Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(learn): add article for publishing a typescript package #7279
base: main
Are you sure you want to change the base?
feat(learn): add article for publishing a typescript package #7279
Changes from 13 commits
b20dcbf
2d5d359
86394b6
d583e03
48e2ad9
081b7f2
2a20202
52d3a13
2228ab3
5034918
ddb1cf1
9258389
4906609
07095c6
33e744a
f1703ad
3fd8076
64fd531
7305f8e
13b8e1c
0f7f993
53793f1
4b06b6c
d250a86
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am sort of questioning linking to this page; reading it, it's pretty out of date and is part of the declaration file section, so sort of misses out on other important stuff.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Happy to change it to a different one—is there one you had in mind?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I noted this in the other thread, but I would be cautious about this as a default; I really only see people setting noEmit when they're doing a quick check, or are using a bundler or something.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is the type "test" command. Why would you want to emit a compilation?
Maybe the names could be better? When I have unit and end-to-end tests with different setups, I split those into different commands like:
test:unit
test:e2e
So in that scenario, it could make sense to name
types:check
→test:types
.But in the sample, there's no differentiation between units and e2e, so then what do I call what is currently
test
?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I mean, I guess it's fine, I am just wary of cases where
tsc
andtsc --noEmit
output different errors because the former is doing more. Maybe you'd hit it onprepack
and that's okay, but it's a little unfortunate to only hit an error when you go to release...There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is that likely? I've been doing this for years and never encountered that—am I just very lucky?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure how to gauge "likely", probably unlikely, but they're cases like "tsc failed to write the files", along with potentially some declaration transform errors. (The latter shouldn't actually end up mattering by my reading of the code, though.)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The specific issues that come up that I can think of are when a declaration file can't reliably be generated because doing so might require referencing entities that are private or non-exported. Trying to figure out why this error is happening can be pretty frustrating, especially if you've been relying a specific pattern over time. Having a divergence between publish/CI probably just makes this even more confusing since most people outside of the person who set up the build won't be aware of any differences.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That does sound like an issue that you legitimately wouldn't catch with a dry-run, but also seems a very unlikely issue (and one that could still occur at publishing even if you were using non-dry-run for the test step). It seems an edge-case worth noting but not worth taking a hit every time to avoid something that likely will never happen (if it does, there are a very limited number of causes—two? permissions and storage availability).
That sounds very detectable for
--noEmit
; if it doesn't do that, that sounds like a defect intsc
? Why would you need to writing to disk in order to discover it?But maybe let's take a step back for a second: The reason I wrote the setup this way is because of performance—but perhaps my information is outdated. Last I heard,
tsc --noEmit
was significantly faster than with emit.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think as of recent releases (since
--isolatedDeclarations
), we've actually always checked declaration errors without emit, so I think the only errors one can see differently are just the errors that happen while writing, which may not really be important except in the case where you've somehow accidentally marked output paths as readonly in the FS or something.It can be, though I think at the scale of this demo, it's definitely not a big difference.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is the take-away then that what I have is fine? There is a potentially (and probably likely) significant perf savings, and there're basically no type-related errors this won't catch?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is
NPM_TOKEN
automatically provided somehow? I think we should mention how to get this or avoid automated publishing accordingly. having a separate guide on automated publishing is worthwhile.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
t's not provide automatically. But this GA example from https://docs.npmjs.com/generating-provenance-statements#example-github-actions-workflow
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Would we have enough content for a dedicated guide on automated publishing?
For now, I think let's add a note explaining what the token is and where it comes from: 0f7f993
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
+1 for note
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There are a ton of problems with automated publishing (discussed above) and I think a separate guide that can fully explain the pros and cons is definitely warranted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In that case, sure, happy to do subsequently (subsequently because otherwise we end up with a web of ½ finished, inter-dependent guides, and this doesn't seem like a show-stopper—unless someone strongly thinks that it needs to happen first).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've made the case above that it would be better to give no publishing guidance prior to such a properly nuanced guide, then to provide instructions absent nuance - iow, I suggest removing this section entirely and hand-wave over publishing for the time being.
I don't think we can avoid interdependent guides; the reality is too complex to allow for a single "does everything" document imo.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why not just redirect to npm docs ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh for sure they'll be inter-dependent. I just want to avoid a bunch of unfinished inter-dependent guides that are stuck in a spiderman meme.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So let's remove provenance and add note or let the security team write another article about it
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Similar to what @andrewbranch and @jakebailey said above, if you specify an
--outDir
, then you can use thepackage.json
"files"
array to avoid other hazards.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
or
.npmignore
, which avoids hazards endemic tofiles
:-)