Skip to content

Conversation

@abarmat
Copy link

@abarmat abarmat commented Aug 24, 2019

This is a change on the standard behaviour when releasing.

Release by default adds all the files in your local repo and then commit everything, this might cause undesired files to be pushed, a security risk depending on the files exposed.

This change will only commit package.json and package-lock.json as part of the bump version stage.

Closes #162

@fmiras
Copy link

fmiras commented Sep 5, 2019

cc @leo

lib/bump.js Outdated
try {
await runGitCommand(`git add -A && git commit -a -m "${version}"`);
await runGitCommand(
`git add package.json package-lock.json && git commit -m "${version}"`

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would fail if a package-lock.json is missing, i.e. if the user uses yarn.
You should check before if there is a package-lock.json or yarn.lock present in my opinion.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the feedback. I've added a check to commit package-lock.json only if it is present. I excluded yarn.lock from the commit as I see release is only changing package.json and package-lock.json in the increment() function.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Only commit package.json instead of all files

4 participants