Post

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

👉 you can check it out at github.com/danielroe/uppt I have some ideas about what to do next … but I would love your thoughts 🙏

many thanks to @jviide.iki.fi for an early review and a couple of great ideas, including automatic pinning to the latest released sha in the README

github.com/danielroe/up... You are doing a lot in here, so I will only focus on this small part, but I want to call out that this is still *not* safe. There is no protection you can put on that action trigger that makes it safe for a workflow like this.

I don't have time right now to do a full review, but happy to setup some time next week if you want to discuss why I believe this to be true and show me why I am wrong.

FWIW, I think *most* of what you are doing in here is what I hoped to do myself (I even had a local repo where I started sometime a few months ago). The only thing I noticed in my quick review just now was that `pull_request_target` detail.

yeah I believe GitHub has done security training for maintainers and told them to avoid it, it's how Axios got got IIRC

indeed, I was part of that cohort - it was excellent!

Like I want a replacement for Release Please, and so all your CC stuff and the PR workflow is great.

The TLDR of the problem is that CI is complex, and if you use pull_request_target you have to secure *the whole supply chain* you use in that CI, no exceptions. And nearly everyone who has looked at this through a robust security lens concludes that you *cannot* achieve that.