Post

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

Also reviewing, and my first nit is simply that this workflow does quite a lot. I call that out bc my preference is for release workflows to do as little as possible, so the operating model is as dumb and simple as possible thus harder for anyone to screw up and requires fewest perms

IE, I prefer maintainers to push tags themselves, so then a workflow does not need to have write on the repo at all But just digging in. For the workflow I imagine you desire, where there is little manual work at all, then I can understand the complexity being an acceptable tradeoff

thank you for diving in!

Its a pleasure to be able to do so without having to just stop at “no 2fa, ci/maintainer gets popped, game over”!!

Is it intended that a release/v* branch from a fork, when merged, should trigger a release? I dont see any verification in the action or the workflow example which enforces that the head.repo == base.repo