Post

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

how does it differ from release-plan? github.com/release-plan...

i’m not familiar with release-plan but it looks like it doesn’t support trusted or staged publishing

It does support trusted publishing in its default generated boilerplate What's staged publishing?

it's great! after 'staging' a tarball via trusted publishing in ci, it requires a maintainer to (with 2fa) confirm the publish

Ah, that's deployments on the gh side

it's similar, indeed. I use both.

Isn't both redundant since they both are a manual step before actual release?

Or both, as in each in a different context, but not part of the same releases? Heh, that sounds kind of awful for a big monorepo publish.

I might drop the github environment and move solely to npm staged publish review.

would you do the same workflow if your monorepo published multiple packages at the same time? (does staged releases require a click per package?)

yes, and yes

gotchya -- I have a couple repos that *can* release up to 10 packages at once -- so for this setup, I think I'd prefer github deployment gating tho, I realize now, in either method of gating publish, I kind of want to see the diff between what is trying to be released and the last published version

nuxt has five, but the point is that approving on npm adds additional security - a compromised go acct isn’t game over

That is a fair way to do it. My fear from doing things on npm is giving mole people access to reduce bus factor also increases risk of compromised npm account from doing something bad