Release Lifecycle Management

An essential part of delivering quality software is creating releases that are validated as they advance through the software development lifecycle (SDLC) toward their eventual consumption by end users. If not managed properly, the lifecycle of releases can become a complex process involving multiple tools and inconsistent processes used by different development teams, leading to an inefficient software supply chain.

How Release Lifecycle Management Works

JFrog’s Release Lifecycle Management (RLM) solution centers around controlling the flow of Release Bundles v2, which you can create with the JFrog CLI, the JFrog Platform UI, or REST APIs from multiple sources, such as artifacts and build outputs. The set of artifacts that define a release candidate is wrapped in the Release Bundle, which is signed with its content. You can then promote the Release Bundle toward production via different stages, for example DEV, INT, STG, and PROD, and distribute them to Edge services.

Security Scanning and Distribution Controls

If you have JFrog Artifactory 7.68.9 or above and JFrog Xray 3.82.6 or above, you can scan the contents of Release Bundles v2 and potentially block these Release Bundles from being promoted if policy violations are identified. If you have JFrog Distribution 2.20.1 or above, you can also use JFrog Xray to block vulnerable Release Bundles from being distributed.

Evidence and Auditability

Each action performed on a Release Bundle is tracked within the JFrog Platform, including creation, promotion, and distribution, and creates signed metadata known as evidence attesting to that action. For more information, see Evidence Management.

Required Subscription Levels

The following subscription levels are required for Release Lifecycle Management operations.

Related Topics

• Understanding Release Bundles v2
• Release Lifecycle Management Workflow
• Release Lifecycle Management Setup
• Create Release Bundles v2
• Release Lifecycle Management CLI