Random q - do folks out there care / think about how much plastic they are exposed to? Talking things like coffee gear, water bottles / mugs, cookware, baby products. Do you research before you buy? Would you like to minimize but takes too much work? Never think about it? I'm cooking something :)

Building a new CLI tool? Here is your toolkit: - gunshi (cli framework) - clack/prompts (cli prompts) - lefthook (git hooks) - tsdown (ts build tool) - bumpy (changelog + publishing) - fledgling (bonus) - for initial npm claim and oidc setup

Citing the recent bun drama, David Bowie will be re-releasing old albums as "Rusty Stardust"

Super fun chatting with @brandonwhichard.com about varlock. He is a real user - found us through a listener and has been using it ever since. Have a listen! 🎧

All varlock docs package links and readmes (as of their next publish) now point to @npmx.dev ♥️🧙‍♂️

PSA - @astro.build + yaml w/ md + @cloudflare.social + LLMs is a killer toolkit to build comprehensive resources of info gathered from all over the web. No servers, no DB, no tedious hand-maintaining data. Ideas that would take way too much effort before are now easily within reach.

🧙‍♂️ [email protected] adds arbitrary codegen. As well as built-in support for php, python, go, rust - so you get a fully typed+coerced env loader to use in your code. Plugins can add codegen types - new possibilities to generate for k8s, terraform... anything! varlock.dev/guides/code-...

Finally digging into a proper plugin system for bumpy 🐸 (bumpy.varlock.dev). This means native support / recipes to release to common js targets like jsr, vscode marketplace, and non-js things like PyPi, and crates.io

btw - I added condiments to my food storage tips site 🫙🍓

varlock will soon support arbitrary codegen registered in plugins. Opens up fun possibilities - generate zod schema, k8s configmap/secret split based on what's marked @sensitive, terraform vars Plus new built-in env generation for rust, go, python, php. Excited to see how you will use it! 🧙‍♂️✨

varlock credential broker is coming very soon! child process (usually AI agent) gets _placeholders_, swapped for real creds at the network boundary. Rules managed from your .env.schema - use our existing plugins to pull from anywhere. Can't wait to share it :)

Hey @pnpm.io - following up on our recent thread about using valid env vars for configuring npmrc auth -- github.com/orgs/pnpm/di...

npm staged publishing approval tool MVP is working. Batch approve multiple packages, multi-sig approval policies, audit trails, batches created in CI via OIDC. NPM token encrypted by passkeys so we never see them. Using staged publishing? Wanting to but avoiding because its clunky? Let me know!

My new npm staged publishing approval tool is called "stageflight" - HMU if you want to beta test! Provides batch approvals, multi-sig policies w/ audit trails, approvers don't need publishing rights. Cloud-hosted but secrets encrypted w/ your passkeys. optional ai review too in future

Working on something pretty rad that’s going to help make npm staged publishing feel much nicer - and even more secure. Like/comment/DM if this is up your alley and you want to help me beta test.

🐸 bumpy.varlock.dev continues to get better and more solid. If you release npm packages - take it for a spin and let me know what you think! Couples very nicely with 🐣 fledgling.varlock.dev especially in a monorepo :)

Doesn't exactly inspire confidence when things show an error message even when they work. A few npm interactions regularly do this for me - approving staged publishing being one of them.

Say hello to 🐣 fledgling - a new tool to create new npm packages and setup/sync trusted publishing (OIDC) settings. Works great for one offs, but even better in a monorepo! just `npx fledgling`

🥚🐣🐥 Hatching something fun tomorrow. A very nice complement to bumpy 🐸

New varlock+mise guide varlock.dev/integrations... Would appreciate a look from any heavy mise users!

How many of y'all use @1password.bsky.social wired into dev/agent workflows? varlock now has built-in caching (secured by secure enclave), meaning fewer roundtrips to 1pass servers. Much smoother for when things are reloading a lot. varlock.dev/plugins/1pas... varlock.dev/guides/cachi...

Honestly didn't know what to expect when I started on prerelease channels for 🐸 bumpy (publish v1.2.3-rc.1 and tag as "next") I knew it's awkward and hard to deal with - one of most complained about parts of changesets 🦋 But the end result is actually really good! github.com/dmno-dev/bum...

pre-release channels are looking good on bumpy 🐸 Same workflow, just merge to _next_. Then merge _next_ to _main_. Anyone out there using a npm preview release channel and not quite happy with their current setup? Hit me up! bumpy.varlock.dev

Looking at adding long-lived pre-release channels to bumpy.varlock.dev (one most confusing/complained about parts of changesets 🦋) not implemented yet, but here is the plan -- github.com/dmno-dev/bum... If anyone has thought about this deeply and has any feedback I'd be very grateful!

when starting a new project repo, choosing a tech stack, etc, i try to always ask the hard and important questions right up front, such as: “how do i work this?”, “what is that beautiful house?”, “where does that highway go to?”, “am I right? am I wrong?”, and “my god! what have I done?”

set up bumpy.varlock.dev in your repo and I'll send you a sweet bumpy sticker 🐸

that's what I like to see 🧙‍♂️✨🔐

Updated bumpy.varlock.dev recommended release workflow. OIDC token is now injected only during publish, not during create/update version PR, also locked down to a github environment with branch protections. Everyone go turn on staged publishing now! And use bumpy :) 🏗️🐸🔐

Any really great examples of css view transitions? I built howtostore.food as a fun side project and went pretty deep on it. Haven't really seen anything like it.

⚡️ We're looking for a DevRel person at @vlt.sh - based in our Toronto 🇨🇦 HQ. You'll work closely w/ me & should love the idea of owning various aspects of product marketing. You'll be vlt's biggest fan & advocate; molding this unique role in a way that plays to your strengths & ours.

If you are using varlock, try `npx skills add dmno-dev/varlock` to install our new varlock skill. I wish the DX around this was better to keep skills published along with npm modules in sync, but this seemed like the best solution for now.

think varlock is neat? Please go “like” it on npmx npmx.dev/package/varl... Bumpy too :) npmx.dev/package/@var...

Putting together a bsky list of folks who build/maintain release tooling (e.g., changesets, release-it, uppt, bumpy, etc). What tools / people am I missing bsky.app/profile/did:...

bumpy.varlock.dev now adds section to GH release showing targets w/ status+links. Uses hidden metadata, release updated until finalized. Next step is adding plugins so you can release to multiple places (npm, jsr, vscode extension marketplace, etc) cc @nullvoxpopuli.com

What is current best practice on how to include/publish skills with npm packages? Seems like the wild west out there...

📦 Set up staged publishing with approximately 1 click per package lavamoat.github.io/stageclicker/ Without sharing any of your permissions or exposing access to anything.

While on the topic of NPM, the varlock package now has ~125k weekly downloads, but is still not indexed by google. Some of our other packages have minimal usage are a indexed properly. Any idea what is going on...? Anyone else have this experience?

I'd love to build some better workflows around staged publishing approval, rather than rely on npm's UI and 2fa. Looking to get this feedback to the right folks github.com/orgs/communi... /cc npm release tool authors @danielroe.dev @notwes.bsky.social @nullvoxpopuli.com @jovidecroock.com

🐸 bumpy.varlock.dev now supports npm staged publishing for complex monorepos 🎉 - create bump file(s) in PR w/ bump level (patch/minor/major) and changelog content - PR merges, a "release PR" is created/updated - release PR merges, new package(s) staged - approve on npm w/ 2fa to release

Should we just fund the company by selling merch? 🧙‍♂️🤘

this is a fantastic thread full of very useful advice + some golden tools 🏆

As of today @varlock.dev has OIDC workload identity support - this means that for some popular combos of deployment platform + secret storage, you no longer need a secret-zero to pull the rest of your sensitive data. check out varlock.dev/guides/oidc/ to get started

Varlock v1 also now has built-in macOS keychain support. Write `ITEM=keychain(prompt)` and you get a native mac popup to choose/add an item. It writes back to your schema with the id. ACL is limited and reading is gated behind fingerprint.

Pushed a HUGE varlock@v1 featuring built-in local encryption via native binaries. No extra setup, and you get native DX to decrypt using biometrics. This is for local git-ignored values, and acts as foundation for future caching + team vaults. Get EVERY secret out of plaintext!

Introducing bumpy 🐸 - a new version/release/changelog tool (carefully crafted slop fork of changesets 🦋) Fixes 100s of open issues, much simpler, more flexible. We use it to release @varlock.dev and 25+ linked plugins/libs. bumpy.varlock.dev

DMNO (varlock) was one of the fastest growing open-source orgs on GitHub in Q1. Thanks for the recognition @supabase.com >commitvc #osscarindex osscar.dev/org/dmno-dev

To celebrate @cloudflare.social's epic week - the new @varlock.dev workers integration got a revamp and it is RAD. We totally fixed env vars in workers. varlock.dev/integrations... Full validation, pull from anywhere, set env atomically w/ each deploy. No more mix of .dev.vars/.env/wrangler.toml

Want to realize you've been storing your celery wrong your whole life? check out howtostore.food 🥦🥕🍎 Idea has been kicking around in my head for 10+ years, finally made feasible by AI. Still more to do, but very proud of the native view transitions! (built on @astro.build and @cloudflare.social)