amqplib
amqplib copied to clipboard
Simplify publishing releases to npm
I've added a GitHub action for automatically publishing releases to npm. The envisioned workflow is as follows...
- Work normally, merging PRs, until ready to release etc
- Check that the main branch build is green
- Check that your local environment is clean and on main and up to date
- Use
npm version major|minor|patchto update package.json and create a tag, e.g. v0.8.1 - Use
git push && git push --tagsto push both the package.json change and the new tag - Create a new release from the release in the GitHub UI
- Wait for the new Publish action to publish the release to npm
For this to work we will need a repository secret configured with an NPM access token. It will be better to create this from a new npm robot account, as there's no way to restrict the access token to just the amqplib module.
One concern I have is that a GitHub action could be modified to expose the secret, which could then be used to publish a vulnerable version of amqplib. Since secrets are not exposed to forks, a maintainer would have to merge the malicious action first though. We should only accept this PR if we are happy with this risk.