Post

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

how does it differ from release-plan? github.com/release-plan...

i’m not familiar with release-plan but it looks like it doesn’t support trusted or staged publishing

It does support trusted publishing in its default generated boilerplate What's staged publishing?

it's great! after 'staging' a tarball via trusted publishing in ci, it requires a maintainer to (with 2fa) confirm the publish

Ah, that's deployments on the gh side

it's similar, indeed. I use both.

Isn't both redundant since they both are a manual step before actual release?

Or both, as in each in a different context, but not part of the same releases? Heh, that sounds kind of awful for a big monorepo publish.

I might drop the github environment and move solely to npm staged publish review.

yes, and yes

gotchya -- I have a couple repos that *can* release up to 10 packages at once -- so for this setup, I think I'd prefer github deployment gating tho, I realize now, in either method of gating publish, I kind of want to see the diff between what is trying to be released and the last published version

nuxt has five, but the point is that approving on npm adds additional security - a compromised go acct isn’t game over

The monorepo use case technically requires a topological sort for which order you publish (and now approve/promote). The ideal is a one click that understands this and can promote them all together in order. Ideally needs additional work from @npmjs.bsky.social, but can be mostly bolted on top of