Post

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

daniel r(ooooooh) in nyc 🇺🇸

@danielroe.dev

22 May

👉 you can check it out at github.com/danielroe/uppt I have some ideas about what to do next … but I would love your thoughts 🙏

daniel r(ooooooh) in nyc 🇺🇸

@danielroe.dev

22 May

many thanks to @jviide.iki.fi for an early review and a couple of great ideas, including automatic pinning to the latest released sha in the README

Wes

@notwes.bsky.social

22 May

github.com/danielroe/up... You are doing a lot in here, so I will only focus on this small part, but I want to call out that this is still *not* safe. There is no protection you can put on that action trigger that makes it safe for a workflow like this.

github.comGitHub - danielroe/uppt: A composite GitHub Action that turns conventional commits into a draft release PR, tags the PR on merge, and stages publishing to npm via OIDC trusted publishing.A composite GitHub Action that turns conventional commits into a draft release PR, tags the PR on merge, and stages publishing to npm via OIDC trusted publishing. - danielroe/uppt

daniel r(ooooooh) in nyc 🇺🇸

@danielroe.dev

🙋‍♂️ for anyone else who comes here, I've switched to using `pull_request`

22/5/26, 9:37 pm0 reposts5 likes

Matteo Gabriele

@matteogabriele.npmx.social

22 May

I find so bizarre that WE need to squeeze our brains to find a feature from GitHub action that doesn't get all hacked instead of THEM making it safe by default. It's just stupid. Anyways, love you Daniel ❤️

James

@43081j.com

22 May