Skip to content

Conversation

@mythz
Copy link
Member

@mythz mythz commented Nov 22, 2025

No description provided.

Package.json updates:
- Remove invalid "main" field (CLI tool, not a library)
- Add repository information
- Set private: false for npm publishing
- Update test script to use ./test.sh
- Add author: ServiceStack
- Add keywords: cli, generator

GitHub Actions workflows:
- Add ci.yml: Runs tests on push/PR for Node 14, 16, 18, 20
- Add publish.yml: Auto-publish to npm on GitHub releases
- Add workflows/README.md: Documentation for publishing process

Publishing documentation:
- Update README with automated publishing instructions
- Add manual publishing instructions
- Document npm version bumping process
- Link to workflows documentation
Workflow changes:
- Add permissions for id-token: write and contents: read
- Enable OIDC authentication for npm publishing
- Add --provenance flag for supply chain security
- Add --access public flag to ensure package visibility

Documentation updates:
- Update workflows/README.md with OIDC authentication details
- Explain provenance attestations and security benefits
- Add manual publishing instructions with --access public flag
- Update main README to highlight provenance publishing

Benefits:
- Enhanced security through OIDC authentication
- Supply chain transparency with provenance attestations
- Automatic attestation generation on GitHub Actions
- Better verification of package authenticity
@mythz mythz merged commit f841eb9 into main Nov 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants