diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 3e770c6..4741045 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -1,10 +1,10 @@ { "name": "continuous-actions", "owner": { - "name": "Continuous-Actions" + "name": "continuous-actions" }, "metadata": { - "description": "Developer tools from Continuous-Actions." + "description": "Developer tools from continuous-actions." }, "plugins": [ { diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 84b95f4..dc147a1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -60,7 +60,7 @@ jobs: github.event.pull_request.head.repo.full_name == github.repository && (github.event.action != 'review_requested' || github.event.requested_team.slug == 'claude-review') - uses: Continuous-Actions/shared/.github/workflows/claude-review.yml@180631d76d2aab123900a17e27f2212331266137 + uses: continuous-actions/shared/.github/workflows/claude-review.yml@180631d76d2aab123900a17e27f2212331266137 secrets: CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} permissions: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ed74d8a..eec4bbc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ permissions: jobs: npm: # Forks inherit this workflow; only the upstream repository publishes. - if: github.repository == 'Continuous-Actions/go-tokenless' && github.event_name == 'push' + if: github.repository == 'continuous-actions/go-tokenless' && github.event_name == 'push' runs-on: ubuntu-latest permissions: contents: read @@ -43,7 +43,7 @@ jobs: github: needs: npm - if: github.repository == 'Continuous-Actions/go-tokenless' && github.event_name == 'push' + if: github.repository == 'continuous-actions/go-tokenless' && github.event_name == 'push' runs-on: ubuntu-latest permissions: contents: write @@ -87,7 +87,7 @@ jobs: mcp-registry: needs: npm if: >- - always() && github.repository == 'Continuous-Actions/go-tokenless' && + always() && github.repository == 'continuous-actions/go-tokenless' && (needs.npm.result == 'success' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && needs.npm.result == 'skipped')) runs-on: ubuntu-latest diff --git a/LICENSE b/LICENSE index a4f4714..f4a2c3a 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2026 Continuous-Actions +Copyright (c) 2026 continuous-actions Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/PRIVACY.md b/PRIVACY.md index af8c58e..2745cfc 100644 --- a/PRIVACY.md +++ b/PRIVACY.md @@ -7,4 +7,4 @@ go-tokenless (the CLI, the MCP server, the Agent Skill and the Claude and Gemini - **Never accessed:** your secrets, tokens, npm account or GitHub account. - **Third parties:** npm's own privacy policy covers requests to the npm registry. -Questions: open an issue at https://github.com/Continuous-Actions/go-tokenless/issues. +Questions: open an issue at https://github.com/continuous-actions/go-tokenless/issues. diff --git a/README.md b/README.md index 07903a5..4e52de3 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,13 @@

- go-tokenless: removes NODE_AUTH_TOKEN from a release workflow and adds id-token: write + go-tokenless: removes NODE_AUTH_TOKEN from a release workflow and adds id-token: write

# go-tokenless -[![CI](https://github.com/Continuous-Actions/go-tokenless/actions/workflows/ci.yml/badge.svg)](https://github.com/Continuous-Actions/go-tokenless/actions/workflows/ci.yml) +[![CI](https://github.com/continuous-actions/go-tokenless/actions/workflows/ci.yml/badge.svg)](https://github.com/continuous-actions/go-tokenless/actions/workflows/ci.yml) [![npm](https://img.shields.io/npm/v/go-tokenless?logo=npm)](https://www.npmjs.com/package/go-tokenless) [![MCP Registry](https://img.shields.io/badge/MCP_Registry-go--tokenless-blue)](https://registry.modelcontextprotocol.io/v0/servers?search=go-tokenless) -[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Continuous-Actions/go-tokenless/badge)](https://scorecard.dev/viewer/?uri=github.com/Continuous-Actions/go-tokenless) +[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/continuous-actions/go-tokenless/badge)](https://scorecard.dev/viewer/?uri=github.com/continuous-actions/go-tokenless) [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE) **Delete your `NPM_TOKEN`.** One command switches npm publishing in GitHub Actions to [trusted publishing](https://docs.npmjs.com/trusted-publishers) (OIDC). No long-lived token is stored anywhere, and every release gets a provenance badge. @@ -131,17 +131,17 @@ go-tokenless is built to be run by coding agents: `--json` output, clear exit co | Client | Setup | |---|---| | Claude directory (claude.ai, Cowork, Claude Code) | Submitted to [Anthropic's plugin directory](https://claude.ai/directory) and awaiting approval. Once listed: open the directory, search **go-tokenless** and select **Add**. It then syncs to Claude Code as `go-tokenless@synced`. Until then, use the marketplace command below | -| Claude Code (plugin: skill + MCP) | `/plugin marketplace add Continuous-Actions/go-tokenless` then `/plugin install go-tokenless@continuous-actions` | +| Claude Code (plugin: skill + MCP) | `/plugin marketplace add continuous-actions/go-tokenless` then `/plugin install go-tokenless@continuous-actions` | | Claude Code (MCP only) | `claude mcp add go-tokenless -- npx -y go-tokenless mcp` | -| Gemini CLI | `gemini extensions install https://github.com/Continuous-Actions/go-tokenless` | +| Gemini CLI | `gemini extensions install https://github.com/continuous-actions/go-tokenless` | | Cursor, VS Code, others | Add the MCP config below | -| Any agent with skills | `npx skills add Continuous-Actions/go-tokenless` | +| Any agent with skills | `npx skills add continuous-actions/go-tokenless` | ```json { "mcpServers": { "go-tokenless": { "command": "npx", "args": ["-y", "go-tokenless", "mcp"] } } } ``` -MCP tools: `plan_trusted_publishing` (read-only) and `apply_trusted_publishing` (writes files; no git or network writes). It is listed in the [MCP Registry](https://registry.modelcontextprotocol.io/v0/servers?search=go-tokenless) as `io.github.Continuous-Actions/go-tokenless`. See also [llms.txt](llms.txt) and the [Agent Skill](skills/go-tokenless/SKILL.md). +MCP tools: `plan_trusted_publishing` (read-only) and `apply_trusted_publishing` (writes files; no git or network writes). It is listed in the [MCP Registry](https://registry.modelcontextprotocol.io/v0/servers?search=go-tokenless) as `io.github.continuous-actions/go-tokenless`. See also [llms.txt](llms.txt) and the [Agent Skill](skills/go-tokenless/SKILL.md). ## Options @@ -194,4 +194,4 @@ Issues and pull requests are welcome. Run `corepack enable && yarn install && ya ## License -[MIT](LICENSE) © Continuous-Actions +[MIT](LICENSE) © continuous-actions diff --git a/claude-plugin/LICENSE b/claude-plugin/LICENSE index a4f4714..f4a2c3a 100644 --- a/claude-plugin/LICENSE +++ b/claude-plugin/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2026 Continuous-Actions +Copyright (c) 2026 continuous-actions Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/claude-plugin/README.md b/claude-plugin/README.md index 1283371..7fa0c5e 100644 --- a/claude-plugin/README.md +++ b/claude-plugin/README.md @@ -9,7 +9,7 @@ The plugin gives Claude an Agent Skill and an MCP server. Ask *"Move our npm pub ## What it runs and accesses -- **MCP server:** started with `npx -y go-tokenless@ mcp`, the published [go-tokenless](https://www.npmjs.com/package/go-tokenless) npm package. Its source is at https://github.com/Continuous-Actions/go-tokenless. +- **MCP server:** started with `npx -y go-tokenless@ mcp`, the published [go-tokenless](https://www.npmjs.com/package/go-tokenless) npm package. Its source is at https://github.com/continuous-actions/go-tokenless. - **Files:** it reads `.github/workflows/*.yml`, `package.json` files and scripts in the repository you point it at. The apply tool writes only to workflow and `package.json` files inside that repository, and never follows links out of it. - **Network:** read-only `GET` requests to `https://registry.npmjs.org/`, to check that each package already exists (the `offline` option turns this off). Nothing else is fetched or sent. There is no telemetry. - **Never:** it doesn't run repository code, read secrets or environment tokens, change git state, or contact npm or GitHub on your behalf. @@ -19,4 +19,4 @@ The plugin gives Claude an Agent Skill and an MCP server. Ask *"Move our npm pub - `plan_trusted_publishing`: read-only. Returns the plan, the diff, the trust commands and the next steps. - `apply_trusted_publishing`: writes the planned file changes. -Full documentation: https://github.com/Continuous-Actions/go-tokenless#readme. License: MIT. +Full documentation: https://github.com/continuous-actions/go-tokenless#readme. License: MIT. diff --git a/docs/errors/e422-repository-url.md b/docs/errors/e422-repository-url.md index 0eaf582..e1ff363 100644 --- a/docs/errors/e422-repository-url.md +++ b/docs/errors/e422-repository-url.md @@ -33,6 +33,6 @@ With provenance (automatic under trusted publishing), npm checks that `package.j npx go-tokenless apply ``` -[go-tokenless](https://github.com/Continuous-Actions/go-tokenless) adds or fixes `repository` in every publishable package. It only rewrites shorthands and missing fields, and edits only that property's text. If `repository` points at a different repo, it stops and reports it instead. +[go-tokenless](https://github.com/continuous-actions/go-tokenless) adds or fixes `repository` in every publishable package. It only rewrites shorthands and missing fields, and edits only that property's text. If `repository` points at a different repo, it stops and reports it instead. [← All errors](../) diff --git a/docs/errors/eneedauth.md b/docs/errors/eneedauth.md index 736d8d0..bf977bf 100644 --- a/docs/errors/eneedauth.md +++ b/docs/errors/eneedauth.md @@ -29,6 +29,6 @@ In a GitHub Actions release that uses [trusted publishing](https://docs.npmjs.co npx go-tokenless ``` -[go-tokenless](https://github.com/Continuous-Actions/go-tokenless) reads your workflows and lists exactly what's missing: the permission, the npm version, `registry-url`, leftover tokens and `repository.url`. `npx go-tokenless apply` fixes them. +[go-tokenless](https://github.com/continuous-actions/go-tokenless) reads your workflows and lists exactly what's missing: the permission, the npm version, `registry-url`, leftover tokens and `repository.url`. `npx go-tokenless apply` fixes them. [← All errors](../) diff --git a/docs/index.md b/docs/index.md index ba36b37..a9f8dd9 100644 --- a/docs/index.md +++ b/docs/index.md @@ -16,7 +16,7 @@ npx go-tokenless # preview: lists every change and shows a diff, writes npx go-tokenless apply # makes the changes and prints the npm trust commands ``` -[go-tokenless](https://github.com/Continuous-Actions/go-tokenless) (MIT) edits only the lines that need changing. It refuses unsafe cases instead of guessing: +[go-tokenless](https://github.com/continuous-actions/go-tokenless) (MIT) edits only the lines that need changing. It refuses unsafe cases instead of guessing: - self-hosted runners - publish jobs reachable from `pull_request_target` or `issue_comment` @@ -47,4 +47,4 @@ npx go-tokenless apply # makes the changes and prints the npm trust commands claude mcp add go-tokenless -- npx -y go-tokenless mcp ``` -It's also a Claude Code plugin, a Gemini CLI extension and an Agent Skill. See the [README](https://github.com/Continuous-Actions/go-tokenless#use-it-with-ai-agents). +It's also a Claude Code plugin, a Gemini CLI extension and an Agent Skill. See the [README](https://github.com/continuous-actions/go-tokenless#use-it-with-ai-agents). diff --git a/llms.txt b/llms.txt index 9e06dca..ab7ca91 100644 --- a/llms.txt +++ b/llms.txt @@ -27,7 +27,7 @@ npm publish, pnpm publish, Yarn Berry `yarn npm publish` (4.10.3+), changesets/a ## Docs -- README: https://github.com/Continuous-Actions/go-tokenless#readme +- README: https://github.com/continuous-actions/go-tokenless#readme - Error guides (ENEEDAUTH, E404 PUT, E422 repository.url, leftover tokens, 2FA-bypass notice): https://continuous-actions.github.io/go-tokenless/ -- Agent Skill: https://github.com/Continuous-Actions/go-tokenless/blob/main/skills/go-tokenless/SKILL.md +- Agent Skill: https://github.com/continuous-actions/go-tokenless/blob/main/skills/go-tokenless/SKILL.md - npm trusted publishing: https://docs.npmjs.com/trusted-publishers diff --git a/package.json b/package.json index 93d1a6a..7a00c67 100644 --- a/package.json +++ b/package.json @@ -18,8 +18,8 @@ "type": "git", "url": "git+https://github.com/Continuous-Actions/go-tokenless.git" }, - "homepage": "https://github.com/Continuous-Actions/go-tokenless#readme", - "bugs": "https://github.com/Continuous-Actions/go-tokenless/issues", + "homepage": "https://github.com/continuous-actions/go-tokenless#readme", + "bugs": "https://github.com/continuous-actions/go-tokenless/issues", "mcpName": "io.github.Continuous-Actions/go-tokenless", "scripts": { "build": "node scripts/build.mjs", diff --git a/scripts/build.mjs b/scripts/build.mjs index a603546..9b9ebde 100644 --- a/scripts/build.mjs +++ b/scripts/build.mjs @@ -18,6 +18,6 @@ await build({ legalComments: 'eof', logLevel: 'warning', define: { 'process.env.GO_TOKENLESS_VERSION': JSON.stringify(version) }, - banner: { js: `#!/usr/bin/env node\n// go-tokenless (MIT) https://github.com/Continuous-Actions/go-tokenless. Generated file, do not edit.\nimport { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);` }, + banner: { js: `#!/usr/bin/env node\n// go-tokenless (MIT) https://github.com/continuous-actions/go-tokenless. Generated file, do not edit.\nimport { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);` }, }); console.log(`dist/cli.js: ${statSync('dist/cli.js').size} bytes`); diff --git a/src/cli.ts b/src/cli.ts index d77b4ae..86daa1c 100644 --- a/src/cli.ts +++ b/src/cli.ts @@ -30,7 +30,7 @@ Options: -v, --version Show the version Exit codes: 0 ok, 1 blocked (errors to fix by hand), 2 usage error, 3 unexpected error. -Docs: https://github.com/Continuous-Actions/go-tokenless`; +Docs: https://github.com/continuous-actions/go-tokenless`; export async function main(argv: string[]): Promise { const args = [...argv];