@throng/cli 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -65,8 +65,13 @@ npm run dev -- --host http://localhost:4000 auth status
|
|
|
65
65
|
|
|
66
66
|
Releases are published by `.github/workflows/cli-release.yml` when a `cli-v*` tag
|
|
67
67
|
is pushed. **There is no npm token**: the workflow authenticates to npm over OIDC
|
|
68
|
-
as a trusted publisher, so nothing long-lived has to be stored in the repository
|
|
69
|
-
|
|
68
|
+
as a trusted publisher, so nothing long-lived has to be stored in the repository.
|
|
69
|
+
|
|
70
|
+
Releases carry **no provenance attestation**. npm only accepts one from a public
|
|
71
|
+
source repository, and throngx is private, so the workflow pins provenance off —
|
|
72
|
+
forcing it on makes npm reject the publish outright. Tokenless authentication is
|
|
73
|
+
unaffected; it is only the attestation that needs a public repo. If throngx ever
|
|
74
|
+
becomes public, drop `NPM_CONFIG_PROVENANCE` from the publish step.
|
|
70
75
|
|
|
71
76
|
To cut a release, bump `version` in `package.json`, merge, then tag. The workflow
|
|
72
77
|
refuses to publish if the tag and `package.json` disagree, so the two cannot drift:
|