go-tokenless 0.0.0-stage → 1.0.0

package/dist/cli.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+// go-tokenless (MIT) https://github.com/Continuous-Actions/go-tokenless. Generated file, do not edit.
+import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
+import{b as w,c as d,d as k,e as v,f as y}from"./chunks/chunk-NBTQMDVT.js";import{resolve as S}from"node:path";var b="1.0.0",g=`go-tokenless: switch npm publishing in GitHub Actions to trusted publishing (no NPM_TOKEN).
+
+Usage:
+  npx go-tokenless [plan]     Show what would change (default; writes nothing)
+  npx go-tokenless apply      Rewrite the workflows and package.json files
+  npx go-tokenless mcp        Run as an MCP server over stdio (for AI agents)
+
+Options:
+  --json          Machine-readable output (the full plan)
+  --diff          Include a unified diff in text output
+  --repo o/r      GitHub owner/repo (default: from git remote "origin")
+  --cwd <dir>     Repository root (default: current directory)
+  --offline       Skip npm registry lookups
+  --npm-version <range>
+                  npm version for the inserted upgrade step (default ^12).
+                  Other versions may break publishing; a warning is shown.
+  --read-token <SECRET>
+                  Give install steps (npm ci, pnpm install, ...) a read-only npm token
+                  from this secret, for private packages. Publish steps stay tokenless.
+  --npm-args "<args>"
+                  Extra arguments added to every npm command it generates
+                  (the upgrade step and the npm trust commands), e.g. "--registry=https://registry.npmjs.org"
+  -h, --help      Show this help
+  -v, --version   Show the version
+
+Exit codes: 0 ok, 1 blocked (errors to fix by hand), 2 usage error, 3 unexpected error.
+Docs: https://github.com/Continuous-Actions/go-tokenless`;async function O(e){let o=[...e],r=n=>{let s=o.indexOf(n);return s<0?!1:(o.splice(s,1),!0)},t=n=>{let s=o.indexOf(n);if(s<0)return;let u=o[s+1];if(u===void 0||u.startsWith("--")&&n!=="--npm-args")throw new d(`${n} needs a value`);return o.splice(s,2),u};if(r("-h")||r("--help"))return console.log(g),0;if(r("-v")||r("--version"))return console.log(b),0;let x=r("--json"),E=r("--diff"),m=r("--offline"),l=t("--repo"),p=t("--npm-version"),c=t("--npm-args"),f=t("--read-token"),h=S(t("--cwd")??"."),i=o.shift()??"plan";if(o.length>0)return console.error(`Unknown argument: ${o[0]}
+
+${g}`),2;if(l!==void 0&&!/^[\w.-]+\/[\w.-]+$/.test(l))return console.error("--repo must look like owner/repo"),2;try{w({npmVersion:p,npmArgs:c,readToken:f})}catch(n){return console.error(String(n.message)),2}if(i==="mcp"){let{serve:n}=await import("./chunks/mcp-LB3P2FNE.js");return n(b),-1}let a;if(i==="plan")a=(await k(h,{repo:l,offline:m,npmVersion:p,npmArgs:c,readToken:f})).plan;else if(i==="apply")a=await v(h,{repo:l,offline:m,npmVersion:p,npmArgs:c,readToken:f});else return console.error(`Unknown command: ${i}
+
+${g}`),2;return console.log(x?JSON.stringify(a,null,2):y(a,{diff:E||i==="plan"})),a.status==="blocked"?1:0}O(process.argv.slice(2)).then(e=>{e>=0&&(process.exitCode=e)},e=>{console.error(`go-tokenless: ${e instanceof Error?e.message:String(e)}`),process.exitCode=e instanceof d?2:3});export{O as main};

package/llms.txt

@@ -0,0 +1,32 @@
+# go-tokenless
+
+> CLI and MCP server (`npx go-tokenless`) that migrates npm publishing in GitHub Actions from stored tokens (NPM_TOKEN, NODE_AUTH_TOKEN) to npm trusted publishing (OIDC). It edits only the lines that need changing in `.github/workflows/*.yml` and `package.json`: removes token env vars and `.npmrc` token lines, adds `permissions: id-token: write`, makes sure npm is 11.5.1+ (Node 24, or an `npm install -g npm@^12` step pinned to one major), sets setup-node `registry-url`, updates JS-DevTools/npm-publish to v4, and fixes `repository.url`. It prints the `npm trust github` command for each package and the steps that need the user's npm 2FA. It never touches the npm account, git history or secrets.
+
+Use it when a user wants to remove an npm token from CI, set up trusted publishing / OIDC / provenance for npm, fix `npm publish` errors ENEEDAUTH, E404 or E422 (repository.url) in GitHub Actions, or prepare for npm removing direct token publishing in January 2027.
+
+## Commands
+
+- `npx -y go-tokenless` (plan, read-only; add `--json` for machine output with `status`, `changes`, `diff`, `findings`, `trust`, `nextSteps`)
+- `npx -y go-tokenless apply` (write the changes)
+- `npx -y go-tokenless mcp` (MCP server over stdio; tools `plan_trusted_publishing`, `apply_trusted_publishing`, input `{ path, repo?, offline?, npmVersion?, npmArgs?, readToken? }`)
+- `--npm-version <range>` overrides the npm installed by the upgrade step (default `^12`; other versions trigger a warning, below 11.5.1 is refused). `--npm-args "<args>"` appends extra arguments to every generated npm command. `--read-token <SECRET>` gives install steps (`npm ci`, `pnpm install`, ...) a read-only `NODE_AUTH_TOKEN` from that secret for private org packages, while publish steps stay tokenless.
+
+Exit codes: 0 ok, 1 blocked (errors need a human), 2 usage error, 3 unexpected error.
+
+## Status values
+
+- `ready`: changes available
+- `applied`: files written; `nextSteps` remain
+- `already-tokenless`: nothing to change
+- `no-publish-workflow`: nothing publishes to npm from GitHub Actions
+- `blocked`: a human must decide; nothing is written. Causes: a publish job reachable by untrusted triggers (pull_request_target, issue_comment, workflow_run), a self-hosted runner, repository.url pointing at another repo, YAML anchors, or a token passed to a job whose publish command can't be found (`publish-not-found`)
+
+## Supported
+
+npm publish, pnpm publish, Yarn Berry `yarn npm publish` (4.10.3+), changesets/action, semantic-release (@semantic-release/npm 13.1.0+), release-please + npm publish, Lerna 9+, Nx release, JS-DevTools/npm-publish, release-it (needs `npm.skipChecks: true`), reusable workflows. `bun publish` and Yarn 1 `yarn publish` are flagged (not supported by those tools).
+
+## Docs
+
+- README: https://github.com/Continuous-Actions/go-tokenless#readme
+- Agent Skill: https://github.com/Continuous-Actions/go-tokenless/blob/main/skills/go-tokenless/SKILL.md
+- npm trusted publishing: https://docs.npmjs.com/trusted-publishers

package/package.json

@@ -1,6 +1,56 @@
 {
   "name": "go-tokenless",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Switch npm publishing in GitHub Actions from NPM_TOKEN to trusted publishing (OIDC) with one command. CLI, MCP server and Agent Skill.",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=22.14"
+  },
+  "bin": "dist/cli.js",
+  "files": [
+    "server.json",
+    "dist",
+    "skills",
+    "llms.txt"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Continuous-Actions/go-tokenless.git"
+  },
+  "homepage": "https://github.com/Continuous-Actions/go-tokenless#readme",
+  "bugs": "https://github.com/Continuous-Actions/go-tokenless/issues",
+  "mcpName": "io.github.Continuous-Actions/go-tokenless",
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "check": "tsc -p tsconfig.json && node scripts/build.mjs && vitest run"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/server": "2.1.0",
+    "@types/node": "24.19.1",
+    "esbuild": "0.28.2",
+    "fast-check": "4.10.2",
+    "typescript": "7.0.2",
+    "vite": "8.3.2",
+    "vitest": "5.0.3",
+    "yaml": "2.9.1",
+    "zod": "4.6.5"
+  },
+  "packageManager": "yarn@4.18.1",
+  "keywords": [
+    "npm",
+    "trusted-publishing",
+    "oidc",
+    "npm-token",
+    "provenance",
+    "github-actions",
+    "publish",
+    "release",
+    "changesets",
+    "semantic-release",
+    "mcp",
+    "agent-skill"
+  ]
+}

package/server.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.Continuous-Actions/go-tokenless",
+  "title": "go-tokenless",
+  "description": "Move npm publishing in GitHub Actions from NPM_TOKEN to trusted publishing (OIDC).",
+  "repository": {
+    "url": "https://github.com/Continuous-Actions/go-tokenless",
+    "source": "github"
+  },
+  "version": "1.0.0",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "go-tokenless",
+      "version": "1.0.0",
+      "transport": { "type": "stdio" },
+      "packageArguments": [{ "type": "positional", "value": "mcp" }]
+    }
+  ]
+}

package/skills/go-tokenless/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: go-tokenless
+description: Migrate npm publishing in GitHub Actions from NPM_TOKEN / NODE_AUTH_TOKEN secrets to npm trusted publishing (OIDC, provenance). Use when the user wants to remove or rotate an npm token, set up npm trusted publishing or OIDC, fix ENEEDAUTH / 404 / E422 errors from `npm publish` in CI, prepare for npm's January 2027 removal of token publishing, or asks to make releases more secure. Works with npm, pnpm, Yarn Berry, changesets, semantic-release, release-please, Lerna, Nx and JS-DevTools/npm-publish.
+---
+
+# Move npm publishing to trusted publishing with go-tokenless
+
+1. **Plan (writes nothing):** run from the repository root:
+   `npx -y go-tokenless --json`
+   Read `status`:
+   - `ready`: changes are listed in `changes` and `diff`.
+   - `already-tokenless`: nothing to change; see `nextSteps`.
+   - `no-publish-workflow`: no workflow publishes to npm. Stop.
+   - `blocked`: `findings` with `level: "error"` must be fixed first. Examples: `untrusted-trigger` (publishing from pull_request_target/issue_comment/workflow_run), `self-hosted-runner`, `repository-mismatch`, `yaml-anchors`, `publish-not-found`. Nothing was written. Explain them to the user; never work around `untrusted-trigger` by granting `id-token: write` yourself.
+2. **Apply:** `npx -y go-tokenless apply`. It edits only the needed lines in `.github/workflows/*.yml` and `package.json` files. Show the user the diff (`git diff`) and commit on a branch.
+3. **Hand the user the remaining steps from `nextSteps` verbatim.** They need the user's npm account with 2FA, so never try to do them yourself:
+   - run each `trust[].command` (`npm trust github <pkg> --repo <owner/repo> --file <workflow.yml> --allow-publish --yes`), or use npmjs.com → package → Settings → Trusted publishing;
+   - packages with `published: false` must be published once by hand first;
+   - after the first successful release, `gh secret delete <name>` for the secrets listed and revoke the token on npmjs.com.
+4. Surface every `warning` finding to the user (for example tool versions that are too old, `bun publish`, or a reusable workflow whose caller needs `id-token: write`).
+
+Rules:
+- Don't leave or add `NODE_AUTH_TOKEN` on publish steps: npm falls back to a configured token, so the old token stays in use and can't be deleted.
+- Trusted publishing works only on GitHub-hosted runners and needs npm 11.5.1+ (Node 24 ships it). The inserted upgrade step is pinned to `npm@^12`; only pass `--npm-version` if the user asks, and relay the warning it produces. Use `--npm-args "<args>"` for extra npm flags such as a registry mirror.
+- If installs need private packages from the user's npm org, add `--read-token NPM_READ_TOKEN` (any secret name). Install steps get a read-only token; publish steps stay tokenless. Tell the user to create a read-only granular token and `gh secret set` it.
+- An MCP server is available as `npx -y go-tokenless mcp` with tools `plan_trusted_publishing` and `apply_trusted_publishing` (argument `path`: absolute repo root).