Post

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

how does it differ from release-plan? github.com/release-plan...

i’m not familiar with release-plan but it looks like it doesn’t support trusted or staged publishing

It does support trusted publishing in its default generated boilerplate What's staged publishing?

it's great! after 'staging' a tarball via trusted publishing in ci, it requires a maintainer to (with 2fa) confirm the publish

Ah, that's deployments on the gh side

it's similar, indeed. I use both.

Isn't both redundant since they both are a manual step before actual release?

I might drop the github environment and move solely to npm staged publish review.

would you do the same workflow if your monorepo published multiple packages at the same time? (does staged releases require a click per package?)

yes, and yes