@baldaworks/acprun 0.1.9 → 0.1.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +18 -14
  2. package/package.json +7 -7
package/README.md CHANGED
@@ -21,28 +21,20 @@ It transparently handles distribution resolution across:
21
21
 
22
22
  ## Installation and quick start
23
23
 
24
- Install `acprun` through either npm launcher or as a Go binary.
24
+ Install `acprun` through npm or as a Go binary.
25
25
 
26
26
  ### npm package (recommended)
27
27
 
28
28
  For repeated direct shell use, install the npm launcher globally:
29
29
 
30
- ```bash
31
- npm install --global acprun@latest
32
- acprun version
33
- ```
34
-
35
- The equivalent scoped package is also available as `@baldaworks/acprun`:
36
-
37
30
  ```bash
38
31
  npm install --global @baldaworks/acprun@latest
32
+ acprun version
39
33
  ```
40
34
 
41
35
  For one-shot execution without global installation, run the complete `npx` command:
42
36
 
43
37
  ```bash
44
- npx --yes acprun@latest list
45
- # Equivalent scoped launcher:
46
38
  npx --yes @baldaworks/acprun@latest list
47
39
  ```
48
40
 
@@ -180,15 +172,27 @@ acprun cache clean --manifests-only
180
172
 
181
173
  ## Distribution
182
174
 
183
- The npm distribution uses CGO-disabled native executables for macOS and Linux on AMD64/ARM64 and Windows AMD64/ARM64 behind the equivalent [`acprun`](https://www.npmjs.com/package/acprun) and [`@baldaworks/acprun`](https://www.npmjs.com/package/@baldaworks/acprun) launchers. Both launchers share the same scoped platform packages.
175
+ The npm distribution uses CGO-disabled native executables for macOS and Linux on AMD64/ARM64 and Windows AMD64/ARM64 behind the [`@baldaworks/acprun`](https://www.npmjs.com/package/@baldaworks/acprun) launcher and six scoped platform packages.
184
176
 
185
- Description, keywords, and MIT license metadata are defined once in `.omnidist/omnidist.yaml` and inherited by both npm launchers.
177
+ Description, keywords, and MIT license metadata are defined in `.omnidist/omnidist.yaml` and included in the npm launcher.
186
178
 
187
179
  ### Release setup
188
180
 
189
- Tag-triggered releases stage and verify the npm packages before publishing and attach native binaries to the GitHub release. Configure the `NPM_PUBLISH_TOKEN` GitHub Actions repository secret before the next release.
181
+ Tag-triggered releases stage and verify the npm packages before publishing and attach native binaries to the GitHub release. npm publishing uses GitHub Actions OIDC through omnidist's `publish-auth: trusted` mode. The publish job has `id-token: write`; no npm publishing secret is required.
182
+
183
+ Sign in locally through npm web authentication with an account that has 2FA enabled and write access to the launcher and its six platform packages. Inspect the trusted-publisher plan, then apply it through omnidist:
184
+
185
+ ```bash
186
+ npx -y npm@11.16.0 login --auth-type=web --registry=https://registry.npmjs.org
187
+ npx -y @omnidist/omnidist@latest npm trust
188
+ npx -y @omnidist/omnidist@latest npm trust --apply
189
+ ```
190
+
191
+ The plan covers all seven packages and grants publishing access to `baldaworks/acprun` using the workflow filename `omnidist-release.yml`. Complete any browser/2FA prompts from npm. Local web authentication is used to configure trust; GitHub Actions obtains its own short-lived OIDC credentials for releases. See [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/) and the [npm trust prerequisites](https://docs.npmjs.com/cli/v11/commands/npm-trust/).
192
+
193
+ npm requires a package to exist before its trusted publisher can be configured. A new package name therefore needs its initial publication through omnidist using local web authentication before applying the trust plan. Keep credentials outside the repository.
190
194
 
191
- The npm publishing account must have permission to publish both launcher names and the shared scoped platform packages. The workflow checks that the token is present before building. A failed upload can leave some npm packages published; retain the release logs and inspect registry state before retrying with the omnidist npm publish command.
195
+ A failed upload can leave some npm packages published. Retain the release logs and inspect registry state before retrying; omnidist 0.2.0 publishes platform packages first and does not skip existing versions, so replaying a partially published release can fail.
192
196
 
193
197
  ---
194
198
 
package/package.json CHANGED
@@ -26,16 +26,16 @@
26
26
  "license": "MIT",
27
27
  "name": "@baldaworks/acprun",
28
28
  "optionalDependencies": {
29
- "@baldaworks/acprun-darwin-arm64": "0.1.9",
30
- "@baldaworks/acprun-darwin-x64": "0.1.9",
31
- "@baldaworks/acprun-linux-arm64": "0.1.9",
32
- "@baldaworks/acprun-linux-x64": "0.1.9",
33
- "@baldaworks/acprun-win32-arm64": "0.1.9",
34
- "@baldaworks/acprun-win32-x64": "0.1.9"
29
+ "@baldaworks/acprun-darwin-arm64": "0.1.10",
30
+ "@baldaworks/acprun-darwin-x64": "0.1.10",
31
+ "@baldaworks/acprun-linux-arm64": "0.1.10",
32
+ "@baldaworks/acprun-linux-x64": "0.1.10",
33
+ "@baldaworks/acprun-win32-arm64": "0.1.10",
34
+ "@baldaworks/acprun-win32-x64": "0.1.10"
35
35
  },
36
36
  "repository": {
37
37
  "type": "git",
38
38
  "url": "git+https://github.com/baldaworks/acprun.git"
39
39
  },
40
- "version": "0.1.9"
40
+ "version": "0.1.10"
41
41
  }