search

FiloSottile / typage

A TypeScript implementation of the age file encryption format, based on libsodium.
BSD 3-Clause "New" or "Revised" License
94 stars 12 forks source link

NPM publish using CI #22

Open FiloSottile opened 1 month ago

FiloSottile commented 1 month ago

I also usually do NPM publish using CI: publish-npm.yml

It will build the package and upload it to NPM, using transparency logs. This would require adding NPM_PUBLISH_TOKEN to the repository.

It allows to keep one less token which can be stolen from my machine.

Originally posted by @paulmillr in https://github.com/FiloSottile/typage/issues/21#issuecomment-2243071291

paulmillr commented 1 month ago

I see you're trying to do this in two steps, to limit malware, which can be uploaded by esbuild.

If esbuild version is locked, and all devDependencies are also locked (change from ^1.2.3 to 1.2.3), then the damage they can do is minimized. Their code is basically time-tested and there won't be a situation when a malwared update does something bad -- because you won't be doing regular updates. If you do this, committing lockfile (which contains checksums) to repo makes sense.

Also, NPM has granular tokens, which can be created per-package.

fyears commented 1 month ago

hi i notice the main branch has switched to noble pure js implementation, and the readme has been updated.

but may i ask when (in plan) would the new version be released?

thanks!