From 2f6a2894f8cb98a9f0d2479a306b387b75092ad4 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Wed, 22 Jul 2026 08:40:09 -0400 Subject: [PATCH 1/4] Prep for first npm publish (v0.3.0) - Adds a publish workflow: publishes to the npm registry when a GitHub release is published, authenticating via npm trusted publishing (OIDC, automatic provenance); guards that the release tag matches the package version. - Bumps the version to 0.3.0 for the first registry release. - README: makes registry install primary; keeps the GitHub install as an alternative, now semver-pinned. --- .github/workflows/publish.yaml | 34 ++++++++++++++++++++++++++++++++++ README.md | 8 ++++++-- package.json | 2 +- 3 files changed, 41 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/publish.yaml diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml new file mode 100644 index 0000000..33b1d07 --- /dev/null +++ b/.github/workflows/publish.yaml @@ -0,0 +1,34 @@ +name: publish + +# Publishes to the npm registry when a GitHub release is published. +# Auth: npm trusted publishing (OIDC) — configure on npmjs.com under +# package Settings > Trusted Publisher (repo chalin/link-cache, workflow +# publish.yaml). Provenance is generated automatically. No npm token needed. + +on: + release: + types: [published] + +permissions: {} + +jobs: + publish: + runs-on: ubuntu-latest + permissions: + contents: read + id-token: write # required for OIDC trusted publishing + provenance + steps: + - uses: actions/checkout@v6 + - uses: actions/setup-node@v6 + with: + node-version: 24 + registry-url: https://registry.npmjs.org + cache: npm + cache-dependency-path: package.json + - run: npm install + - run: npm run check + - name: Check that the release tag matches the package version + run: | + version=$(node -p 'require("./package.json").version') + test "$GITHUB_REF_NAME" = "v$version" + - run: npm publish diff --git a/README.md b/README.md index baaccb9..298654a 100644 --- a/README.md +++ b/README.md @@ -24,10 +24,14 @@ change when links actually change. ## Install -Until this package is published to the npm registry, install it from GitHub: +```sh +npm install --save-dev link-cache +``` + +Or, to install from GitHub rather than the npm registry: ```sh -npm install --save-dev github:chalin/link-cache +npm install --save-dev github:chalin/link-cache#semver:^0.3.0 ``` This puts both bins on your project's `PATH`. diff --git a/package.json b/package.json index 6f877a2..a8de595 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "link-cache", - "version": "0.2.1", + "version": "0.3.0", "description": "Zero-dependency helper CLIs for cached Lychee link-checking: lychee-norm-cache (run + normalize .lycheecache) and refcache (inspect/prune the cache).", "keywords": [ "lychee", From c4491c00fe9282ed9ad5f4e0b13f07def44b61b2 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Wed, 22 Jul 2026 09:06:01 -0400 Subject: [PATCH 2/4] Harden the publish workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Pins actions to commit SHAs — the job holds npm-publish capability (id-token: write), so mutable tags are an unnecessary risk. - Installs with --ignore-scripts so dependency install hooks can't execute in the publish job. - Moves the tag/version guard before the install so nothing runs for a mismatched release tag. --- .github/workflows/publish.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 33b1d07..0efce6e 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -18,17 +18,17 @@ jobs: contents: read id-token: write # required for OIDC trusted publishing + provenance steps: - - uses: actions/checkout@v6 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 24 registry-url: https://registry.npmjs.org cache: npm cache-dependency-path: package.json - - run: npm install - - run: npm run check - name: Check that the release tag matches the package version run: | version=$(node -p 'require("./package.json").version') test "$GITHUB_REF_NAME" = "v$version" + - run: npm install --ignore-scripts + - run: npm run check - run: npm publish From 6d2f840c21546218033dc217c4f683eac6a7e4f0 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Wed, 22 Jul 2026 09:32:09 -0400 Subject: [PATCH 3/4] Run no registry-delivered code in the publish job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per review: with no lockfile, `npm run check` resolves devDependencies fresh at release time and executes them in the job that holds `id-token: write`. Drop install and checks from the publish job — the `check` workflow already validates every push to main, and publishing needs no node_modules (zero runtime deps, no build, no lifecycle scripts). Also drop the now-unused setup-node cache config and add `--ignore-scripts` to `npm publish` as defense in depth. --- .github/workflows/publish.yaml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 0efce6e..863636b 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -23,12 +23,13 @@ jobs: with: node-version: 24 registry-url: https://registry.npmjs.org - cache: npm - cache-dependency-path: package.json - name: Check that the release tag matches the package version run: | version=$(node -p 'require("./package.json").version') test "$GITHUB_REF_NAME" = "v$version" - - run: npm install --ignore-scripts - - run: npm run check - - run: npm publish + # No install or checks here: the `check` workflow already validates every + # push to main, and publishing needs no node_modules (zero runtime deps, + # no build step, no lifecycle scripts). Keeping this job free of + # registry-delivered code means nothing untrusted runs with id-token + # authority. + - run: npm publish --ignore-scripts From a01099a7e146a183a4634a7c5453ad05469e2660 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Wed, 22 Jul 2026 09:49:20 -0400 Subject: [PATCH 4/4] Trim workflow comments (DRY pass, no behavior change) --- .github/workflows/publish.yaml | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 863636b..cd34c2a 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -1,9 +1,7 @@ name: publish -# Publishes to the npm registry when a GitHub release is published. -# Auth: npm trusted publishing (OIDC) — configure on npmjs.com under -# package Settings > Trusted Publisher (repo chalin/link-cache, workflow -# publish.yaml). Provenance is generated automatically. No npm token needed. +# Auth: npm trusted publishing (OIDC) — requires one-time setup on npmjs.com +# (package Settings > Trusted Publisher: this repo + this workflow). on: release: @@ -16,7 +14,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - id-token: write # required for OIDC trusted publishing + provenance + id-token: write # OIDC trusted publishing + provenance steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 @@ -27,9 +25,7 @@ jobs: run: | version=$(node -p 'require("./package.json").version') test "$GITHUB_REF_NAME" = "v$version" - # No install or checks here: the `check` workflow already validates every - # push to main, and publishing needs no node_modules (zero runtime deps, - # no build step, no lifecycle scripts). Keeping this job free of - # registry-delivered code means nothing untrusted runs with id-token - # authority. + # No install or checks: `check` already gates every push, and publishing + # needs no node_modules — so no registry-delivered code runs with + # id-token authority. - run: npm publish --ignore-scripts