Update release process

Makefile

@@ -88,10 +88,15 @@ clean-workhorse:
 	$(call message,$@)
 	rm -f $(EXE_ALL)
 
-.PHONY:	release
-release:
+.PHONY:	tag
+tag:
 	$(call message,$@)
-	sh _support/release.sh
+	sh _support/tag.sh
+
+.PHONY:	signed_tag
+signed_tag:
+	$(call message,$@)
+	TAG_OPTS=-s sh _support/tag.sh
 
 .PHONY:	clean-build
 clean-build:

PROCESS.md

@@ -19,11 +19,14 @@ The final merge must be performed by a maintainer.
 New versions of Workhorse can be released by one of the Workhorse
 maintainers. The release process is:
 
-- create a merge request to update CHANGELOG and VERSION on the
-  respective release branch (usually `master`)
-- make sure the new version number adheres to our [versioning standard](#versioning)
-- merge the merge request
-- run `make release` on the release branch
+-   pick a release branch. For x.y.0, use `master`. For all other
+    versions (x.y.1, x.y.2 etc.) , use `x-y-stable`. Also see [below](#versioning)
+-   create a merge request to update CHANGELOG and VERSION on the
+    release branch
+-   merge the merge request
+-   run `make tag` or `make signed_tag` on the release branch. This will
+    make a tag matching the VERSION file.
+-   push the tag to gitlab.com
 
 ## Versioning
 

_support/release.sh → _support/tag.sh

 set -e
 
-remotes='https://gitlab.com/gitlab-org/gitlab-workhorse.git'
-
 main() {
   get_version
   tag_name="v${version}"
-  git tag -m "Version ${version}" -a ${tag_name}
+  git tag $TAG_OPTS -m "Version ${version}" -a ${tag_name}
   git show ${tag_name}
-  echo
-  echo "Does this look OK? Enter 'yes' to push to ${remotes}"
-  read confirmation
-  if [ "x${confirmation}" != xyes ] ; then
-    echo "Aborting"
-    exit 1
-  fi
-  for r in ${remotes}; do
-    git push "${r}" HEAD ${tag_name}
-  done
+  cat <<'EOF'
+
+  Remember to now push your tag, either to gitlab.com (for a
+  normal release) or dev.gitlab.org (for a security release).
+EOF
 }
 
 get_version() {