Post

Curious, what are your views on changesets? I’m kinda torn

it looks really nice and I would consider it if I needed a more complex workflow or independent versioning of packages but I wanted something effortless + simpler, that works off of the metadata already present in conventional commits

I used to use changesets, but then helped develop release-plan -- which supports both same versions and independent versions dependening on config, and semver impact labels I do still miss the fidelity of a manual high context changelog entry tho

That explains the intensive typing I was hearing behind me at @madvue.es 😂😂

love this

does it only work with conventional commits? I’m not a fan of that particular standard :-/

Also reviewing, and my first nit is simply that this workflow does quite a lot. I call that out bc my preference is for release workflows to do as little as possible, so the operating model is as dumb and simple as possible thus harder for anyone to screw up and requires fewest perms

IE, I prefer maintainers to push tags themselves, so then a workflow does not need to have write on the repo at all But just digging in. For the workflow I imagine you desire, where there is little manual work at all, then I can understand the complexity being an acceptable tradeoff

thank you for diving in!

What I really want is custom approval gate api, so I can implement the approval rather than going through npm with 2fa. Cc @notwes.bsky.social

The whole point is every publish needs a responsible human in the loop. If you do it via an API without 2fa, then you’ve defeated the whole point of staged publishing.

Totally, but I want to implement my own flow that does involve 2fa rather than use npm’s

Oh, I totally misread that as “without” lol.

👉 you can check it out at github.com/danielroe/uppt I have some ideas about what to do next … but I would love your thoughts 🙏

many thanks to @jviide.iki.fi for an early review and a couple of great ideas, including automatic pinning to the latest released sha in the README

github.com/danielroe/up... You are doing a lot in here, so I will only focus on this small part, but I want to call out that this is still *not* safe. There is no protection you can put on that action trigger that makes it safe for a workflow like this.

Wow, you're fast 😅 I'll take a look on Monday. Got places to use it

would love to hear any ideas you have to make it better! 🙏

You bet!

how does it differ from release-plan? github.com/release-plan...

i’m not familiar with release-plan but it looks like it doesn’t support trusted or staged publishing

It does support trusted publishing in its default generated boilerplate What's staged publishing?