edu-webcomponents 1.19.7 → 1.19.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
# Requeriments to use .github/workflows/release-and-publish.yaml
|
|
2
|
+
|
|
3
|
+
## Release
|
|
4
|
+
- Create a PAT in GitHub and add it to GitHub secrets with *GITHUB_TOKEN* name.
|
|
5
|
+
|
|
6
|
+
## Publish
|
|
7
|
+
- Have an account in npm.com, create a PAT with write permissions, and add it GitHub secrets with *NPM_TOKEN* name.
|
|
8
|
+
- Use workflow from [here](https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages#publishing-packages-to-the-npm-registry)
|
|
9
|
+
|
|
10
|
+
# Notes
|
|
11
|
+
|
|
12
|
+
## Provenance
|
|
13
|
+
|
|
14
|
+
You can generate provenance statements for the packages you publish. This allows you to publicly establish where a package was built and who published a package, which can increase supply-chain security for your packages.
|
|
15
|
+
|
|
16
|
+
More info: [https://docs.npmjs.com/generating-provenance-statements](https://docs.npmjs.com/generating-provenance-statements).
|
package/package.json
CHANGED
|
@@ -1,46 +0,0 @@
|
|
|
1
|
-
# Publish packages to npm registry by using GitHub Actions
|
|
2
|
-
- Have an account in npm.com and create a PAT with write permissions
|
|
3
|
-
- Add PAT created to GitHub secrets
|
|
4
|
-
- Use workflow from [here](https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages#publishing-packages-to-the-npm-registry)
|
|
5
|
-
|
|
6
|
-
## Provenance
|
|
7
|
-
|
|
8
|
-
### What is is?
|
|
9
|
-
|
|
10
|
-
You can generate provenance statements for the packages you publish. This allows you to publicly establish where a package was built and who published a package, which can increase supply-chain security for your packages.
|
|
11
|
-
|
|
12
|
-
More info: [https://docs.npmjs.com/generating-provenance-statements](https://docs.npmjs.com/generating-provenance-statements).
|
|
13
|
-
|
|
14
|
-
### How to
|
|
15
|
-
Add permissions and provenance flag to the workflow job that publishes packages to npm registry, as you can see here:
|
|
16
|
-
```
|
|
17
|
-
name: Publish Package to npmjs
|
|
18
|
-
on:
|
|
19
|
-
release:
|
|
20
|
-
types: [published]
|
|
21
|
-
jobs:
|
|
22
|
-
build:
|
|
23
|
-
runs-on: ubuntu-latest
|
|
24
|
-
permissions:
|
|
25
|
-
contents: read
|
|
26
|
-
id-token: write
|
|
27
|
-
steps:
|
|
28
|
-
- uses: actions/checkout@v4
|
|
29
|
-
- uses: actions/setup-node@v4
|
|
30
|
-
with:
|
|
31
|
-
node-version: '20.x'
|
|
32
|
-
registry-url: 'https://registry.npmjs.org'
|
|
33
|
-
- run: npm install -g npm
|
|
34
|
-
- run: npm ci
|
|
35
|
-
- run: npm publish --provenance --access public
|
|
36
|
-
env:
|
|
37
|
-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
|
38
|
-
```
|
|
39
|
-
|
|
40
|
-
Add repository object with type and url properties to the package.json, as you can see here:
|
|
41
|
-
```
|
|
42
|
-
"repository": {
|
|
43
|
-
"type": "git",
|
|
44
|
-
"url": "https://github.com/eduardocruzpalacios/edu-webcomponents"
|
|
45
|
-
},
|
|
46
|
-
```
|