docs: add overview of automated releases in readme

README.md

@@ -29,34 +29,34 @@ To run the API and/or Admin servers run the following commands
 
 ### Both Admin + API
 ```bash
-#NPM: 
+#NPM:
 npm start
 
-#CLI: 
+#CLI:
 node src/index.js server
 ```
 
-### API 
+### API
 ```bash
-#NPM: 
+#NPM:
 npm run start:api
 
-#CLI: 
+#CLI:
 node src/index.js server --api
 ```
 
-### Admin 
+### Admin
 ```bash
-#NPM: 
+#NPM:
 npm run start:admin
 
-#CLI: 
+#CLI:
 node src/index.js server --admin
 ```
 
 ## Tests
 
-### Unit Testing 
+### Unit Testing
 
 Running unit tests
 ```bash
@@ -144,8 +144,36 @@ For more information on anchore and anchore-cli, refer to:
 - [Anchore CLI](https://github.com/anchore/anchore-cli)
 - [Circle Orb Registry](https://circleci.com/orbs/registry/orb/anchore/anchore-engine)
 
+## Automated Releases
 
+As part of our CI/CD process, we use a combination of CircleCI, standard-version
+npm package and github-release CircleCI orb to automatically trigger our releases
+and image builds. This process essentially mimics a manual tag and release.
 
-## Additional Notes: 
+On a merge to master, CircleCI is configured to use the mojaloopci github account
+to push the latest generated CHANGELOG and package version number.
 
-- For all put parties callbacks `FSPIOP-Destination` header is considered to be mandatory. 
+Once those changes are pushed, CircleCI will pull the updated master, tag and
+push a release triggering another subsequent build that also publishes a docker image.
+
+### Potential problems
+
+*   There is a case where the merge to master workflow will resolve successfully, triggering
+    a release. Then that tagged release workflow subsequently failing due to the image scan,
+    audit check, vulnerability check or other "live" checks.
+
+    This will leave master without an associated published build. Fixes that require
+    a new merge will essentially cause a skip in version number or require a clean up
+    of the master branch to the commit before the CHANGELOG and bump.
+
+    This may be resolved by relying solely on the previous checks of the
+    merge to master workflow to assume that our tagged release is of sound quality.
+    We are still mulling over this solution since catching bugs/vulnerabilities/etc earlier
+    is a boon.
+
+*   It is unknown if a race condition might occur with multiple merges with master in
+    quick succession, but this is a suspected edge case.
+
+## Additional Notes:
+
+- For all put parties callbacks `FSPIOP-Destination` header is considered to be mandatory.