Allow approval of multiple staged packages at once

[willfarrell]

🏷️ Discussion Type

Product Feedback

Body

As a monorepo maintainer, approving each package individually is extremely time consuming. @middy/* for example is ~40 packages.

Having support for npm stage approve <id> <id> then open the browser to approve all with webauthn would be a huge win.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[leobalter]

thanks @willfarrell yes, we have this on track. I'm aware we need to ship a solution that functions better for maintainers who manage multiple packages and specially releasing many at the same time from monorepos.

I appreciate the feedback, please hang tight as we are working on this.

[lgarron]

I would also like to put in a strong word for this.

It is common for certain programs to be published as a main package with platform-specific packages that contain pre-built binaries (e.g. esbuild, biome), and I maintain one myself. I tried out npm stage publish¹, and found that it turned 0 steps into 30: lgarron/repo#11

If anything, I'm likely to develop inattention blindness and potentially approve a bogus staged package if someone snuck it in while I was clicking and authenticating away furiously. That doesn't even sound too implausible for the kind of targeted attack this is meant to mitigate, since it is obvious to predict when I'm about to approve staged packages: I have a long-established history of publishing releases to npm for my projects immediately after pushing a corresponding version bump commit to GitHub.

Some way to batch-approve staged packages would make the UX a lot more palatable, at the very least if it worked in cases where the packages reference each other and/or are staged together from the same device in quick succession.

Footnotes

1. The rest of this comment notwithstanding, I really appreciate that it required only a tiny tweak to the local flow to change npm publish to npm stage publish. It's not that I'm against publishing via CI or can't configure it — I was one of the first people to ever use trusted publishing for a package on npm! — but it comes with several tradeoffs and wouldn't work at all for the increasing number of projects I am moving to Codeberg. ↩