amqplib icon indicating copy to clipboard operation
amqplib copied to clipboard

Simplify publishing releases to npm

Open cressie176 opened this issue 3 years ago • 0 comments

I've added a GitHub action for automatically publishing releases to npm. The envisioned workflow is as follows...

  1. Work normally, merging PRs, until ready to release etc
  2. Check that the main branch build is green
  3. Check that your local environment is clean and on main and up to date
  4. Use npm version major|minor|patch to update package.json and create a tag, e.g. v0.8.1
  5. Use git push && git push --tags to push both the package.json change and the new tag
  6. Create a new release from the release in the GitHub UI
  7. Wait for the new Publish action to publish the release to npm

For this to work we will need a repository secret configured with an NPM access token. It will be better to create this from a new npm robot account, as there's no way to restrict the access token to just the amqplib module.

One concern I have is that a GitHub action could be modified to expose the secret, which could then be used to publish a vulnerable version of amqplib. Since secrets are not exposed to forks, a maintainer would have to merge the malicious action first though. We should only accept this PR if we are happy with this risk.

cressie176 avatar Apr 18 '22 13:04 cressie176