Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid adding and committing every file when releasing #163

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

abarmat
Copy link

@abarmat abarmat commented Aug 24, 2019

This is a change on the standard behaviour when releasing.

Release by default adds all the files in your local repo and then commit everything, this might cause undesired files to be pushed, a security risk depending on the files exposed.

This change will only commit package.json and package-lock.json as part of the bump version stage.

Closes #162

@fmiras
Copy link

fmiras commented Sep 5, 2019

cc @leo

lib/bump.js Outdated
@@ -109,7 +109,9 @@ module.exports = async (type, preSuffix) => {
createSpinner('Creating release commit');

try {
await runGitCommand(`git add -A && git commit -a -m "${version}"`);
await runGitCommand(
`git add package.json package-lock.json && git commit -m "${version}"`

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would fail if a package-lock.json is missing, i.e. if the user uses yarn.
You should check before if there is a package-lock.json or yarn.lock present in my opinion.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the feedback. I've added a check to commit package-lock.json only if it is present. I excluded yarn.lock from the commit as I see release is only changing package.json and package-lock.json in the increment() function.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Only commit package.json instead of all files
4 participants