DOCSEARCHbyAlgolia
Submit Docs

Universal Release Tool

website·Indexed 31 days ago

https://release.kjanat.com

A plugin-based release automation system for publishing packages across multiple ecosystems, including npm, Cargo (Rust), Docker, Python (PyPI), and Go. Built with Bun, it leverages Bun.secrets, Bun.semver, and Bun Shell for high-performance version management and secure credential storage. Configuration is managed via a single .release.yaml file.

Tokens
10.4K
Snippets
86
Records
104
Agent score
49%

What's inside Universal Release

  1. Overview of Bun.secrets for secure credential storage

    Universal Release utilizes the Bun.secrets API to store credentials securely using OS-level encryption. Key security benefits include:

    • OS-level encryption: Integrates with system keychains.
    • Memory zeroing: Sensitive data is cleared from memory to prevent exposure in memory dumps.
    • No environment leaks: Secrets are not visible in process listings (e.g., ps).
    • Automatic rotation: Secrets can be updated without requiring a process restart.

    Platform Support:

    • macOS: Keychain Services
    • Linux: libsecret (GNOME Keyring, KWallet)
    • Windows: Credential Manager

  2. Overview of Universal Release

    Universal Release is a production-grade, plugin-based release automation system designed to support multiple package ecosystems through a unified interface. It is built using Bun's native capability stack for high performance and security. Key capabilities include multi-ecosystem publishing (npm, Cargo, Docker, Python, Go), OS-level encrypted credential storage, full TypeScript type-safety, and coordinated releases for monorepos.

  3. Perform semantic versioning operations with Bun.semver

    Bun provides a native Bun.semver API implemented in Zig that is fully compatible with npm semver and approximately 20x faster than node-semver. It is built into the Bun runtime and requires no external dependencies.
    // Compare versions: returns -1, 0, or 1
Bun.semver.order("1.0.0", "1.0.1");

// Check if a version satisfies a range
Bun.semver.satisfies("1.2.3", "^1.0.0"); // true

// Sort an array of versions
const versions = ["1.0.0", "2.0.0", "1.5.0"];
versions.sort(Bun.semver.order);
// ["1.0.0", "1.5.0", "2.0.0"]

  4. Universal Release ecosystem support and features

    Universal Release is a high-performance release tool powered by Bun's native APIs. It provides OS-level encrypted credentials, auto-escaped shell commands, and built-in SBOM support. It currently supports the following ecosystems:

    • JavaScript/TypeScript: npm, pnpm, yarn, bun
    • Rust: Cargo
    • Containers: Docker
    • Python
    • Go

  6. Universal Release Tool Architecture Overview

    The Universal Release Tool is a plugin-based release automation system designed to support multiple package ecosystems via a unified interface. It uses a central ReleaseOrchestrator to coordinate a pipeline that includes configuration loading, ecosystem detection, validation, publishing, SBOM generation, attestation, and artifact signing.

  7. Configure Docker ecosystem settings

    Configure the Docker ecosystem in your configuration file to specify enabled status, target registries, validation steps, and target platforms. The platforms setting utilizes docker buildx internally for multi-architecture builds.
    ecosystems:
  docker:
    enabled: true
    registries:
      - ghcr.io/org/image
      - docker.io/org/image
      - registry.company.com/image
    validation:
      build: true
      scan: true
    platforms:
      - linux/amd64
      - linux/arm64

  8. Understand performance and security benefits of using Bun in Universal Release

    Universal Release utilizes Bun's native capabilities to achieve significant performance and security improvements over traditional Node.js alternatives:

    Performance Gains:

    • Startup Time: Cold starts are reduced to <50ms (approx. 4x faster).
    • Semver Operations: 20x faster using the Bun.semver API.
    • Shell Commands: 5x faster via native Zig implementation.
    • Memory Efficiency: 37% less memory usage (e.g., 28MB vs 45MB).

    Security Advantages:

    • Credential Storage: Uses Bun.secrets for OS-level secrets (Keychain/libsecret/Credential Manager).
    • Injection Prevention: Auto-escaped interpolation prevents shell injection.
    • Data Protection: Memory zeroing for sensitive data and prevention of environment variable leaks in logs.

  9. Migrate from node-semver to Bun.semver

    Since Bun.semver is built into the Bun runtime, you can remove the semver external dependency. Replace semver.satisfies with Bun.semver.satisfies and replace comparison methods like semver.gt (greater than) with Bun.semver.order checks.
    // Before (node-semver)
import semver from "semver";
semver.satisfies("1.2.3", "^1.0.0");
semver.gt("2.0.0", "1.0.0");

// After (Bun.semver)
Bun.semver.satisfies("1.2.3", "^1.0.0");
Bun.semver.order("2.0.0", "1.0.0") === 1; // Equivalent to gt

  10. Configure and execute your first release

    To perform a first release, you must create a .release.yaml configuration file, store your credentials securely using the CLI, and then execute the publish command. The configuration file defines the versioning scheme, commit convention, and ecosystem-specific validation rules (e.g., requiring a build and test for npm).
    # .release.yaml
version: 1
global:
  versionScheme: semantic
  commitConvention: conventional-commits
ecosystems:
  npm:
    enabled: true
    validation:
      build: true
      test: true
    # Store credentials securely
release secrets set NPM_TOKEN

# Publish the package
release publish

  11. Set up PyPI credentials for Universal Release

    Store your PyPI token as a secret using the release secrets set command. The token can be obtained from the PyPI account management page at pypi.org/manage/account/token.
    release secrets set PYPI_TOKEN

  12. Manage piping, redirection, and output in Bun Shell

    Bun Shell supports piping output to files, capturing command output as text, and combining multiple commands using standard shell operators like &&.
    // Pipe output to a file
await $`npm pack`.pipe(Bun.file("package.tgz"));

// Capture command output as a string
const version = await $`git describe --tags`.text();

// Combine commands using shell syntax
await $`npm run build && npm test`;