Post

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

how does it differ from release-plan? github.com/release-plan...

i’m not familiar with release-plan but it looks like it doesn’t support trusted or staged publishing

It does support trusted publishing in its default generated boilerplate What's staged publishing?

it's great! after 'staging' a tarball via trusted publishing in ci, it requires a maintainer to (with 2fa) confirm the publish

Ah, that's deployments on the gh side

Isn't both redundant since they both are a manual step before actual release?

Or both, as in each in a different context, but not part of the same releases? Heh, that sounds kind of awful for a big monorepo publish.

I might drop the github environment and move solely to npm staged publish review.