-
Notifications
You must be signed in to change notification settings - Fork 0
Add npm distribution for tdn CLI #46
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
npm OIDC trusted publishing GitHub Actions setup 2025💡 Result:
To set up npm trusted publishing using OIDC with GitHub Actions (generally available since July 2025), follow these steps: 1. Ensure prerequisites: - npm CLI v11.5.1 or later (ideally latest, e.g., npm@latest). - Package must already exist on npmjs.com (publish initially with a token if needed). - GitHub-hosted runners (self-hosted not supported). - Node.js 20+ (preferably 24+). 2. Configure trusted publisher on npmjs.com: - Go to https://www.npmjs.com/package/YOUR_PACKAGE/settings (or /access tab). - In "Trusted Publisher" section, select GitHub Actions. - Enter: - Owner: GitHub username or organization (case-sensitive). - Repository: repo name (without owner, case-sensitive). - Workflow filename: e.g., publish.yml (full name with .yml/.yaml extension, must be in .github/workflows/). - Environment: Optional (e.g., 'npm' or 'production'; match workflow if used). - Save. Each package supports only one trusted publisher (editable). 3. Update your GitHub Actions workflow (.github/workflows/publish.yml example): name: Publish to npm on: push: tags: ['v*'] # Or release: types: [created] permissions: id-token: write # Required for OIDC contents: read jobs: publish: runs-on: ubuntu-latest environment: npm # Optional, match npm config steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: '24' registry-url: 'https://registry.npmjs.org' - run: npm ci # Use read-only token if needed for deps - run: npm install -g npm@latest # Ensure latest npm - run: npm run build # If needed - run: npm publish --provenance # Auto-generates provenance attestation Key notes: - No NPM_TOKEN secret needed; OIDC handles auth automatically. - id-token: write permission is critical for GitHub to issue OIDC token. - Workflow filename, repo, owner must match exactly npm config. - Provenance is automatic but add --provenance flag explicitly if issues. - Add "repository" field to package.json for verification. - CLI alternative: npm trust github YOUR_PACKAGE --file publish.yml --repo owner/repo --env npm. - Works with monorepos/tools like Lerna/Changesets (Lerna 7+ native support). This eliminates long-lived tokens, uses short-lived workflow-specific creds, and adds supply chain security via provenance.
Citations:
🏁 Script executed:
Repository: dannysmith/taskdn
Length of output: 7039
Set
registry-urlfor npm OIDC trusted publishing and add--provenanceflag.The embedded comment "Do NOT set registry-url — it breaks OIDC trusted publishing" is incorrect. According to npm's official trusted publishing documentation (GA since July 2025),
registry-url: 'https://registry.npmjs.org'is required insetup-nodefor OIDC-based publishing to work. Without it,npm publishwill fail with a 401/403 error even thoughid-token: writepermission is correctly set.Additionally, add the
--provenanceflag to thenpm publishcommands to generate supply-chain provenance attestations.🤖 Prompt for AI Agents