@agilecustoms/envctl 0.38.3 → 1.1.0

package/README.md

@@ -24,35 +24,38 @@ npm view @agilecustoms/envctl version # show latest version available (without i
 
 1. Login in npmjs.com
 2. Create organization "agilecustoms" this will create scope `@agilecustoms` (one org => exactly one scope, also scope can be created w/o org)
-3. Go to your user > Access Tokens > Generate New Token > Granular Access Token
-   1. Token name: `agilecustoms-ci`
-   2. Packages and scopes
-      1. Permissions: Read and write
-      2. Only select packages and scopes: `@agilecustoms`
-   3. Organizations (keep as is)
-4. Save token in repo Settings > Environments > release > Environment secrets > Add environment secret
-   1. Name `NPMJS_TOKEN`
-   2. Repository access: `envctl` only
+3. How to add a package first time?
+4. Configure [Trusted publishing for npm packages](https://docs.npmjs.com/trusted-publishers)
+   1. Navigate to package [settings](https://www.npmjs.com/package/@agilecustoms/envctl/access)
+   2. Pick GitHub Actions
+      1. Organization or user: `agilecustoms`
+      2. Repository: `envctl`
+      3. Workflow filename: `build.yml`
+      4. Environment name: `release`
+      5. "Set up connection"
+5. In GH workflow job use `permissions: id-token: write` and release action with input `npm-publish: true`
 
 ## History/motivation
 
 `env-api` is a microservice hosted in 'maintenance' account and working as garbage collector: every environment first
 created in `env-api` and then 'managed' by `env-api`: it deletes env when it is not in use anymore OR can extend lifetime.
-Creation API yields unique ID, so you can safely manage env (delete, extend lifetime) via this ID. But creation API
-needs to be secured. There are two main use cases:
+Creation API yields unique ID, so you can safely extend lifetime via this ID
+
+### Authorization
+
+There are two main use cases:
 1. create an environment from CI (mainly ephemeral envs)
 2. create env from a dev machine
 
-I (Alex C) have chosen IAM authorization as a common denominator:
-1. on CI — use OIDC to assume a role `/ci/deployer`                     
-2. on dev machine — use SSO and profile chaining to assume role `/ci/deployer`
+Originally I (Alex C) have chosen IAM authorization (`/ci/deployer` on pipeline via OIDC, `/developer` on dev machine via SSO)
+Then (Feb 2026) I reworked it to use API keys
 
-Then as `/ci/deployer` --call--> `env-api` HTTP API (exposed with API Gateway with IAM authorizer)
+### Distribution
 
-Now the problem is: any request needs to be signed with AWS signature v4. Originally I planned to use bash scripts, but it
-quickly became bulky and hard to maintain. Then I thought about Node.js - it is available on dev machines and
-in GitHub actions (namely in Ubuntu runners). How to distribute it? First I thought about using `ncc` to bundle in one
-big .js file (as I do for `publish-s3` and `gha-healthcheck`) but it will be hard to use on dev machine...
+Originally I planned to use bash scripts, but it quickly became bulky and hard to maintain.
+Then I thought about Node.js - it is available on dev machines and in GitHub actions (namely in Ubuntu runners).
+How to distribute it? First I thought about using `ncc` to bundle in one big .js file
+(as I do for `publish-s3` and `gha-healthcheck`) but it will be hard to use on dev machine...
 
 So I ended up publishing this client as an npm package in npmjs
 - CI environments can install it via GH action `agilecustoms/envctl`

package/dist/client/TerraformAdapter.js

@@ -6,6 +6,7 @@ const RETRYABLE_ERRORS = [
     'ConcurrentModificationException',
     'public policies are blocked by the BlockPublicPolicy block public access setting',
     'operation error Lambda: AddPermission, https response error StatusCode: 404',
+    `because public policies are prevented by the BlockPublicPolicy setting in S3 Block Public Access`
 ];
 export class TerraformAdapter {
     processRunner;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agilecustoms/envctl",
   "description": "node.js CLI client for manage environments",
-  "version": "0.38.3",
+  "version": "1.1.0",
   "author": "Alex Chekulaev",
   "type": "module",
   "engines": {
@@ -12,7 +12,6 @@
   },
   "files": [
     "dist/",
-    "scripts/",
     "package.json"
   ],
   "repository": {