search

mikeal / merge-release

Automatically release all merges to master on npm.
Other
471 stars 64 forks source link

One time password #16

Open bpierre opened 4 years ago

bpierre commented 4 years ago

Hi, thank you for doing merge-release!

I am trying to set it up, and I was wondering if it was possible to keep the account of the authentication key in “authorization only mode” for the 2FA? I get an error asking for an OTP at the moment.

mikeal commented 4 years ago

There isn’t a great solution to this yet.

Unfortunately, the way npm does OTP restrictions for publishing doesn’t leave a lot of room for automation.

If you disable OTP for publishes it’ll work. I know @bcoe is working on some infrastructure that puts a more limited token infrastructure in front of npm that you then trust with your OTP but I don’t think it’s available yet for people to use without setting up their own infrastructure.

bcoe commented 4 years ago

@mikeal we open-sourced it, happy to help walk you through it at some point:

https://github.com/GoogleCloudPlatform/wombat-dressing-room

https://opensource.googleblog.com/2020/01/wombat-dressing-room-npm-publication_10.html

:ok_hand: