Post

daniel r(ooooooh) in nyc 🇺🇸

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

@nullvoxpopuli.com

how does it differ from release-plan? github.com/release-plan...

github.comGitHub - release-plan/release-planContribute to release-plan/release-plan development by creating an account on GitHub.

daniel r(ooooooh) in nyc 🇺🇸

i’m not familiar with release-plan but it looks like it doesn’t support trusted or staged publishing

@nullvoxpopuli.com

It does support trusted publishing in its default generated boilerplate What's staged publishing?

daniel r(ooooooh) in nyc 🇺🇸

it's great! after 'staging' a tarball via trusted publishing in ci, it requires a maintainer to (with 2fa) confirm the publish

docs.npmjs.comStaged publishing for npm packages | npm DocsDocumentation for the npm registry, website, and command-line interface

23/5/26, 12:02 pm0 reposts0 likes

@nullvoxpopuli.com

Ah, that's deployments on the gh side

daniel r(ooooooh) in nyc 🇺🇸

it's similar, indeed. I use both.

@nullvoxpopuli.com

Isn't both redundant since they both are a manual step before actual release?

@jacobbolda.com

Or both, as in each in a different context, but not part of the same releases? Heh, that sounds kind of awful for a big monorepo publish.