digitalbazaar / publish-script

publish-script

Usage

The pubnpm script is intended to be executed in the repository folder immediately after CHANGELOG.md has been modified in preparation for the release.

pubnpm is intended for repositories that have a package.json file. If a build script exists in package.json then npm install will be run before publishing.

Both scripts require a single argument, the release type, which is one of the following: [patch | minor | major]

# a npm patch release
$ pubnpm patch

pubnpm options:

• -h or --help: Show help.
• -v or --verbose: Be verbose running commands.
• -C or --color=WHEN: Color mode: always, auto, never (default: PUBNPM_COLOR env var or auto).
• -n or --dry-run: Show commands that will be run without executing them.
• -t TAG or --tag=TAG: Use the npm publish tag feature
• -b BRANCH or --branch=BRANCH: Ensure running on a git branch (default: main, empty string to skip).
• -N or --new: Skip owner check for a new package.
• -P or --public: Used with new to specify that a scoped package is public.
• -R or --restricted: Used with new to specify that a scoped package is private/restricted.

NOTE: MacOS only supports short options.

The tag feature is useful if releasing to a "dev" branch vs the "latest":

pubnpm -v -t dev patch

Release a new public scoped package from the main branch

pubnpm -N -P major

Release a new public scoped package from the master branch

pubnpm -N -P -b master major

publish-script's Issues

Unable to use help or dry-run flags

I'm running into trouble using the npm publish script on did-io:

did-io$ git st
On branch master
Your branch is up to date with 'origin/master'.

Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git checkout -- <file>..." to discard changes in working directory)

	modified:   CHANGELOG.md

no changes added to commit (use "git add" and/or "git commit -a")

did-io$ pubnpm -h
A release type must be specified: [major | minor | patch]

did-io$ pubnpm minor -h
A release type must be specified: [major | minor | patch]

did-io$ pubnpm minor -vn
A release type must be specified: [major | minor | patch]

did-io$ pubnpm -v -n minor
A release type must be specified: [major | minor | patch]

What am I doing wrong?

Support scoped packages in pubnpm

We need scoped package support here.

https://github.com/digitalbazaar/publish-script/tree/fix-scoped

See fixme:

https://github.com/digitalbazaar/publish-script/compare/fix-scoped?expand=1

pubnpm script fails halfway through if `/tmp/digital-bazaar-release` already exists

mkdir: cannot create directory ‘/tmp/digital-bazaar-release’: File exists

Default branch alternatives

We have one package that is using "main" as the default branch. The branch check defaults should likely accept both "master" and "main" (or whatever name the git community might decide to use by default).

Typing `pubnpm --help` should only print help

Checkout version to publish before running npm publish

npm owner checks fail on new npm package

If a package does not exist on NPM, then the ownership checks fail.

Maybe a simple overide on this check is required:

pubnpm major --new

Add explicit version option.

npm version can accept an explicit version. An option should expose this.

The workaround is to temporarily replace the VERSION_TYPE in the npm vesrion call with the desired version.

Consider inspecting deps/peer deps

We recently had an incident where a release was made that included a dep that was just a github branch, without pinning to a commit or a tag. This should be avoided and prevented in the future.

This code should inspect dependencies (and peerDeps?) looking for irregularities. If we don't want to insist on a released dep, then at minimum there should be a pinned commit hash on github deps.

Enhancements for the --new flag

We need to ensure that there is always more than one npm owner for packages. Should the new flag trigger a script that adds the core team?

https://gist.github.com/mattcollier/84b95f718a24a5f6c1eab0f0e0eb3805

The tricky part would be ensuring that npm owner add is actually successful.

The `-n` (dry-run) flag does not work properly on pubtag

When using this flag a tag is not generated, but the changelog entry is committed when it should not be. I'm not sure if other things happen that should not happen as well. Please fix, thanks.

Check github status

Since we're getting fancy with this!

https://www.githubstatus.com/api/

Recovering from failure of any of the several github interactions involved in the publish script can be difficult to unwind and recover from.

If it's possible to make a simple request to determine that there are no current (or recent?) github outtages that would be super cool.

Owner check fails on scoped private modules

Just tried to publish v2 of a scoped module and the npm owner check fails.

I was able to work around this by using the --new flag which bypasses the check.

Don't push dev tags

Is there a use case for needing to push the dev xxx-0 tags? They don't seem useful and clutter the tag list. I'd suggest removing them in the scripts. After the "xxx version prepatch" command is run, the code could run the node command to read package.json/bower.json to get the new version, then run "git tag -d DEVVER", and omit the final tag push.

git ls-files --modified --other ignores .gitignore files

Editors leave *~ or other such files in directories and the --other flag of git ls-files --modified --other will list these files causing the scripts to fail. Some other method should be used that respects the .gitignore patterns.

pubnpm script should bail when `https://github.com/...` `repository.url` is used

The URL should always be [email protected]:... instead.

Command line for `-b` flag

The readme says one can use the branch flag like -b 4.x however, I found that there cannot be a space after the b. So what worked was -b4.x. We need to reconcile the documentation with the feature one way or another.