Ask HN: 是时候停止在 package.json 中添加版本号了吗？
1 分•作者: xDmytri•4 个月前
我做了一个名为 `hipp` 的工具，用于消除 npm 包中类似 'chore: version bump' 的提交，并附带了简单的内容完整性检查作为额外功能。
这个想法是保持 package.json 的版本为 0.0.0，在 git 中为你的发布打标签（例如，v1.2.3），然后发布。
HIPP 会动态地重写版本，并在 README 中附加一个带有一次性密钥的签名清单。
我有没有遗漏什么，导致这个想法不好？它简化了我的工作流程，也提供了一种证明 npm 中的内容与 git 中该版本内容相同的方法。它还确保了发布到 npm 的人与提交与该版本相关的人是同一个人。
除了 git 和 npm 之外，没有任何依赖。
总结：
git tag v1.0.0
git push origin main --tags
npx @dk/hipp
npx @dk/hipp verify
https://www.npmjs.com/package/@dk/hipp
查看原文
I made a tool called `hipp` to eliminate 'chore: version bump' commits for npm packages, and I included simple content integrity as a bonus.<p>The idea is to keep the package.json version at 0.0.0, tag your release in git (e.g., v1.2.3), and publish.<p>HIPP rewrites the version on the fly and appends a signed manifest to the README with a disposable key.<p>Is there something I haven't thought of that makes this a bad idea? It simplifies my workflow and also provides a way to prove that what's in npm is the same as what's in git for that version. It also ensures that the person who published to npm is the same as the person who made the commit tied to that version.<p>No dependencies on anything other than git and npm.<p>TL;DR<p>git tag v1.0.0<p>git push origin main --tags<p>npx @dk/hipp<p>npx @dk/hipp verify<p>https://www.npmjs.com/package/@dk/hipp