better release process

[dominictarr]

better release process

[calvinmetcalf]

Those sound sensible

[jprichardson]

I like this idea as it seems to provide an adequate system of checks &
balances. It's probably better than what exists now.

On Mon, Nov 17, 2014 at 2:59 PM, Dominic Tarr [email protected]
wrote:

I've done something dumb and published a broken release more than once.
Given the seriousness of crypto, this is not acceptable, and we need a
better way.

I'm thinking something along the lines of all releases should be a pull
request,
which are then validated and published by another contributor.
@calvinmetcalf https://github.com/calvinmetcalf, you have been putting
most of the work into this recently,
I could add you as an npm owner, and then one of us prepares a release,
but the other one publishes it.

Alternatively, I've just added a prepublish test that would have prevented
3.4.0 getting out.
ce25939
ce25939

Maybe this will be enough?

—
Reply to this email directly or view it on GitHub
#75.

Simple & Secure Bitcoin Wallet: https://www.coinbolt.com
Bitcoin / JavaScript: http://cryptocoinjs.com
Follow me on Twitter: http://twitter.com/jprichardson

[MylesBorins]

Having a consistent process tends to be the most useful in my experience. While the above test might help against some problems, I am not sure it would have guarded against 3.4.0 as you would have still had sha.js in your node_modules folder unless you had done a clean install.

A release candidacy might be a good way to move forward, although for the scale of this lib it might be overkill. Perhaps publication could be offloaded to the CI server?

[calvinmetcalf]

@thealphanerd you'd get an error for having an extraneous dep

[calvinmetcalf]

when doing npm ls

[MylesBorins]

OH AMAZING!!!! I did not know about that feature... I will now be slowly adding this to all of my modules 😄

[dcousens]

Agreed with this.

However, just submitting a PR for all changes into the library in general would also have allowed for external review and probably have caught this particular issue.

Even things like ce25939 might have been caught by just giving the changes a tiny amount of breathing time out in the open (aka, in a PR).

[dominictarr]

yes, okay lets try it this way and see how it goes.

[dcousens]

This has been the case for a while now. Seems to work well. Closing.