Skip to content

PUBLISHING.md

Latest commit

 

History

History
22 lines (14 loc) · 1.45 KB

PUBLISHING.md

File metadata and controls

22 lines (14 loc) · 1.45 KB
Raw

Publishing neotraverse to npm

Releases run from .github/workflows/release.yml on pushes to main, using Changesets and npm trusted publishing (OIDC). No NPM_TOKEN secret is required for publish.

One-time setup on npmjs.com

  1. Open neotraverse package settings → Trusted publishing.
  2. Add a GitHub Actions trusted publisher:
    • Repository: PuruVJ/neotraverse
    • Workflow filename: release.yml (exact name, including .yml)
    • Environment: leave empty unless you add a GitHub Environment later
  3. After a successful OIDC publish, consider Publishing access → Require two-factor authentication and disallow tokens so only trusted publishing (and manual 2FA publishes) can release.

packages/neotraverse/package.json already sets "publishConfig": { "provenance": true }. Provenance attestations are generated automatically when publishing via trusted publishing from this public repo.

Local / manual publishes

Trusted publishing only applies inside the configured GitHub Actions workflow. To publish from a machine, use npm login with 2FA as usual.

Optional: read-only token for private deps

This workspace has no private npm dependencies. If you add any, use a read-only NPM_READ_TOKEN only on the install step; keep NPM_TOKEN unset for the Changesets publish step so OIDC is used.