MONGOCRYPT-804 amend release doc with release team steps

[connorsmacd]

Reference

MONGOCRYPT-804

Summary

This repository has new rulesets similar to what is described in this C Driver PR and this C++ Driver PR. Here is a summary of the rulesets, which is a direct copy of @eramongodb's summary with the exception of the exclusion patterns in the last bullet point:

• Joining the @mongodb/dbx-c-cxx-releases team during a release allows one to bypass to the following rulesets:
  • "Restrict Creations" (branches and tags) to create new release branches and tags.
  • "Require a Pull Request" (new and active branches) to directly push to (new) release branches.
• "Restrict Deletions" apply to all branches and tags without exception.
• "Restrict Updates" applies to all tags without exception and to an inclusive target list of stale branches which may be "locked" from any further changes.
• "Require a Pull Request" applies to all branches, except as bypassed described above, and excluding the following patterns:
  • debian/*
  • gh-pages
  • pymongocrypt-*

"Require a Pull Request" applies the most of the same rules as the preexisting libmongocrypt rulesets. The only difference is merge commits are no longer permitted (only squashing and rebasing is allowed).

This PR does not include steps for signing artifacts, since that seems to be covered by a different task: MONGOCRYPT-841.

[kevinAlbs]

Release process changes LGTM. I have a requested tweak to the rulesets:

Suggest removing node-*, java-*, and csharp-* from rule exclusions. Those drivers have moved their libmongocrypt bindings out of the repository. I don't expect those need to be mentioned. Python (pymongocrypt) is the only language binding that still releases in this repo.

---

Suggest adding mongodb-dbx-release-bot to the bypass list to Require a Pull Request (master). The pymongocrypt release appears to automate much of the release after pushing a tag:

Pushing a tag will trigger the release process on GitHub Actions

Logs of the last run on a tagged release show a pushed tag: pymongocrypt-1.16.0 and commit pushed to master.

---

Suggest moving rulesets from "Evaluate" to "Active". If (by chance) it prevents our 1.17.0 release, I expect we can modify the rulesets during the release without much delay.

[connorsmacd]

Release process changes LGTM. I have a requested tweak to the rulesets:

Suggest removing node-*, java-*, and csharp-* from rule exclusions. Those drivers have moved their libmongocrypt bindings out of the repository. I don't expect those need to be mentioned. Python (pymongocrypt) is the only language binding that still releases in this repo.

Suggest adding mongodb-dbx-release-bot to the bypass list to Require a Pull Request (master). The pymongocrypt release appears to automate much of the release after pushing a tag:

Pushing a tag will trigger the release process on GitHub Actions

Logs of the last run on a tagged release show a pushed tag: pymongocrypt-1.16.0 and commit pushed to master.

Suggest moving rulesets from "Evaluate" to "Active". If (by chance) it prevents our 1.17.0 release, I expect we can modify the rulesets during the release without much delay.

Done.