Commit 4c234f6266a for nodejs
commit 4c234f6266aa6b2af4bdd392f5244f86a5a6a0c4
Author: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Date: Sat Oct 31 18:25:28 2026 +0100
doc: remove CI lockdown steps from security releases
The CI is no longer locked down for security releases. The pre-release
paragraph describing the lockdown procedure was already dropped from
releases.md in nodejs/node#64198, but the release day steps and two
inline notes still told stewards and releasers to wait for it.
Remove the remaining references:
* Drop 'Lock down the CI' and 'Unlock the CI' from the release day
checklist in security-release-process.md and renumber the steps.
* Drop the note in releases.md telling releasers not to run CI on
nodejs-private pull requests until the lockdown.
* Drop the security release details block under the CI step that
deferred to the lockdown coordinated with the Build Working Group.
Refs: https://github.com/nodejs/node/pull/64198
Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/67116
Refs: https://github.com/nodejs/build/pull/4355
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md
index f10407720f3..9663c594d73 100644
--- a/doc/contributing/releases.md
+++ b/doc/contributing/releases.md
@@ -341,9 +341,6 @@ known, additionally include `CVE-ID: CVE-XXXX-XXXXX` in the commit metadata.
Make sure to sign and push to resulting commit to the private repository and not
the public one.
-**Note**: Do not run CI on the PRs in `nodejs-private` until CI is locked down.
-You can integrate the PRs into the proposal without running full CI.
-
</details>
### 2. Create a new branch for the release
@@ -714,15 +711,6 @@ A number of the modules tested by CitGM are not completely
reliable so differences shown by the comparison are not immediately cause
for concern.
-<details>
-<summary>Security release</summary>
-
-If there are private security patches, do not run any CI jobs on the proposal
-until CI has been locked down. The security steward should be coordinating this
-with the Build Working Group.
-
-</details>
-
#### 7.1 Updating the release _(optional)_
Sometimes a release might be deferred to the subsequent day due to several
diff --git a/doc/contributing/security-release-process.md b/doc/contributing/security-release-process.md
index 7444707774f..07e75bf2481 100644
--- a/doc/contributing/security-release-process.md
+++ b/doc/contributing/security-release-process.md
@@ -147,20 +147,14 @@ security announcements for more information.
## Release day
-* [ ] 1\. **Lock down the CI:**
- * Lock down the CI to prevent public access to the CI machines, ping a member of `@nodejs/jenkins-admins`.
-
-* [ ] 2\. **Release:**
+* [ ] 1\. **Release:**
* Verify the CI is green on all release proposals (test-V8, CITGM, etc).
* Follow the [release process](https://github.com/nodejs/node/blob/main/doc/contributing/releases.md).
-* [ ] 3\. **Unlock the CI:**
- * Unlock the CI to allow public access to the CI machines, ping a member of `@nodejs/jenkins-admins`.
-
-* [ ] 4\. **Publish Post-Release Blog Post:**
+* [ ] 2\. **Publish Post-Release Blog Post:**
* Publish the post-release blog post on the `nodejs/nodejs.org` repository.
-* [ ] 5\. **Notify the community:**
+* [ ] 3\. **Notify the community:**
* Notify the community that the security release has gone out:
* [ ] Slack: `#nodejs-social`
* [ ] [docker-node](https://github.com/nodejs/docker-node/issues)