Skip to content

RELEASING.md

Latest commit

 

History

History
46 lines (34 loc) · 1.72 KB

RELEASING.md

File metadata and controls

46 lines (34 loc) · 1.72 KB
Raw

Releasing

Each package under apps/ is released on its own. One script serves them all: it reads the name and version from the package's package.json, so nothing is hardcoded per package. npm publish needs 2FA.

Release a package

  1. Bump version in apps/<package>/package.json and add the entry to its CHANGELOG.md.

  2. Check what ships:

    mise run publish-dry-run apps/<package>

  3. Publish from a clean main. The task checks the npm login first (pnpm whoami; if it fails, it runs pnpm login and checks again), so an expired login stops it in seconds, not after the test suite. Then it runs mise run check, pnpm publish, and tags <name>@<version>:

    mise run publish apps/<package>
git push origin <name>@<version>

  4. Create the GitHub release from the tag.

  5. For am-i-hacked, bump AIH_VERSION in .github/workflows/gate.yml to the new version so the security gate keeps running the latest stable release.

scripts/release.sh refuses a private package, a version already on npm, and any package.json with lifecycle scripts (prepare, prepack, postinstall and the like) that would run during pack, publish or install.

Packages

Package Folder Commands
am-i-hacked apps/am-i-hacked am-i-hacked, aih, am-i-compromised, aic, security-gate, scanner, safe-pull
am-i-being-recorded apps/am-i-being-recorded am-i-being-recorded, aibr
secure-semgrep apps/secure-semgrep secure-semgrep

am-i-hacked was published as am-i-compromised up to 1.x. After a 2.x release, point users at the new name:

pnpm deprecate am-i-compromised "Renamed to am-i-hacked. Run: npx am-i-hacked"