
Security News
curl Shuts Down Bug Bounty Program After Flood of AI Slop Reports
A surge of AI-generated vulnerability reports has pushed open source maintainers to rethink bug bounties and tighten security disclosure processes.
A small CLI for automating releases based on conventional commits. It bumps versions, updates your changelog and publishes GitHub releases.
A small CLI for automating releases based on conventional commits. It bumps versions, updates your changelog and publishes GitHub releases.
Note: This tool works with Yarn, npm and pnpm.
Install via npm:
npm install @wroud/ci
Install via yarn
yarn add @wroud/ci
For detailed usage and API reference, visit the documentation site.
Create an optional wroud.ci.config.js in the project root:
export default {
repository: "owner/repo",
tagPrefix: "v",
};
repository is used to generate links in the changelog. If omitted, GITHUB_REPOSITORY or the repository.url field from package.json is used. tagPrefix sets the prefix for git tags. It can also be provided via the TAG_PREFIX environment variable or the tagPrefix field in package.json.
release [path]Bump version and update changelog.
--prefix tag prefix (defaults to configured prefix)--change-log-file path to changelog file--dry-run preview actions without writing filesgit-tagCreate git tag for current version.
--prefix tag prefix (defaults to configured prefix)--dry-run preview actionsrelease-githubPublish GitHub releases for new tags.
--prefix tag prefix (defaults to configured prefix)--dry-run preview actionsAdd scripts to your package.json:
{
"scripts": {
"ci:release": "ci release",
"ci:git-tag": "ci git-tag",
"ci:release-github": "ci release-github"
}
}
Run the commands for each package using yarn workspaces foreach:
yarn workspaces foreach -A --topological-dev run ci:release
name: Release
on:
push:
tags:
- 'v*'
jobs:
release:
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- run: corepack enable
- uses: actions/setup-node@v4
with:
node-version: 20
cache: 'yarn'
- run: yarn install --immutable
- run: yarn build
- run: npx @wroud/ci release-github
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
All notable changes to this project will be documented in the CHANGELOG file.
This project is licensed under the MIT License. See the LICENSE file for details.
FAQs
A small CLI for automating releases based on conventional commits. It bumps versions, updates your changelog and publishes GitHub releases.
We found that @wroud/ci demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A surge of AI-generated vulnerability reports has pushed open source maintainers to rethink bug bounties and tighten security disclosure processes.

Product
Scan results now load faster and remain consistent over time, with stable URLs and on-demand rescans for fresh security data.

Product
Socket's new Alert Details page is designed to surface more context, with a clearer layout, reachability dependency chains, and structured review.