Use NPM trusted publishing #725
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
amacneil
force-pushed
the
adrian/npm-publishing
branch
from
a5fe0d1 to
4cc96f7
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
amacneil
force-pushed
the
adrian/npm-publishing
branch
from
e64c4a9 to
401bf68
Compare
amacneil
force-pushed
the
adrian/npm-publishing
branch
from
e624d1a to
b3f1939
Compare
|
|
||
| for (const pkg of packages) { | ||
| await exec("npm", ["publish", "--access", "public", pkg]); | ||
| await exec("corepack", ["npm", "--version"]); |
There was a problem hiding this comment.
Debug version check runs redundantly inside publish loop
Low Severity
A debugging statement await exec("corepack", ["npm", "--version"]) was added inside the for loop that iterates over all packages. This causes the npm version to be printed once for every package being published, which is unnecessary and appears to be leftover debug code. If the version check was intentional for verification, it would only need to run once before the loop, not for each package iteration.
amacneil
force-pushed
the
adrian/npm-publishing
branch
from
a98dc9b to
f2c7400
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
NPM classic tokens are no more, trusted publishing is the future.
Prevent failures like https://github.com/amacneil/dbmate/actions/runs/20837451898/job/59865223681
Note
Adopts NPM OIDC trusted publishing and tidies GitHub workflows and package metadata.
npmjob: grantsid-tokenpermissions, enablescorepack, removes registry/token usage;typescript/publish.tsunsetsNODE_AUTH_TOKENand publishes viacorepack npm publish --provenancedependabot.yml; minor naming tweaks in post-release workflow.prettierrc.json; setspackageManagerintypescript/package.jsondbmateand template packages (repository format, bin mapping, homepage/author)pkg/dbmate/version.goto2.29.1Written by Cursor Bugbot for commit 00b792f. This will update automatically on new commits. Configure here.