Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
release-git
Advanced tools
Generic CLI tool to automate versioning and package publishing-related tasks.
🚀 Generic CLI tool to automate versioning and package publishing-related tasks:
package.json
)Use release-git for version management and publish to anywhere with its versatile configuration, a powerful plugin system, and hooks to execute any command you need to test, build, and/or publish your project.
Although release-git is a generic release tool, most projects use it for projects with npm packages. The recommended way to install release-git uses npm and adds some minimal configuration to get started:
npm init release-git
Alternatively, install it manually, and add the release
script to package.json
:
npm install -D release-git
{
"name": "my-package",
"version": "1.0.0",
"scripts": {
"release": "release-git"
},
"devDependencies": {
"release-git": "^15.10.0"
}
}
Run release-git from the root of the project using either npm run
or npx
:
npm run release
npx release-git
You will be prompted to select the new version, and more prompts will follow based on your configuration.
You might want to ask your questions in the Release It! knowledge base (powered by OpenAI and 7-docs). This is an experimental knowledge base, answers may be incorrect.
Using Yarn? Please see the npm section on Yarn.
Using a monorepo? Please see this monorepo recipe.
Per-project installation as shown above is recommended, but global installs are supported as well:
npm install -g release-git
brew install release-git
Here's a list of interesting external resources:
Want to add yours to the list? Just open a pull request!
Out of the box, release-git has sane defaults, and plenty of options to configure it. Most projects use a
.release-git.json
file in the project root, or a release-git
property in package.json
.
Here's a quick example .release-git.json
:
{
"git": {
"commitMessage": "chore: release v${version}"
},
"github": {
"release": true
}
}
→ See Configuration for more details.
By default, release-git is interactive and allows you to confirm each task before execution:
By using the --ci
option, the process is fully automated without prompts. The configured tasks will be executed as
demonstrated in the first animation above. In a Continuous Integration (CI) environment, this non-interactive mode is
activated automatically.
Use --only-version
to use a prompt only to determine the version, and automate the rest.
How does release-git determine the latest version?
package.json
, its version
will be used (see npm to skip this).0.0.0
will be used as the latest version.Alternatively, a plugin can be used to override this (e.g. to manage a VERSION
or composer.json
file):
Add the --release-version
flag to print the next version without releasing anything.
Git projects are supported well by release-git, automating the tasks to stage, commit, tag and push releases to any Git remote.
→ See Git for more details.
GitHub projects can have releases attached to Git tags, containing release notes and assets. There are two ways to add GitHub releases in your release-git flow:
GITHUB_TOKEN
)→ See GitHub Releases for more details.
GitLab projects can have releases attached to Git tags, containing release notes and assets. To automate GitLab releases:
gitlab.release: true
→ See GitLab Releases for more details.
By default, release-git generates a changelog, to show and help select a version for the new release. Additionally, this changelog serves as the release notes for the GitHub or GitLab release.
The default command is based on git log ...
. This setting (git.changelog
) can be overridden. To further
customize the release notes for the GitHub or GitLab release, there's github.releaseNotes
or gitlab.releaseNotes
.
Make sure any of these commands output the changelog to stdout
. Note that release-git by default is agnostic to commit
message conventions. Plugins are available for:
To print the changelog without releasing anything, add the --changelog
flag.
→ See Changelog for more details.
With a package.json
in the current directory, release-git will let npm
bump the version in package.json
(and
package-lock.json
if present), and publish to the npm registry.
→ See Publish to npm for more details.
With release-git, it's easy to create pre-releases: a version of your software that you want to make available, while
it's not in the stable semver range yet. Often "alpha", "beta", and "rc" (release candidate) are used as identifiers for
pre-releases. An example pre-release version is 2.0.0-beta.0
.
→ See Manage pre-releases for more details.
Use --no-increment
to not increment the last version, but update the last existing tag/version.
This may be helpful in cases where the version was already incremented. Here are a few example scenarios:
release-git --no-increment --no-npm
to skip the npm publish
and try pushing the same Git tag again.Use script hooks to run shell commands at any moment during the release process (such as before:init
or
after:release
).
The format is [prefix]:[hook]
or [prefix]:[plugin]:[hook]
:
part | value |
---|---|
prefix | before or after |
plugin | version , git , npm , github , gitlab |
hook | init , bump , release |
Use the optional :plugin
part in the middle to hook into a life cycle method exactly before or after any plugin.
The core plugins include version
, git
, npm
, github
, gitlab
.
Note that hooks like after:git:release
will not run when either the git push
failed, or when it is configured not to
be executed (e.g. git.push: false
). See execution order for more details on execution order of plugin lifecycle
methods.
All commands can use configuration variables (like template strings). An array of commands can also be provided, they will run one after another. Some example release-git configuration:
{
"hooks": {
"before:init": ["npm run lint", "npm test"],
"after:my-plugin:bump": "./bin/my-script.sh",
"after:bump": "npm run build",
"after:git:release": "echo After git push, before github release",
"after:release": "echo Successfully released ${name} v${version} to ${repo.repository}."
}
}
The variables can be found in the default configuration. Additionally, the following variables are exposed:
version
latestVersion
changelog
name
repo.remote, repo.protocol, repo.host, repo.owner, repo.repository, repo.project
branchName
All variables are available in all hooks. The only exception is that the additional variables listed above are not yet
available in the init
hook.
Use --verbose
to log the output of the commands.
For the sake of verbosity, the full list of hooks is actually: init
, beforeBump
, bump
, beforeRelease
, release
or afterRelease
. However, hooks like before:beforeRelease
look weird and are usually not useful in practice.
Note that arguments need to be quoted properly when used from the command line:
release-git --'hooks.after:release="echo Successfully released ${name} v${version} to ${repo.repository}."'
Using Inquirer.js inside custom hook scripts might cause issues (since release-git also uses this itself).
Use --dry-run
to show the interactivity and the commands it would execute.
→ See Dry Runs for more details.
release-git --verbose
(or -V
), release-git prints the output of every user-defined hook.release-git -VV
, release-git also prints the output of every internal command.NODE_DEBUG=release-git:* release-git [...]
to print configuration and more error details.Use verbose: 2
in a configuration file to have the equivalent of -VV
on the command line.
Since v11, release-git can be extended in many, many ways. Here are some plugins:
Plugin | Description |
---|---|
@release-git/bumper | Read & write the version from/to any file |
@release-git/conventional-changelog | Provides recommended bump, conventional-changelog, and updates CHANGELOG.md |
@release-git/keep-a-changelog | Maintain CHANGELOG.md using the Keep a Changelog standards |
@release-git-plugins/lerna-changelog | Integrates lerna-changelog into the release-git pipeline |
@release-git-plugins/workspaces | Releases each of your projects configured workspaces |
release-git-calver-plugin | Enables Calendar Versioning (calver) with release-git |
@grupoboticario/news-fragments | An easy way to generate your changelog file |
@j-ulrich/release-git-regex-bumper | Regular expression based version read/write plugin for release-git |
Internally, release-git uses its own plugin architecture (for Git, GitHub, GitLab, npm).
→ See all release-git plugins on npm.
→ See plugins for documentation to write plugins.
While mostly used as a CLI tool, release-git can be used as a dependency to integrate in your own scripts. See use release-git programmatically for example code.
The latest major version is v16, supporting Node.js 16 and up (as Node.js v14 is EOL). Use release-git v15 for environments running Node.js v14. Also see CHANGELOG.md.
FAQs
Generic CLI tool to automate versioning and package publishing-related tasks.
The npm package release-git receives a total of 1 weekly downloads. As such, release-git popularity was classified as not popular.
We found that release-git demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.