electron-userland
Don't publish by default on github builds
- Version: 22.9.1
When setting up a new github actions build, it attempts to publish the result automatically to github by default. I only noticed this because I received an unexpected error at the end of my build:
⨯ GitHub Personal Access Token is not set, neither programmatically, nor using env "GH_TOKEN"
This was a normal branch build, not tagged or anything, which I'd never normally want to publish.
This behaviour is pretty surprising, and in many cases it's a serious security risk if you don't expect it when there's github token in the environment for some other reason. Build output even in open source repos could easily contain secrets, especially when you're first setting up a new build - it would be easy for this to accidentally publish your code signing keys, for example.
Also, this surprising behaviour isn't documented - there's no default value for publish listed on the config value or CLI arguments.
There's been quite a few issues discussing this in the past, all now closed due to inactivity, e.g. https://github.com/electron-userland/electron-builder/issues/4546 and https://github.com/electron-userland/electron-builder/issues/1693. I think it's pretty clear that this is causing confusion.
Are you be open to disabling this? I think it's just a matter of making null the default value for publish config (that's the current workaround for this behaviour). I'd be happy to put a PR together for this, if you're open to that.
In general, I'd personally prefer to have electron-builder publish as a separate action, so I can build that into my CI workflow in more complex ways (e.g. testing a built distributable before it's published) but that's a separate question, and being able to opt-in with --publish is fine for now.
Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
![stale[bot] avatar](https://avatars.githubusercontent.com/in/1724?v=4 "Published by a pub.dev verified publisher"){kind=small}
This is still relevant, and AFAIK there's nothing blocking it and it's very easy to do (although it is a breaking change!). It would be great to hear thoughts from the maintainers on this issue.
Still an issue, I don't know why this behaviour was selected as default.
Seems like it tries to publish when my package.json script is named "release" and it does not when the name is something else like "dist".
This was working correctly in version 22.11.3, but has regressed in 22.11.7. Can it be fixed please? We are unable to build for non-release builds where we do NOT want to publish the built artifacts.
Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
This is still relevant, it has a fair few votes now, and AFAIK there's nothing blocking it and it's very easy to do (although it is a breaking change!). It would be great to hear thoughts from the maintainers on this issue.
Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
I haven't touched this myself in a while, but I still have my own workarounds in place for this and the docs haven't been noticeably updated, so AFAICT yes it's still relevant.
I'm very happy to close this if anybody can confirm that it has been resolved though!
node_modules/.bin/electron-builder --linux snap -c.snap.publish=never is not working for me :(
⨯ Cannot find module 'electron-publisher-never'
We attempted to put publish: [] into the linux key in our package.json config, and GitHub still tried to publish (and failed, due to the missing token). We needed to move to --publish=never on the command-line, specifically for the linux build.
It would be good to fix this. Or make it more obvious in the first place, then easy to turn off.
This was on electron-builder 24.6.3.
