From 467f0d75be8e0c476e5de83cb814eced9a00e747 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 11 Oct 2026 21:43:55 +0000 Subject: [PATCH 1/2] ci: stage the npm release The release job packs the package. pnpm stage publish sends the tarball to the staging queue. The checklist records pull request 169 as done. The checklist records the npm token check as done. Co-authored-by: Jared Wray --- .github/workflows/release.yaml | 16 ++++++++++------ DEFENSE_IN_DEPTH.md | 6 +++--- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index e4e1095..6b0f56f 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -51,9 +51,13 @@ jobs: - name: Testing run: pnpm test - - name: Publish - # No NPM_TOKEN: pnpm authenticates via OIDC trusted publishing and - # generates provenance attestations from the OIDC identity. - # --no-git-checks is required because the release runs from a detached - # tag checkout rather than a branch. - run: pnpm publish --provenance --no-git-checks --ignore-scripts + - name: Pack + run: | + mkdir -p packed + pnpm pack --pack-destination packed + ls -la packed + + - name: Stage publish + # OIDC stages the tarball. This job does not use an npm token. + # --no-git-checks is required. The release checkout is a detached tag. + run: pnpm stage publish ./packed/*.tgz --access public --provenance --no-git-checks diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index 8dd3b6f..7e609ec 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -30,15 +30,15 @@ Profile: npm library · public - [x] Every action pinned to a full commit SHA (`npx actions-up`) — verified 2026-10-08 - [x] Every job installs Socket Firewall (`SocketDev/action` SHA-pinned, `firewall-version` pinned); `pnpm install` / `npm install` run as `sfw pnpm install` / `sfw npm install` — PR #167 - [x] `.github/workflows/check-workflows.yaml` lints workflows with zizmor on every PR — PR #168 -- [ ] Workflow `name:` and job `name:` contain no spaces (kebab-case) so they can be set as required status checks (PR #169 pending) +- [x] Workflow `name:` and job `name:` contain no spaces (kebab-case) so they can be set as required status checks — PR #169 - [x] `persist-credentials: false` on checkouts that don't push — PR #168 - [x] No `pull_request_target` on workflows that run untrusted PR code — verified 2026-10-08 - [x] Artifact-publishing workflows disable `actions/setup-node` default caching (`package-manager-cache: false`) to prevent cache poisoning — PR #168 -- [ ] No npm tokens (or other registry credentials) in Actions secrets +- [x] No npm tokens (or other registry credentials) in Actions secrets — verified 2026-10-11 ## 5. npm publishing — npm libraries only - [ ] OIDC trusted publishing configured **stage-only** on npmjs.com for the publish workflow — it can stage, never publish live (manual) -- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` +- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` (PR pending) - [ ] Maintainer promotes staged versions with 2FA (manual) - [ ] Drydock connected — staged releases reviewed before promotion (manual) - [ ] No direct publish rights: package requires 2FA and disallows tokens (manual) From c5423aeae887a6bef72725e723fa6b978e7aa7e4 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 11 Oct 2026 21:44:13 +0000 Subject: [PATCH 2/2] docs: record pull request 170 on the stage publish item The checklist names the open pull request. Co-authored-by: Jared Wray --- DEFENSE_IN_DEPTH.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index 7e609ec..4ef9de9 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -38,7 +38,7 @@ Profile: npm library · public ## 5. npm publishing — npm libraries only - [ ] OIDC trusted publishing configured **stage-only** on npmjs.com for the publish workflow — it can stage, never publish live (manual) -- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` (PR pending) +- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` (PR #170 pending) - [ ] Maintainer promotes staged versions with 2FA (manual) - [ ] Drydock connected — staged releases reviewed before promotion (manual) - [ ] No direct publish rights: package requires 2FA and disallows tokens (manual)