question about releases all going to master

[andmer]

Hi All,
Question for community if anyone has a chance to clarify for me in gitflow usage and workflow, I'd appreciate it!

New to gitflow, How am I thinking about this wrong, where to properly insert the QA/certification process before finishing a release to master?

Scenario is as follows:

• 1.0.0 is head of "master" branch -- current deployed in production
• git flow release start 1.1.0 (1.1.0 is new release branch off of "develop")
• git flow release finish 1.1.0 (1.1.0 is deemed feature complete) and is merged and tagged into "master"
• CI/CD picks up new tag release and builds new artifact for 1.1.0 that goes to QA
• QA rejects the 1.1.0 release (bugs xyz)
• git flow hotfix start 1.1.1 (work begins clearing up the rejected bugs)
• Emergency hotfix is suddenly needed for 1.0.0, currently deployed production release, but I have no way to hotfix this because I've already merged in 1.1.0 which was rejected.

How do I not to get into this state? Should CI not listen to "master" but instead listen to "release/*" to build final artifacts?

It feels wrong because those "release/*" branches get deleted when "master" git flow finish occurs and also it has no merge into "master".

If you recompile and archive a new artifact for deployment after "release/*" artifact is approved and finished into master, it is not the same binary that was approved, it is a new artifact altogether, which feels wrong too.

[petervanderdoes]

QA should be done on a release branch.

You are technically correct that it is not the same binary that was approved but nothing changed between the release and master when it's merged into master.

if you need to supported multiple versions you can use the support branch for different versions, ie 1.x and 2.x, and master branch would be the latest version.

[andmer]

Thanks for the response Peter, much appreciated! But when you merge to master, recompile and ship the output, you just hope its the same as what was certified in QA from the release branch cut from develop?

[petervanderdoes]

You can always do a final QA on master but TBH I think that is overkill, The code hasn't changed, the compiler hasn't changed, so it should be all the same.

[andmer]

what if you hotfix master after you start but before you finish next release? the product of this merge on finish is different than what QA certified. hmmm.

[andmer]

i suppose you must make sure you manually merge master in the release for final certification or be forced to recertify before "release finish" because if there is a gap between "hotfix finish" going to "master" and "develop" the "release" will not get it from usual workflow of "hotfix finish"

maybe that make sense as a solution?