docs: add release checklist (#104)

Signed-off-by: Shiwei Zhang <[email protected]>

README.md

@@ -14,11 +14,12 @@
 
 The ORAS .NET library follows [Semantic Versioning](https://semver.org/), where breaking changes are reserved for MAJOR releases, and MINOR and PATCH releases must be 100% backwards compatible.
 
-## Docs
+## Documentations
 
-- [API Documentation](https://oras-project.github.io/oras-dotnet/api/): API Documentation for the ORAS .NET library.
-- [oras.land/client_libraries](https://oras.land/client_libraries/): Documentation for general ORAS libraries.
+- [API documentation](https://oras-project.github.io/oras-dotnet/api/): API Documentation for the ORAS .NET library.
+- [ORAS client libraries](https://oras.land/docs/category/client-libraries): Documentation for general ORAS libraries.
 - [Reviewing guide](https://github.com/oras-project/community/blob/main/REVIEWING.md): All reviewers must read the reviewing guide and agree to follow the project review guidelines.
+- [Release checklist](RELEASE_CHECKLIST.md): Checklist for releasing a new version of the ORAS .NET library.
 
 ## Code of Conduct
 

RELEASE_CHECKLIST.md

@@ -0,0 +1,26 @@
+# Release Checklist
+
+## Overview
+
+This document describes the checklist to publish a release through the [GitHub release page](https://docs.github.com/en/repositories/releasing-projects-on-github/managing-releases-in-a-repository). After releasing, a NuGet package will be published to [nuget.org](https://www.nuget.org/packages/OrasProject.Oras/) for end users.
+
+## Release Process
+
+1. Determine a [SemVer2](https://semver.org/)-valid version prefixed with the letter `v` for release. For example, `v1.0.0-rc.1`.
+2. Create an issue to vote for a new release (see [example](https://github.com/oras-project/oras-dotnet/issues/103)).
+3. After the vote passes, [draft a release](https://github.com/oras-project/oras-dotnet/releases/new) using the determined version as the tag name, targeting the `main` branch. A tag will be automatically created from the `main` branch when you publish the release.
+4. Compose and revise the release note and optionally select `Set as a pre-release` depending on the version.
+5. Publish the release on GitHub.
+6. A [workflow](https://github.com/oras-project/oras-dotnet/actions/workflows/release-nuget.yml) will be triggered automatically by tag creation mentioned in the step 3 for publishing the release to NuGet.
+7. Wait for NuGet to validate the newly released package.
+8. Announce the release in the community.
+
+## Retract Process
+
+Due to many reasons (e.g. publish accidentally, security vulnerability discovered), a version can be retracted by the following steps:
+
+1. Determine the version to be retracted.
+2. Create an issue to vote for the retraction as well as detailed items to be retracted.
+3. After the vote passes, delete or modify the release as well as the corresponding tag depending on the voted items.
+4. On `nuget.org`, [unlist](https://learn.microsoft.com/nuget/nuget-org/policies/deleting-packages) and / or [deprecate](https://learn.microsoft.com/nuget/nuget-org/deprecate-packages) the corresponding NuGet package.
+5. Announce the retraction in the community.