@iasiv5/dsh-quota-watch 0.0.1 → 0.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -31,7 +31,8 @@
|
|
|
31
31
|
- API 路由只允许 loopback 或已配对的浏览器访问；响应禁用缓存。
|
|
32
32
|
- 本仓库、测试 fixtures 与 npm 包不得包含任何真实 key、OAuth grant、临时 token、原始账号响应或个人余额。测试仅使用合成响应。
|
|
33
33
|
- npm 包采用显式 `files` 白名单；`npm run security:check` 会扫描工作树和实际 pack 文件，诊断只报告路径和规则名，不打印匹配值。
|
|
34
|
-
- 首次 bootstrap 发布真实插件 `0.0.1`
|
|
34
|
+
- 首次 bootstrap 发布真实插件 `0.0.1` 使用 npm web-login；后续 tag release 使用 GitHub Actions OIDC 与 provenance，版本发布者身份为 GitHub Actions，不保存长期 npm token。
|
|
35
|
+
- OIDC 不会改写已发布的 `0.0.1` 元数据，也不负责移除 Registry 级 maintainer 字段；源码和 npm tarball 不写入发布账号邮箱。
|
|
35
36
|
|
|
36
37
|
## 安装
|
|
37
38
|
|