Decision

<aside> ✅ Option: Why?

</aside>

Context

• npm package provenance: https://github.blog/2023-04-19-introducing-npm-package-provenance/
• https://github.com/mui/material-ui/issues/38321
• Bot npm account: https://www.notion.so/mui-org/npm-mui-release-bot-1712517009f14081afbe7202e0584fdc?pvs=4

Problems

1. The more people in the team, the more account with write access to npm to publish the packages, and the bigger the surface attack becomes.

Options

A.

B.

Proposal

Option:

Why?

Benchmarks

• https://github.com/facebook/react/tree/main/scripts/release

• Next.js https://www.npmjs.com/package/next

  

• https://github.com/release-it/release-it Release CLI with wide usage across OS projects