bahmutov / ci-publish

Poor man's semantic release utility. Let the CI do the `npm publish` step after the build passes

ci-publish

Poor man's semantic release utility. Let the CI do the npm publish step after the build passes

Goal

Allow any CI to publish your module after tests pass, using your account to login.

Q: Why not use semantic-release?

A: Because it needs a lot of tweaking to setup on CircleCI or Gitlab

Q: But your package only does the "release" part without the "semantic" version upgrade?

A: Yeah :( I am sorry

Example: this own repo, see .travis.yml file

How to use

• Add as a dependency to your project npm install --save-dev ci-publish

• Login into your project's NPM registry

npm login --registry <registry url>
npm login --registry http://registry.npmjs.org

• Copy the token

The login step added a line to your ~/.npmrc file looking something like this

//registry.npmjs.org/:_authToken=00000000-0000-0000-0000-000000000000

Grab the auth token value 00000000-0000-0000-0000-000000000000 (older NPM proxies or registries like sinopia might have an older different token string format)

• Set the token as CI environment variable

Go to your CI project settings and add a new variable NPM_TOKEN with the value you have just copied

• Add script command (optional)

Create a script command to run the publish, in your package.json

{
    "scripts": {
        "ci-publish": "ci-publish"
    }
}

Now you can run the ci-publish logic from shell using npm run ci-publish command

You can avoid adding a script command if you use explicit command in your CI files, like $(npm bin)/ci-publish

• Add a command to run on your CI after the tests pass.

Travis CI

Add after_success section to your .travis.yml file

after_success:
    - npm run ci-publish || true

Every time you want to publish your module to the registry after the tests pass, just increment the package version and push the code. The CI will pass the tests and will try to run ci-publish. This will add the auth token to the CI's "user" profile, allowing it to publish under your authority. If the package has a new version, it will be published. If you have not incremented the version number, this step fail, but we do not fail the build step by using || true

warning: The publish will fail if there are multiple Travis jobs trying to publish at the same time, which happens if you test on multiple NodeJS versions. Maybe use a different CI engine for the publish?

Gitlab

Add a new deploy job to your .gitlab-ci.yml file. For example

before_script:
  - npm install
stages:
  - test
  - deploy
npm_test:
  stage: test
  script:
    - npm test
release:
  stage: deploy
  script:
    - echo Running release
    - npm run ci-publish || true

Gitlab can run multiple test jobs in parallel and then a single release job.

Typical output

For example, when successfully publishing this module, Travis produced this output

$ npm run ci-publish || true
> [email protected] ci-publish /home/travis/build/bahmutov/ci-publish
> node bin/ci-publish.js
//registry.npmjs.org/:_authToken=${NPM_TOKEN}
saved /home/travis/.npmrc
$ npm publish || true
* [email protected]

Extra resources

• Increment package version on demand using semantic commits

• Deploying with npm private modules

• If you need to debug NPM commands, just enable verbose NPM logging

npm_config_loglevel=verbose $(npm bin)/ci-publish

Small print

Author: Gleb Bahmutov © 2015

• @bahmutov
• glebbahmutov.com
• blog

License: MIT - do anything with the code, but don't blame me if it does not work.

Spread the word: tweet, star on github, etc.

Support: if you find any problems with this module, email / tweet / open issue on Github

MIT License

Copyright (c) 2015 Gleb Bahmutov

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

ci-publish's Issues

how to publish public scoped package ?

Hi,
I would like to publish a public scoped package (https://www.npmjs.com/docs/orgs/publishing-an-org-scoped-package.html#publishing-a-public-scoped-package)

My CI is failing with :

npm ERR! publish Failed PUT 402
npm ERR! code E402
npm ERR! You must sign up for private packages : 

Known low severity security vulnerability detected in debug >= 3.0.0, < 3.1.0

Please update available-versions to latest version to fix the following issue, reported by GitHub:

Known low severity security vulnerability detected in debug >= 3.0.0, < 3.1.0defined in package-lock.json.package-lock.json update suggested: debug ~> 3.1.0. | Known low severity security vulnerability detected in debug >= 3.0.0, < 3.1.0defined in package-lock.json. | package-lock.json update suggested: debug ~> 3.1.0.
Known low severity security vulnerability detected in debug >= 3.0.0, < 3.1.0defined in package-lock.json.
package-lock.json update suggested: debug ~> 3.1.0.

npm ls output:

├─┬ [email protected]
│ ├─┬ [email protected]
│ │ ├─┬ [email protected]
│ │ │ └─┬ [email protected]
│ │ │   └── [email protected]
│ │ ├── [email protected]
│ │ ├─┬ [email protected]

Allow publishing only from specific Node version

To avoid double publishing from multiple node versions

how to publish to custom registry

With npm publish one publishes to the authenticated registry. With npm run ci-publish one publishes to the default registry with the token provided in NPM_TOKEN.

How do you suggest to provide the custom registry for publishing? I tried providing the option --registry http ... as well as the environment variable npm_config_registry=http ... without success.

thanks for your help

how to publish to private registry

Hi, I have looked at the source code and apparently it is not possible to set the registry.

there are now registry deployed like verdaccio, would you mind giving the hand or updating the module?

Specify `ignore-scripts` when publishing

As noted in https://snyk.io/blog/github-actions-to-securely-publish-npm-packages/, it is insecure to allow scripts to execute at the time of publishing, so we should make sure that this configuration is applied

Use ban-sensitive-files

Since it can now check the .npmrc file https://github.com/bahmutov/ban-sensitive-files

Encrypt the auth token

If other's get hold of the auth token, they could make releases as yourself.

https://docs.travis-ci.com/user/encryption-keys/

Known moderate severity security vulnerability detected in hoek < 4.2.1

GitHub reported issue to my project which depends on ci-publish:
Where hoek is a sub-dependency of CI publish:

└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └─┬ [email protected]
        ├─┬ [email protected]
        │ └── [email protected]  deduped
        ├── [email protected]
        └─┬ [email protected]
          └── [email protected]  deduped

Publish is incorrect if, for example, transpiling is required

https://gitgud.io/nixx/paperman/-/jobs/10151

npm WARN lifecycle [email protected]~prepack: cannot run in wd %s %s (wd=%s) [email protected] gulp compile .

I would need to add an --unsafe-perm argument here, but that option is not exposed with this tool.

Note that the publish still happens, just without any files that make the package tick.

What is the advantage of using ci-publish?

Hi Gleb! I had a similar thought last week, and ended up setting up auto-publishing manually.

In what ways is your implementation better than mine?

Thanks in advance.

I Need Some Advice

Howdy @bahmutov,

I'm looking at refactoring semantic-release-gitlab to remove package publishing from semantic-release-gitlab, and move that functionality into a separate package.

The act of publishing an npm package to the npm registry would fall into a job separate from the job that publishes a tag and release notes to GitLab.

A detailed explanation of the goal, and reasoning, is available at the link above.

It looks like ci-publish can handle most of my requirements, such as setting up the CI's .npmrc configuration file, and calling npm publish.

The one remaining requirement, because of the way semantic-release-gitlab generates a new version based on the commits since the last tag, is the need to write a version number to the package.json.

If publishing to the npm registry happens in a separate job from the job that runs semantic-release-gitlab, the value written to package.json by semantic-release-gitlab won't be available during the npm publish.

Therefore, I was wondering whether I should bake ci-publish into another tool that also writes the version number to a package.json file, or whether that functionality can, or should, exist in a project like ci-publish?

[email protected] requires @bahmutov/parse-github-repo-url

It seems that the latest [email protected] refers to non-existing or not yet published @bahmutov/parse-github-repo-url node module.

The 'npm install' complains like that:
npm ERR! Darwin 15.6.0
npm ERR! argv "/usr/local/bin/node" "/usr/local/bin/npm" "install"
npm ERR! node v6.2.0
npm ERR! npm v3.8.9
npm ERR! code E404

npm ERR! 404 no such package available : @bahmutov/parse-github-repo-url
npm ERR! 404
npm ERR! 404 '@bahmutov/parse-github-repo-url' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404 It was specified as a dependency of 'changed-log'
npm ERR! 404
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.

Version 1.1.0 works fine though