From 8aaa47e0475f89c199b639caf6c2cb7aadfa5eae Mon Sep 17 00:00:00 2001 From: Rostislav Rotaru Date: Sat, 14 Nov 2026 17:34:57 -0800 Subject: [PATCH] Take out the first publish's one-time npm token Once the first publish has run, every publish uses npm's trusted publishing alone: the release job passes no registry-token, and the README says no token is stored. Closes #1 Agent: DEV3 (developer) Agent-Model: Anthropic Opus 5.5, Medium --- .github/workflows/release-npm.yml | 2 -- README.md | 3 +-- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml index cf2861f..08bb5f7 100644 --- a/.github/workflows/release-npm.yml +++ b/.github/workflows/release-npm.yml @@ -35,8 +35,6 @@ jobs: version: ${{ inputs.version }} commit: ${{ inputs.commit }} environment: release - secrets: - registry-token: ${{ secrets.NPM_FIRST_PUBLISH_TOKEN }} dependents: needs: release diff --git a/README.md b/README.md index a62a777..cd491f5 100644 --- a/README.md +++ b/README.md @@ -258,8 +258,7 @@ Runs of different filters go side by side; a second run of the same `ref` and `f ## Releases -The packages, `@noldova/checkpoints`, `@noldova/checkpoints.protocol` and the Git packages, `@noldova/checkpoints.git.-` for each target in `src/noldova.checkpoints.git/builds.json`, are published to npm by the "Release npm packages" workflow, `.github/workflows/release-npm.yml`, and a release never deletes a published version. -The first publish uses a one-time token that only the `release` environment holds, `NPM_FIRST_PUBLISH_TOKEN`, since npm's trusted publishing needs each package to exist; every later publish uses trusted publishing, so no token is stored. +The packages, `@noldova/checkpoints`, `@noldova/checkpoints.protocol` and the Git packages, `@noldova/checkpoints.git.-` for each target in `src/noldova.checkpoints.git/builds.json`, are published to npm by the "Release npm packages" workflow, `.github/workflows/release-npm.yml`, through npm's trusted publishing, so no token is stored, and a release never deletes a published version. A maintainer starts it by hand with the version, which `version.json` and the root `package.json` hold, and the full hash of the commit on `main` to release; the version changes in a pull request before its release, in the Git packages' committed manifests too. It calls the organization's shared npm release workflow, pinned to a full commit SHA, whose README says what each job does, in the `release` environment; after the release, its dependents job calls the organization's shared `update-dependents.yml` with the version and the commit. The shared workflow reads the version from `version.json`, checks that the commit is on `main` and holds it, tags the commit, runs `npm ci` and `npm run build`, checks the archives in `_packages` with its pipelines tool, which lists the packages from the `package.json` files committed under `src`, so each Git package's manifest is committed as `src/noldova.checkpoints.git/packages//package.json`, and publishes them.