Skip to content

Repository navigation

Take out the first publish's one-time npm token #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
rostislavrotaru wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −4
Draft

Take out the first publish's one-time npm token #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions .github/workflows/release-npm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,6 @@ jobs:
version: ${{ inputs.version }}
commit: ${{ inputs.commit }}
environment: release
secrets:
registry-token: ${{ secrets.NPM_FIRST_PUBLISH_TOKEN }}

dependents:
needs: release
Expand Down
3 changes: 1 addition & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,8 +258,7 @@ Runs of different filters go side by side; a second run of the same `ref` and `f

## Releases

The packages, `@noldova/checkpoints`, `@noldova/checkpoints.protocol` and the Git packages, `@noldova/checkpoints.git.<platform>-<arch>` for each target in `src/noldova.checkpoints.git/builds.json`, are published to npm by the "Release npm packages" workflow, `.github/workflows/release-npm.yml`, and a release never deletes a published version.
The first publish uses a one-time token that only the `release` environment holds, `NPM_FIRST_PUBLISH_TOKEN`, since npm's trusted publishing needs each package to exist; every later publish uses trusted publishing, so no token is stored.
The packages, `@noldova/checkpoints`, `@noldova/checkpoints.protocol` and the Git packages, `@noldova/checkpoints.git.<platform>-<arch>` for each target in `src/noldova.checkpoints.git/builds.json`, are published to npm by the "Release npm packages" workflow, `.github/workflows/release-npm.yml`, through npm's trusted publishing, so no token is stored, and a release never deletes a published version.
A maintainer starts it by hand with the version, which `version.json` and the root `package.json` hold, and the full hash of the commit on `main` to release; the version changes in a pull request before its release, in the Git packages' committed manifests too.
It calls the organization's shared npm release workflow, pinned to a full commit SHA, whose README says what each job does, in the `release` environment; after the release, its dependents job calls the organization's shared `update-dependents.yml` with the version and the commit.
The shared workflow reads the version from `version.json`, checks that the commit is on `main` and holds it, tags the commit, runs `npm ci` and `npm run build`, checks the archives in `_packages` with its pipelines tool, which lists the packages from the `package.json` files committed under `src`, so each Git package's manifest is committed as `src/noldova.checkpoints.git/packages/<target>/package.json`, and publishes them.
Expand Down
Loading