Question
Following "Research npm Trusted Publishing + staged publishing" (#4)'s findings, configure npmjs.org's Trusted Publisher link for @dnd-mapp/template-lib-angular, an org-owner action on npmjs.org linking the GitHub repo + release-publish.yml workflow, mirroring the one-time org-owner setup template-app-angular's README already documents for Docker Hub (DMA_BOT_SSH_SIGNING_KEY secret access, dnd-mapp GitHub App bypass grant).
Required bootstrap step (confirmed by research, not optional): neither Trusted Publishing nor Staged Publishing can be configured for a package that has never been published, npm has no OIDC path for a first publish. So this ticket's checklist must include a one-time manual npm publish (token or local login + 2FA) of an initial version before the Trusted Publisher link can be set up at all. This is distinct from, and doesn't reopen, the map's decision to leave the automated CI release pipeline unexercised: that still stands, only this one manual bootstrap publish is required, and it was already going to be manual/HITL work either way.
This is manual work outside the repo (HITL), resolve by handing the org owner a precise checklist derived from the research findings (bootstrap publish, then configure Trusted Publisher, restricting "allowed actions" to npm stage publish only, per the research's recommendation for keeping CI unable to go public on its own), and record what was actually configured (so "Rewrite CI for npm publish" and future instantiated repos know the exact setup).
Question
Following "Research npm Trusted Publishing + staged publishing" (#4)'s findings, configure npmjs.org's Trusted Publisher link for
@dnd-mapp/template-lib-angular, an org-owner action on npmjs.org linking the GitHub repo +release-publish.ymlworkflow, mirroring the one-time org-owner setuptemplate-app-angular's README already documents for Docker Hub (DMA_BOT_SSH_SIGNING_KEYsecret access,dnd-mappGitHub App bypass grant).Required bootstrap step (confirmed by research, not optional): neither Trusted Publishing nor Staged Publishing can be configured for a package that has never been published, npm has no OIDC path for a first publish. So this ticket's checklist must include a one-time manual
npm publish(token or local login + 2FA) of an initial version before the Trusted Publisher link can be set up at all. This is distinct from, and doesn't reopen, the map's decision to leave the automated CI release pipeline unexercised: that still stands, only this one manual bootstrap publish is required, and it was already going to be manual/HITL work either way.This is manual work outside the repo (HITL), resolve by handing the org owner a precise checklist derived from the research findings (bootstrap publish, then configure Trusted Publisher, restricting "allowed actions" to
npm stage publishonly, per the research's recommendation for keeping CI unable to go public on its own), and record what was actually configured (so "Rewrite CI for npm publish" and future instantiated repos know the exact setup).