Post

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

how does it differ from release-plan? github.com/release-plan...

i’m not familiar with release-plan but it looks like it doesn’t support trusted or staged publishing

It does support trusted publishing in its default generated boilerplate What's staged publishing?

it's great! after 'staging' a tarball via trusted publishing in ci, it requires a maintainer to (with 2fa) confirm the publish

Ah, that's deployments on the gh side

it's similar, indeed. I use both.

Isn't both redundant since they both are a manual step before actual release?

Or both, as in each in a different context, but not part of the same releases? Heh, that sounds kind of awful for a big monorepo publish.

I might drop the github environment and move solely to npm staged publish review.

would you do the same workflow if your monorepo published multiple packages at the same time? (does staged releases require a click per package?)

yes, and yes

gotchya -- I have a couple repos that *can* release up to 10 packages at once -- so for this setup, I think I'd prefer github deployment gating tho, I realize now, in either method of gating publish, I kind of want to see the diff between what is trying to be released and the last published version

The monorepo use case technically requires a topological sort for which order you publish (and now approve/promote). The ideal is a one click that understands this and can promote them all together in order. Ideally needs additional work from @npmjs.bsky.social, but can be mostly bolted on top of

Yes, but because you have to manually click the button right now it means that there is a race condition between somebody installing latest and you actually approving all of the packages. This is why you have to do it in topological order, technically.

The ideal would be the npm knows these go together, and you can queue them such that the registry will approve them as a transaction, or in order.