Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ci] Remove unnecessary steps from the publish pipeline #3904

Open
sotojn opened this issue Jan 14, 2025 · 1 comment
Open

[ci] Remove unnecessary steps from the publish pipeline #3904

sotojn opened this issue Jan 14, 2025 · 1 comment
Assignees
Labels
ci enhancement priority:low security Pull requests that address a security vulnerability

Comments

@sotojn
Copy link
Contributor

sotojn commented Jan 14, 2025

I recently updated teraslice to use yarn 4, which required changes to the publish pipeline. As part of this update, I added a step to properly configure yarn 4's authentication with the npm token.

In Yarn 1, signing in with the npm CLI was sufficient for running yarn publish. However, with Yarn 4, the new authentication step renders these previous steps redundant. Additionally, echoing GitHub secrets in the pipeline exposes unnecessary risks, even though GitHub protects us from leaking the npm token. We should remove these steps.

What needs to be removed:

- name: Register npm token
run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
- name: Verify npm authentication
run: npm whoami

What's already been added to replace the above code:

- name: Verify npm authentication within yarn
env:
CI_NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: yarn npm whoami
- name: Publish to npm
env:
CI_NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: yarn ts-scripts publish -t latest npm

@sotojn sotojn added enhancement priority:low ci security Pull requests that address a security vulnerability labels Jan 14, 2025
@sotojn sotojn self-assigned this Jan 14, 2025
@sotojn
Copy link
Contributor Author

sotojn commented Jan 14, 2025

Also the publish-tag.yml needs these steps removed as well. So two files need to be changed:

- name: Register npm token
run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
- name: Verify npm authentication
run: npm whoami

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ci enhancement priority:low security Pull requests that address a security vulnerability
Projects
None yet
Development

No branches or pull requests

1 participant