Skip to content

Document that the npm trusted publisher is configured #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
elkaix merged 1 commit into from
Sep 24, 2026
Merged

Document that the npm trusted publisher is configured #65

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .claude/skills/release/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,10 @@ Repo-local maintainer skill; it is not shipped to plugin users.

Rerunning after a partial run is safe: an existing tag at HEAD resumes at the push.

`PUBLISH_LOCAL=1 ./scripts/release.sh "Notes"` publishes to npm from this machine's npm login (no provenance) before pushing the tag. It builds, tests and smoke-tests a clean worktree of the tag first. npm processes uploads asynchronously; the CI npm job waits up to 10 minutes for the version and then skips it. Use this until the npm trusted publisher is configured.
`PUBLISH_LOCAL=1 ./scripts/release.sh "Notes"` publishes to npm from this machine's npm login (no provenance) before pushing the tag. It builds, tests and smoke-tests a clean worktree of the tag first. npm processes uploads asynchronously; the CI npm job waits up to 10 minutes for the version and then skips it. It is now only a fallback: the npm trusted publisher is configured (2026-09-24), so a plain `./scripts/release.sh` lets CI publish with provenance.

`publish.yml` (on `v*.*.*` tags) re-verifies versions against the tag, rebuilds and tests, then:
- `npm publish --provenance` via npm trusted publishing (OIDC, no token; skipped if the version exists). One-time setup on npmjs.com: package Settings → Trusted publisher → GitHub Actions, `PyModel/designer-skill`, workflow `publish.yml`, environment `npm`, with direct publishing allowed (`npm trust github … --allow-publish`). `npm trust github` cannot do it from a 2FA-bypass token. Until then the job falls back to waiting for a `PUBLISH_LOCAL=1` publish;
- `npm publish --provenance` via npm trusted publishing (OIDC, no token; skipped if the version exists). One-time setup on npmjs.com: package Settings → Trusted publisher → GitHub Actions, `PyModel/designer-skill`, workflow `publish.yml`, environment `npm`, with direct publishing allowed (`npm trust github … --allow-publish`). Configured 2026-09-24 (saving needs the owner's security key; `npm trust github` cannot do it from a 2FA-bypass token). If the CI publish fails, the job waits for a `PUBLISH_LOCAL=1` publish;
- MCP registry `mcp-publisher validate` + `publish` via GitHub OIDC (fatal on failure). The namespace is case-sensitive: `io.github.PyModel/*`;
- `gh release create` from the tag notes (skipped if it exists).

Expand Down
Loading