Repository navigation
MILAB-7081: release all packages via npm trusted publishing - #5
Open
mike-ainsel wants to merge 2 commits into
Open
mike-ainsel wants to merge 2 commits into
mike-ainsel wants to merge 2 commits into
Conversation
Minor bump for every public package so each one publishes once through its new npm trusted publisher (OIDC), which expires unless used within 2 days.
|
No reviewable files after applying ignore patterns. |
Patch instead of minor, and bump model/ui/workflow/test together with the published packages, as block changesets usually do. The .kind package stays untouched.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds one changeset that bumps every package of the repository (patch; model/ui/workflow/test included, .kind untouched), so the next release publishes all of them through npm trusted publishing (OIDC).
Why: npm stopped accepting the 2FA-bypass
NPMJS_TOKEN; this repo already publishes vianode-simple-pnpm.yaml@v4(pack on our runner, upload from a GitHub-hosted job). A new trusted publisher on npmjs.com expires unless a publish goes through it within 2 days, and a release only publishes the packages its changesets bump — so every package needs one release now.Merge only after the trusted publishers for these packages are configured (
infra/npm-trust/npm-trust-setup.sh apply), and within 2 days of that.No code changes.