Repository navigation
ci: stage releases on npm for 2FA approval instead of publishing directly - #52
Merged
Merged
Conversation
npm normalizes bin paths without it and warned on every publish that the entry was invalid. The installed binary is unchanged.
…ctly The trusted publisher should only allow npm stage publish, so a release from CI stays private until a maintainer approves it with 2FA. A compromised workflow run can no longer put a version in front of users. Staging an existing version is an error, so the job skips versions already on npm. Mirrors chhoumann/obsidian-test-kit#7.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switches obsidian-e2e to npm staged publishing, the same change as chhoumann/obsidian-test-kit#7.
What changes:
releaseis nownpm stage publish --provenanceinstead ofchangeset publish. CI uploads each version privately with a provenance attestation, and it goes public only after a maintainer runsnpm stage approve <stage-id>with 2FA. The stage ID is in the Release workflow log under "Stage on npm". A compromised workflow run can therefore stage a version but never publish one.package.json's version is already on npm.changeset publishdid that check itself, and staging an existing version is a hard error, so without the guard every push to main with no pending changesets would fail.npm stageshipped in 11.15.0..changeset/README.mdnow describe the approval step and the stage-only trusted publisher.binpath from./dist/runner/bin.mjstodist/runner/bin.mjs. npm normalizes to that form anyway, and it warned on every publish that the bin entry was "invalid and removed". The message is misleading, since npm keeps the entry, and the installed binary is the same.I ran
pnpm run release:checklocally and it passes:vp checkis clean and 404 tests pass. A localnpm stage publish --provenance --dry-runwith an empty userconfig packs the expected 30 files and errors on the already-published 0.15.0, which is the case the guard handles.This only takes effect once the npmjs.com setting changes. On the obsidian-e2e package's Trusted Publisher, untick "Allow
npm publish". Until then, CI stages and the publisher could still publish directly.