Post

daniel r(ooooooh) in nyc 🇺🇸
@danielroe.dev

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

Wes
@notwes.bsky.social

github.com/danielroe/up... You are doing a lot in here, so I will only focus on this small part, but I want to call out that this is still *not* safe. There is no protection you can put on that action trigger that makes it safe for a workflow like this.

github.comGitHub - danielroe/uppt: A composite GitHub Action that turns conventional commits into a draft release PR, tags the PR on merge, and stages publishing to npm via OIDC trusted publishing.A composite GitHub Action that turns conventional commits into a draft release PR, tags the PR on merge, and stages publishing to npm via OIDC trusted publishing. - danielroe/uppt
Matteo Gabriele
@matteogabriele.npmx.social

I find so bizarre that WE need to squeeze our brains to find a feature from GitHub action that doesn't get all hacked instead of THEM making it safe by default. It's just stupid. Anyways, love you Daniel ❤️

Wes
@notwes.bsky.social

I don't have time right now to do a full review, but happy to setup some time next week if you want to discuss why I believe this to be true and show me why I am wrong.

Wes
@notwes.bsky.social

FWIW, I think *most* of what you are doing in here is what I hoped to do myself (I even had a local repo where I started sometime a few months ago). The only thing I noticed in my quick review just now was that `pull_request_target` detail.