Improve the release process to better handle OTP

I was able to release 9.4.0 following @ntwb’s instructions.

It was a bit clunky because:

1. I had to, as per the instructions, manually delete and re-checkout the .npmrc file
2. I had to run NPM_CONFIG_OTP=123456 npm run release to trigger the prerelease checks, wait for publish step to fail because the OTP would expire, then run NPM_CONFIG_OTP=987654 npm run release -- --skip-test --skip-cleanup to publish before the new OTP expired.

Hopefully number 1 will be addressed by @hudochenkov’s PR to npmpub.

Maybe number 2 can also be addressed in npmpub, maybe by an interactive prompt that asks you for a OTP just before the publish step?

It’d be great to keep using npmpub for these reasons.

Thoughts?

---

Background: the stylelint npm package maintainers have turned on two-factor auth following ESLint’s postmortem recommendations. So we now need to supply a one-time-password when publishing npm packages.

[hudochenkov]

I tried np last two releases of stylelint-order and was quite happy with it. It’s much better than npmpub experience I had this weekend 😃

I’d love to see how np’s OTP works in practice. If it’s an interactive prompt that works with our long-running tests then that would be superb.

Yes. In one of steps it asks for OTP in prompt.

For np we would need to add this line to .npmrc, otherwise git tag would be v10.1.0 (notice the “v”):

tag-version-prefix = ""

[jeddy3]

I’ve a bit more testing to do, but out of time for today

Excellent stuff. This is all very interesting.

I’d love to see how np’s OTP works in practice. If it’s an interactive prompt that works with our long-running tests then that would be superb.