Document version bumping / release process

It was suggested that the mechanism for bumping a package version is to do pnpx changeset and follow the prompts to generate a changeset. I added that to the README, but still have significant confusion.

I ran it and it added a file to the .changeset directory. Ok, now what?

The pnpx changeset command had said:

🦋 The following packages will be patch bumped: 🦋 @sveltejs/snowpack-config@1.0.0-next.2

But I don’t really understand when or where that happens. The command changed nothing except adding a file to the .changeset directory and there’s no indication of what might consume that file. I saw Rich’s commits were also bumping the package.json, but I’m not sure how that happened. Was there another command to run or did he do it manually?

I followed up by bumping the version manually. I’m still not sure what to do from here though. Do I need to bug @Rich-Harris to cut a new release? Is there anyone else who can do it?

I’m facing three different things that are broken right now in SvelteKit and it’s super frustrating that there doesn’t seem to be anything I can do to get fixes out. Maybe we could have GitHub Actions automatically publish changes or expand the set of people who can publish SvelteKit?

[GrygrFlzr]

According to npm…

https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification:

You may also choose to allow publishing with either two-factor authentication or with automation tokens. This lets you configure automation tokens in a CI/CD workflow, but requires two-factor authentication from interactive publishes.

https://docs.npmjs.com/creating-and-viewing-access-tokens:

Automation: an automation token can download packages and publish new ones, but if you have two-factor authentication (2FA) configured on your account, it will not be enforced. You can use an automation token in continuous integration workflows and other automation systems to publish a package even when you cannot enter a one-time passcode. This is recommended for automation workflows where you are publishing new packages.

So an automation token should skip 2FA.

[Rich-Harris]

The email address associated with svelte-admin seems to indicate that it was created by you @Rich-Harris.

Oh.

Is the idea that it’s safe for that user to not have 2FA enabled because its tokens will only live in the CI service

I think so, yeah. It seems to be ‘how it’s done’ so I assume smarter people than me have thought about it and decided it’s okay.

https://github.com/sveltejs/kit/pull/417