Choose a release automation tool for an SDK repository
Dry-run changesets, git-cliff, release-please, and semantic-release against a throwaway copy of the repository, then pick by where a person decides the release.
How-to › Section 12
Release and secure packages#
Publishing to registries, versioning and release automation, supply-chain integrity, and hardening clients and servers.
9 guides in 3 topics. Every guide compares its approaches and shows the output its commands printed.
Version, changelog and automate releases 2 guides
Semver for SDKs, deciding whether a regenerated SDK is a minor or major release, conventional commits, CHANGELOG generation, release candidates, human-gated production releases, deprecation policy and long-term support, scheduled live suites, regenerating SDKs in CI (the Speakeasy action, Fern CI, sdkgen doctor and release-and-tag as options).
Generate a changelog from conventional commits
Turn a commit range into CHANGELOG.md sections grouped by release, with dependency bumps and regeneration noise filtered out rather than published.
Secure the supply chain 2 guides
SLSA levels, Sigstore signing and cosign, SBOMs (CycloneDX, SPDX), provenance attestations, dependency pinning and lockfiles, Dependabot and Renovate, Socket, secret scanning, CVE runbooks, reproducible builds as a security property, and the trade-offs of a zero-dependency policy (the Voxgig multi-language libraries as one example of that policy).
Automate dependency updates with Dependabot or Renovate
Configure Dependabot and Renovate side by side for an SDK repository: a release-age delay on every update, and automerge only for the updates that earn it.
Write a CVE response runbook for an SDK
Take a private vulnerability report to a fixed release in every language you ship, then check the advisory against the OSV schema and your SDK list.
Harden clients and servers 5 guides
Runtime security for integrations: the OWASP API Security Top 10, TLS pinning, SSRF defence for user-supplied URLs, input validation at the boundary, mass assignment, security.txt (RFC 9116), secret redaction in logs and debug output, least-privilege tokens, dependency isolation, server-side key rotation.
Audit the scopes of the tokens your integrations use
Inventory every long-lived token your services and CI jobs hold, map each to a week of calls, and re-issue it at the smallest scope behind a flag.
Publish security.txt for an API
Serve an RFC 9116 security.txt so a researcher who finds a bug in your API knows where to send it, and add the expiry check that stops the file going stale.
Review an API against the OWASP API Security Top 10
Review a running API against the ten risks of the 2023 edition, recording a replayable request and an owner for every risk, and rank the gaps you find.
Rotate API keys without breaking your clients
Run two keys at once, watch which one each caller uses, and retire the old one on evidence rather than on a date somebody picked.
Test an API for broken object level authorization
Try every identifier with every credential and assert that a caller who does not own a resource gets the same answer as one asking for something that does not exist.
Generate the client instead of writing it#
Retries, timeouts, pagination and auth are the same problems in every client. Voxgig generates them from your OpenAPI description, in 23 languages, from one model.