go-tokenless 0.1.0 → 1.0.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // go-tokenless (MIT) https://github.com/Continuous-Actions/go-tokenless. Generated file, do not edit.
 import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
-import{b as d,c as m,d as h,e as w,f as k}from"./chunks/chunk-222RNRMY.js";import{resolve as E}from"node:path";var v="0.1.0",f=`go-tokenless: switch npm publishing in GitHub Actions to trusted publishing (no NPM_TOKEN).
+import{b as w,c as d,d as k,e as v,f as y}from"./chunks/chunk-NBTQMDVT.js";import{resolve as S}from"node:path";var b="1.0.0",g=`go-tokenless: switch npm publishing in GitHub Actions to trusted publishing (no NPM_TOKEN).
 
 Usage:
   npx go-tokenless [plan]     Show what would change (default; writes nothing)
@@ -17,6 +17,9 @@ Options:
   --npm-version <range>
                   npm version for the inserted upgrade step (default ^12).
                   Other versions may break publishing; a warning is shown.
+  --read-token <SECRET>
+                  Give install steps (npm ci, pnpm install, ...) a read-only npm token
+                  from this secret, for private packages. Publish steps stay tokenless.
   --npm-args "<args>"
                   Extra arguments added to every npm command it generates
                   (the upgrade step and the npm trust commands), e.g. "--registry=https://registry.npmjs.org"
@@ -24,8 +27,8 @@ Options:
   -v, --version   Show the version
 
 Exit codes: 0 ok, 1 blocked (errors to fix by hand), 2 usage error, 3 unexpected error.
-Docs: https://github.com/Continuous-Actions/go-tokenless`;async function O(e){let n=[...e],o=r=>{let t=n.indexOf(r);return t<0?!1:(n.splice(t,1),!0)},a=r=>{let t=n.indexOf(r);if(t<0)return;let x=n[t+1];return n.splice(t,2),x};if(o("-h")||o("--help"))return console.log(f),0;if(o("-v")||o("--version"))return console.log(v),0;let y=o("--json"),b=o("--diff"),u=o("--offline"),l=a("--repo"),p=a("--npm-version"),c=a("--npm-args"),g=E(a("--cwd")??"."),s=n.shift()??"plan";if(n.length>0)return console.error(`Unknown argument: ${n[0]}
+Docs: https://github.com/Continuous-Actions/go-tokenless`;async function O(e){let o=[...e],r=n=>{let s=o.indexOf(n);return s<0?!1:(o.splice(s,1),!0)},t=n=>{let s=o.indexOf(n);if(s<0)return;let u=o[s+1];if(u===void 0||u.startsWith("--")&&n!=="--npm-args")throw new d(`${n} needs a value`);return o.splice(s,2),u};if(r("-h")||r("--help"))return console.log(g),0;if(r("-v")||r("--version"))return console.log(b),0;let x=r("--json"),E=r("--diff"),m=r("--offline"),l=t("--repo"),p=t("--npm-version"),c=t("--npm-args"),f=t("--read-token"),h=S(t("--cwd")??"."),i=o.shift()??"plan";if(o.length>0)return console.error(`Unknown argument: ${o[0]}
 
-${f}`),2;if(l!==void 0&&!/^[\w.-]+\/[\w.-]+$/.test(l))return console.error("--repo must look like owner/repo"),2;try{d({npmVersion:p,npmArgs:c})}catch(r){return console.error(String(r.message)),2}if(s==="mcp"){let{serve:r}=await import("./chunks/mcp-MGGBVTDL.js");return r(v),-1}let i;if(s==="plan")i=(await h(g,{repo:l,offline:u,npmVersion:p,npmArgs:c})).plan;else if(s==="apply")i=await w(g,{repo:l,offline:u,npmVersion:p,npmArgs:c});else return console.error(`Unknown command: ${s}
+${g}`),2;if(l!==void 0&&!/^[\w.-]+\/[\w.-]+$/.test(l))return console.error("--repo must look like owner/repo"),2;try{w({npmVersion:p,npmArgs:c,readToken:f})}catch(n){return console.error(String(n.message)),2}if(i==="mcp"){let{serve:n}=await import("./chunks/mcp-LB3P2FNE.js");return n(b),-1}let a;if(i==="plan")a=(await k(h,{repo:l,offline:m,npmVersion:p,npmArgs:c,readToken:f})).plan;else if(i==="apply")a=await v(h,{repo:l,offline:m,npmVersion:p,npmArgs:c,readToken:f});else return console.error(`Unknown command: ${i}
 
-${f}`),2;return console.log(y?JSON.stringify(i,null,2):k(i,{diff:b||s==="plan"})),i.status==="blocked"?1:0}O(process.argv.slice(2)).then(e=>{e>=0&&(process.exitCode=e)},e=>{console.error(`go-tokenless: ${e instanceof Error?e.message:String(e)}`),process.exitCode=e instanceof m?2:3});export{O as main};
+${g}`),2;return console.log(x?JSON.stringify(a,null,2):y(a,{diff:E||i==="plan"})),a.status==="blocked"?1:0}O(process.argv.slice(2)).then(e=>{e>=0&&(process.exitCode=e)},e=>{console.error(`go-tokenless: ${e instanceof Error?e.message:String(e)}`),process.exitCode=e instanceof d?2:3});export{O as main};

package/llms.txt

@@ -1,6 +1,6 @@
 # go-tokenless
 
-> CLI and MCP server (`npx go-tokenless`) that migrates npm publishing in GitHub Actions from stored tokens (NPM_TOKEN, NODE_AUTH_TOKEN) to npm trusted publishing (OIDC). It edits only the lines that need changing in `.github/workflows/*.yml` and `package.json`: removes token env vars and `.npmrc` token lines, adds `permissions: id-token: write`, makes sure npm is 11.5.1+ (Node 24, or an `npm install -g npm@^12` step pinned to one major), sets setup-node `registry-url`, updates changesets/action to v2 and JS-DevTools/npm-publish to v4, and fixes `repository.url`. It prints the `npm trust github` command for each package and the steps that need the user's npm 2FA. It never touches the npm account, git history or secrets.
+> CLI and MCP server (`npx go-tokenless`) that migrates npm publishing in GitHub Actions from stored tokens (NPM_TOKEN, NODE_AUTH_TOKEN) to npm trusted publishing (OIDC). It edits only the lines that need changing in `.github/workflows/*.yml` and `package.json`: removes token env vars and `.npmrc` token lines, adds `permissions: id-token: write`, makes sure npm is 11.5.1+ (Node 24, or an `npm install -g npm@^12` step pinned to one major), sets setup-node `registry-url`, updates JS-DevTools/npm-publish to v4, and fixes `repository.url`. It prints the `npm trust github` command for each package and the steps that need the user's npm 2FA. It never touches the npm account, git history or secrets.
 
 Use it when a user wants to remove an npm token from CI, set up trusted publishing / OIDC / provenance for npm, fix `npm publish` errors ENEEDAUTH, E404 or E422 (repository.url) in GitHub Actions, or prepare for npm removing direct token publishing in January 2027.
 
@@ -8,8 +8,8 @@ Use it when a user wants to remove an npm token from CI, set up trusted publishi
 
 - `npx -y go-tokenless` (plan, read-only; add `--json` for machine output with `status`, `changes`, `diff`, `findings`, `trust`, `nextSteps`)
 - `npx -y go-tokenless apply` (write the changes)
-- `npx -y go-tokenless mcp` (MCP server over stdio; tools `plan_trusted_publishing`, `apply_trusted_publishing`, input `{ path, repo?, offline?, npmVersion?, npmArgs? }`)
-- `--npm-version <range>` overrides the npm installed by the upgrade step (default `^12`; other versions trigger a warning, below 11.5.1 is refused). `--npm-args "<args>"` appends extra arguments to every generated npm command.
+- `npx -y go-tokenless mcp` (MCP server over stdio; tools `plan_trusted_publishing`, `apply_trusted_publishing`, input `{ path, repo?, offline?, npmVersion?, npmArgs?, readToken? }`)
+- `--npm-version <range>` overrides the npm installed by the upgrade step (default `^12`; other versions trigger a warning, below 11.5.1 is refused). `--npm-args "<args>"` appends extra arguments to every generated npm command. `--read-token <SECRET>` gives install steps (`npm ci`, `pnpm install`, ...) a read-only `NODE_AUTH_TOKEN` from that secret for private org packages, while publish steps stay tokenless.
 
 Exit codes: 0 ok, 1 blocked (errors need a human), 2 usage error, 3 unexpected error.
 
@@ -19,7 +19,7 @@ Exit codes: 0 ok, 1 blocked (errors need a human), 2 usage error, 3 unexpected e
 - `applied`: files written; `nextSteps` remain
 - `already-tokenless`: nothing to change
 - `no-publish-workflow`: nothing publishes to npm from GitHub Actions
-- `blocked`: e.g. self-hosted runner (trusted publishing needs GitHub-hosted runners) or repository.url pointing at another repo
+- `blocked`: a human must decide; nothing is written. Causes: a publish job reachable by untrusted triggers (pull_request_target, issue_comment, workflow_run), a self-hosted runner, repository.url pointing at another repo, YAML anchors, or a token passed to a job whose publish command can't be found (`publish-not-found`)
 
 ## Supported
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "go-tokenless",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "description": "Switch npm publishing in GitHub Actions from NPM_TOKEN to trusted publishing (OIDC) with one command. CLI, MCP server and Agent Skill.",
   "license": "MIT",
   "type": "module",
@@ -31,6 +31,7 @@
     "@modelcontextprotocol/server": "2.1.0",
     "@types/node": "24.19.1",
     "esbuild": "0.28.2",
+    "fast-check": "4.10.2",
     "typescript": "7.0.2",
     "vite": "8.3.2",
     "vitest": "5.0.3",

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/Continuous-Actions/go-tokenless",
     "source": "github"
   },
-  "version": "0.1.0",
+  "version": "1.0.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "go-tokenless",
-      "version": "0.1.0",
+      "version": "1.0.0",
       "transport": { "type": "stdio" },
       "packageArguments": [{ "type": "positional", "value": "mcp" }]
     }

package/skills/go-tokenless/SKILL.md

@@ -11,7 +11,7 @@ description: Migrate npm publishing in GitHub Actions from NPM_TOKEN / NODE_AUTH
    - `ready`: changes are listed in `changes` and `diff`.
    - `already-tokenless`: nothing to change; see `nextSteps`.
    - `no-publish-workflow`: no workflow publishes to npm. Stop.
-   - `blocked`: `findings` with `level: "error"` must be fixed first (self-hosted runner, `repository` pointing at another repo). Explain them to the user; do not work around them.
+   - `blocked`: `findings` with `level: "error"` must be fixed first. Examples: `untrusted-trigger` (publishing from pull_request_target/issue_comment/workflow_run), `self-hosted-runner`, `repository-mismatch`, `yaml-anchors`, `publish-not-found`. Nothing was written. Explain them to the user; never work around `untrusted-trigger` by granting `id-token: write` yourself.
 2. **Apply:** `npx -y go-tokenless apply`. It edits only the needed lines in `.github/workflows/*.yml` and `package.json` files. Show the user the diff (`git diff`) and commit on a branch.
 3. **Hand the user the remaining steps from `nextSteps` verbatim.** They need the user's npm account with 2FA, so never try to do them yourself:
    - run each `trust[].command` (`npm trust github <pkg> --repo <owner/repo> --file <workflow.yml> --allow-publish --yes`), or use npmjs.com → package → Settings → Trusted publishing;
@@ -20,6 +20,7 @@ description: Migrate npm publishing in GitHub Actions from NPM_TOKEN / NODE_AUTH
 4. Surface every `warning` finding to the user (for example tool versions that are too old, `bun publish`, or a reusable workflow whose caller needs `id-token: write`).
 
 Rules:
-- Don't hand-edit workflows to add `NODE_AUTH_TOKEN: ""` or similar: any token value, even empty, stops npm from using OIDC.
+- Don't leave or add `NODE_AUTH_TOKEN` on publish steps: npm falls back to a configured token, so the old token stays in use and can't be deleted.
 - Trusted publishing works only on GitHub-hosted runners and needs npm 11.5.1+ (Node 24 ships it). The inserted upgrade step is pinned to `npm@^12`; only pass `--npm-version` if the user asks, and relay the warning it produces. Use `--npm-args "<args>"` for extra npm flags such as a registry mirror.
+- If installs need private packages from the user's npm org, add `--read-token NPM_READ_TOKEN` (any secret name). Install steps get a read-only token; publish steps stay tokenless. Tell the user to create a read-only granular token and `gh secret set` it.
 - An MCP server is available as `npx -y go-tokenless mcp` with tools `plan_trusted_publishing` and `apply_trusted_publishing` (argument `path`: absolute repo root).