card title="Agent packages" icon="box">
    Compiled and packaged agent artifacts
  </Card>

  <Card title="Docker images" icon="docker">
    Containerized agent images tagged with release version
  </Card>

  <Card title="Quality reports" icon="chart-bar">
    SonarQube and test reports
  </Card>

  <Card title="Security reports" icon="shield-check">
    Trivy security scan results
  </Card>
</CardGroup>

## Publishing a release

### Steps

1. **Create Release Draft**: Use the [release draft workflow](/agentic-ai/ci-cd-workflows/release-draft-workflow) to create a draft
2. **Review Release**: Review the release draft and release notes
3. **Edit if Needed**: Update release notes or version if necessary
4. **Publish Release**: Click "Publish release" in GitHub
5. **Workflow Triggers**: Production release workflow automatically starts
6. **Monitor Build**: Watch the workflow execution
7. **Verify Artifacts**: Confirm artifacts are published successfully

## Configuration

### Quality gates

All quality gates are enabled for production releases:

* **SonarQube**: `enableSonar: true`
* **Promptfoo**: `enablePromptfoo: true`
* **Redteam**: `enableRedteam: true`

### Timeout

The workflow has a 600-minute (10-hour) timeout to accommodate full quality checks.

## Reusable components used

This workflow uses:

* **build-publish.yaml**: Main reusable workflow that orchestrates the entire build and publish process
* All quality check actions (SonarQube, Promptfoo, Redteam)
* Docker build and push actions
* Security scanning actions

See the [Reusable Components](/agentic-ai/ci-cd-workflows/reusable-components) page for detailed documentation.

## Best practices

* **Review Before Publish**: Always review release drafts before publishing
* **Quality Checks**: Ensure all quality gates pass in release draft
* **Version Verification**: Verify version numbers are correct
* **Release Notes**: Include comprehensive release notes
* **Testing**: Test release artifacts before deploying

## Troubleshooting

### Release failures

Common issues:

1. **Build Failures**: Review build logs for compilation errors
2. **Quality Gate Failures**: Address SonarQube, Promptfoo, or Redteam issues
3. **Security Scan Failures**: Fix critical vulnerabilities
4. **Docker Build Issues**: Check Dockerfile and dependencies
5. **Publish Errors**: Verify Azure ACR credentials and permissions

### Verification

* Check workflow logs in GitHub Actions
* Verify Docker images in Azure Container Registry
* Review SonarQube reports
* Check security scan results

## Next steps

* [Learn about release draft creation](/agentic-ai/ci-cd-workflows/release-draft-workflow)
* [Understand hotfix releases](/agentic-ai/ci-cd-workflows/hotfix-release-workflow)
* [Review CI/CD overview](/agentic-ai/ci-cd-workflows/overview)