From 8e040de3b9bd6e081337b26984d4ea304e2e6ee4 Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Wed, 9 Sep 2026 13:12:19 -0500 Subject: [PATCH 1/2] ci: publish with npm trusted publishing The @variablelab/portless package now trusts the release.yml workflow in the Release environment, so the publish job exchanges its GitHub OIDC token for a short-lived npm token. Drop the NODE_AUTH_TOKEN env from the publish step, which makes it identical to upstream's again, and describe the setup and the token revocation in docs/RELEASING.md. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01KVTfcx388VGYh1ecW9b7BJ --- .github/workflows/release.yml | 2 -- docs/RELEASING.md | 11 ++++++++--- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7047e201..ea64e5b4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -96,8 +96,6 @@ jobs: - name: Publish to npm run: npm publish --provenance working-directory: packages/portless - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} github-release: name: Create GitHub Release diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 96f88b08..aa3bb6d6 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -10,9 +10,14 @@ Pushing a new version to `main` is what publishes. There is no separate approval ## One-time setup -- Create an npm granular access token with publish rights on the `@variablelab` scope and "bypass two-factor authentication" enabled (npm requires this for publishes from CI). Add it to the repository as the `NPM_TOKEN` secret under Settings, Secrets and variables, Actions. -- The publish job runs in the `Release` GitHub environment. GitHub creates it on the first run. Add required reviewers to that environment if you want a manual gate before every publish. -- Alternative: configure [npm trusted publishing](https://docs.npmjs.com/trusted-publishers) for `variableland/portless` with the `release.yml` workflow, then delete the `NODE_AUTH_TOKEN` line from the publish step. Provenance works with either method. +- Publishing uses [npm trusted publishing](https://docs.npmjs.com/trusted-publishers): the `@variablelab/portless` package on npm trusts the `release.yml` workflow of `variableland/portless` running in the `Release` environment, and the job exchanges its GitHub OIDC token for a short-lived npm token. No long-lived token is stored. To re-create the relationship (interactive 2FA): + + ```bash + npm trust github @variablelab/portless --file release.yml --repo variableland/portless --env Release --allow-publish + ``` + +- The `Release` GitHub environment exists. Add required reviewers there if you want a manual gate before every publish. +- The `NPM_TOKEN` secret used for the first release (0.0.1) is no longer read by the workflow. Revoke it on npmjs.com and delete the secret after the first successful OIDC publish. ## Cut a release From 3384e8d3ba495986c2ce44cfccda8f6223dbbb6d Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Wed, 9 Sep 2026 13:12:20 -0500 Subject: [PATCH 2/2] chore: fix contributors entry so npm keeps the url npm parses a parenthesized part of a person's name as the url, so "Ricardo (rcrd)" was published with url "rcrd" and the real url dropped. Use a plain name and the GitHub profile url. Metadata only; no release. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01KVTfcx388VGYh1ecW9b7BJ --- packages/portless/package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/portless/package.json b/packages/portless/package.json index 213681ba..3f873535 100644 --- a/packages/portless/package.json +++ b/packages/portless/package.json @@ -55,9 +55,9 @@ "author": "Vercel Labs", "contributors": [ { - "name": "Ricardo (rcrd)", + "name": "Ricardo Q. Bazan", "email": "ricardo@variable.land", - "url": "https://github.com/variableland/portless" + "url": "https://github.com/rqbazan" } ], "license": "Apache-2.0",