trustdex 0.4.0 → 0.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -1
- package/docs/RELEASING.md +7 -11
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -3,6 +3,7 @@
|
|
|
3
3
|
[](https://github.com/grigent/trustdex/actions/workflows/ci.yml)
|
|
4
4
|
[](https://github.com/grigent/trustdex/actions/workflows/codeql.yml)
|
|
5
5
|
[](https://github.com/grigent/trustdex/releases)
|
|
6
|
+
[](https://www.npmjs.com/package/trustdex)
|
|
6
7
|
[](LICENSE)
|
|
7
8
|
|
|
8
9
|
**A local-first trust and provenance gate for AI agent tools.**
|
|
@@ -71,6 +72,15 @@ TrustDex requires Node.js 20 or newer. CI exercises the full test and gate workf
|
|
|
71
72
|
|
|
72
73
|
Requires Node.js 20+.
|
|
73
74
|
|
|
75
|
+
Run directly from npm:
|
|
76
|
+
|
|
77
|
+
```bash
|
|
78
|
+
npx trustdex@0.4.2 --help
|
|
79
|
+
npx trustdex@0.4.2 inspect ./mcp.json --pack strict --policy ./trustdex.policy.json
|
|
80
|
+
```
|
|
81
|
+
|
|
82
|
+
Or work from a source checkout:
|
|
83
|
+
|
|
74
84
|
```bash
|
|
75
85
|
git clone https://github.com/grigent/trustdex.git
|
|
76
86
|
cd trustdex
|
|
@@ -282,7 +292,7 @@ The private key should never be committed.
|
|
|
282
292
|
```yaml
|
|
283
293
|
- uses: actions/checkout@v4
|
|
284
294
|
|
|
285
|
-
- uses: grigent/trustdex@v0.4.
|
|
295
|
+
- uses: grigent/trustdex@v0.4.2
|
|
286
296
|
with:
|
|
287
297
|
config: ./mcp.json
|
|
288
298
|
pack: official-first
|
package/docs/RELEASING.md
CHANGED
|
@@ -7,21 +7,15 @@ TrustDex uses two small GitHub Actions workflows:
|
|
|
7
7
|
|
|
8
8
|
This split keeps GitHub release creation separate from registry credentials.
|
|
9
9
|
|
|
10
|
-
##
|
|
10
|
+
## Bootstrap publication
|
|
11
11
|
|
|
12
|
-
|
|
12
|
+
The one-time token-based bootstrap publication has been completed. Do not repeat it for normal releases.
|
|
13
13
|
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
1. Make sure the `trustdex` package name is still available on npm.
|
|
17
|
-
2. Create an npm granular access token that is allowed to publish the package and store it as the repository secret `NPM_TOKEN`.
|
|
18
|
-
3. Run **Create GitHub Release** for the current package version, such as `v0.4.0`.
|
|
19
|
-
4. Run **Publish Package to npmjs** for the same tag only after the GitHub release succeeds.
|
|
20
|
-
5. Delete the publishing token after the first successful publication.
|
|
14
|
+
A short-lived `NPM_TOKEN` may remain only until trusted publishing has been configured and verified. Delete both the npm token and the GitHub repository secret immediately after the first successful OIDC publication.
|
|
21
15
|
|
|
22
16
|
Do not paste npm credentials into issues, pull requests, source files, logs, or chat.
|
|
23
17
|
|
|
24
|
-
##
|
|
18
|
+
## npm trusted publishing
|
|
25
19
|
|
|
26
20
|
After the package exists, configure npm trusted publishing for:
|
|
27
21
|
|
|
@@ -32,7 +26,9 @@ After the package exists, configure npm trusted publishing for:
|
|
|
32
26
|
|
|
33
27
|
The workflow grants only `contents: read` and `id-token: write`. npm can then authenticate the GitHub-hosted job with OIDC instead of a long-lived write token.
|
|
34
28
|
|
|
35
|
-
Once trusted publishing works, remove the `NPM_TOKEN` repository secret. The workflow deliberately continues to use the standard `npm publish` command so npm can select OIDC authentication.
|
|
29
|
+
Once trusted publishing works, remove the `NPM_TOKEN` repository secret and revoke the bootstrap token on npm. The workflow deliberately continues to use the standard `npm publish` command so npm can select OIDC authentication.
|
|
30
|
+
|
|
31
|
+
Both release workflows run `npm pkg fix` and require a clean `package.json` diff before packing or publishing. This prevents npm from silently normalizing away critical metadata such as the CLI entrypoint.
|
|
36
32
|
|
|
37
33
|
## Provenance
|
|
38
34
|
|
package/package.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "trustdex",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.2",
|
|
4
4
|
"description": "A local-first trust, provenance, and review gate for AI agent tools, MCP servers, skills, and plugins.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
7
|
-
"trustdex": "
|
|
7
|
+
"trustdex": "bin/trustdex.mjs"
|
|
8
8
|
},
|
|
9
9
|
"scripts": {
|
|
10
10
|
"test": "node --test",
|
|
@@ -27,7 +27,7 @@
|
|
|
27
27
|
"license": "MIT",
|
|
28
28
|
"repository": {
|
|
29
29
|
"type": "git",
|
|
30
|
-
"url": "https://github.com/grigent/trustdex.git"
|
|
30
|
+
"url": "git+https://github.com/grigent/trustdex.git"
|
|
31
31
|
},
|
|
32
32
|
"bugs": {
|
|
33
33
|
"url": "https://github.com/grigent/trustdex/issues"
|