Post

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

👉 you can check it out at github.com/danielroe/uppt I have some ideas about what to do next … but I would love your thoughts 🙏

many thanks to @jviide.iki.fi for an early review and a couple of great ideas, including automatic pinning to the latest released sha in the README

github.com/danielroe/up... You are doing a lot in here, so I will only focus on this small part, but I want to call out that this is still *not* safe. There is no protection you can put on that action trigger that makes it safe for a workflow like this.

I don't have time right now to do a full review, but happy to setup some time next week if you want to discuss why I believe this to be true and show me why I am wrong.

it absolutely surprises me to hear you say that. and of course I'd love to hear why.

FWIW, I think *most* of what you are doing in here is what I hoped to do myself (I even had a local repo where I started sometime a few months ago). The only thing I noticed in my quick review just now was that `pull_request_target` detail.

yeah I believe GitHub has done security training for maintainers and told them to avoid it, it's how Axios got got IIRC

so what I've been told they were saying is that p_t_r is so darn hard to get right that you should just not; just never pick up the potential footgun

Yeah, some of our @expressjs.bsky.social TC did that training as well. And this is a good TLDR of my opposition. It would take me more time than I have to pull the specific workflow apart, but so far I haven’t been able to find a release from CI that I wasn’t able to find at least one weakness in.