Post

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

how does it differ from release-plan? github.com/release-plan...

i’m not familiar with release-plan but it looks like it doesn’t support trusted or staged publishing

It does support trusted publishing in its default generated boilerplate What's staged publishing?

it's great! after 'staging' a tarball via trusted publishing in ci, it requires a maintainer to (with 2fa) confirm the publish

Ah, that's deployments on the gh side

it's similar, indeed. I use both.

Isn't both redundant since they both are a manual step before actual release?

Or both, as in each in a different context, but not part of the same releases? Heh, that sounds kind of awful for a big monorepo publish.

I might drop the github environment and move solely to npm staged publish review.

would you do the same workflow if your monorepo published multiple packages at the same time? (does staged releases require a click per package?)

yes, and yes

nuxt has five, but the point is that approving on npm adds additional security - a compromised go acct isn’t game over

*github

That is a fair way to do it. My fear from doing things on npm is giving mole people access to reduce bus factor also increases risk of compromised npm account from doing something bad

The monorepo use case technically requires a topological sort for which order you publish (and now approve/promote). The ideal is a one click that understands this and can promote them all together in order. Ideally needs additional work from @npmjs.bsky.social, but can be mostly bolted on top of

I presumed you could queue up a bunch of these for approval, right? With covector, we were sequentially publishing considering that, and I presumed you could push a bunch for approval. Might need a dirty publish, but would be fine in this context.

Yes, but because you have to manually click the button right now it means that there is a race condition between somebody installing latest and you actually approving all of the packages. This is why you have to do it in topological order, technically.

Order only matters if there is delay in releasing individual packages ya?

There’s always a delay in the current workflow because you have to manually approve them. I replied with more details in the other part of the thread.