Publish npm packages to public npmjs.org - #36
Conversation
Move @kin0992/* publishing from GitHub Packages to the public npm registry (npmjs.org) with Sigstore provenance, satisfying OpenSSF Scorecard's Packaging and Signed-Releases checks. - release-reusable.yml: default registry-url to registry.npmjs.org, add required npm_token secret, add provenance input (default true), set NPM_CONFIG_PROVENANCE, drop unused packages: write permission. - Each package publishConfig: access public + provenance true, drop the GitHub Packages registry override. - .changeset/config.json: access public. - Changeset bumps all four packages (minor) documenting the move. - Docs (README, CONTRIBUTING, CONSUMING): no-auth public install, npm_token secret, provenance prerequisites. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: 66f326b The changes in this PR will be included in the next version bump. This PR includes changesets to release 4 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 235ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 231ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 229ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 231ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 233ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 226ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 232ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 237ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 240ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 205ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 205ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 208ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
Declare the NPM_TOKEN repository secret consumed by the release workflow. Value is supplied out-of-band via stack config: pulumi config set --secret devToolkit:npmToken <token> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 176ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 174ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 178ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
The Configure step bakes the literal token into .npmrc, which pnpm reads at publish time, so NODE_AUTH_TOKEN/NPM_TOKEN on the changesets step were unused. Keep GITHUB_TOKEN and the provenance flag. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 225ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 230ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 233ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
Write _authToken as an unexpanded ${NODE_AUTH_TOKEN} reference and
provide it as env only on the publish step, so the secret is never
written to disk. Move the .npmrc write after Build so no earlier
pnpm run hits the unresolved placeholder.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 239ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 239ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 241ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 246ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 233ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 234ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
Support tag-only consumers (e.g. release = changeset tag) that do not publish to a registry: npm-scope and npm_token are now optional, and the npm auth step is skipped when npm-scope is empty. Publishing consumers still set npm-scope + npm_token as before. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 227ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 222ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 220ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
🍹
|
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 225ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 222ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 230ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
=== branch-name === Running benchmark: branch-name-eval ✓ [1/3] Feature Branch Naming 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 234ms
Task Results
Benchmark: branch-name-eval | Skill: git/branch-name | Model: claude-sonnet-4-20250514 === commit-message === Running benchmark: commit-message-eval ✓ [1/3] Basic Bug Fix Commit 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 250ms
Task Results
Benchmark: commit-message-eval | Skill: git/commit-message | Model: claude-sonnet-4-20250514 === pr-title-description === Running benchmark: pr-title-description-eval ✓ [1/3] Basic Feature PR 🧪 Waza Eval ResultsStatus: ✅ Passed | Score: 1.00 | Duration: 231ms
Task Results
Benchmark: pr-title-description-eval | Skill: git/pr-title-description | Model: claude-sonnet-4-20250514 ═══════════════════════════════════════════════ Skill Status Pass Rate Avg Score |
## What Two leftover references to GitHub Packages from before the npmjs.org migration (#36): - `.npmrc` — the `@kin0992` scope still pointed at `npm.pkg.github.com`; now points to `registry.npmjs.org` (the public registry packages actually publish to). - `.changeset/README.md` — the release-flow description still said "publishes to GitHub Packages"; updated to npmjs.org. ## Why Since #36, packages publish publicly to npmjs.org with provenance (`release-reusable.yml` authenticates against `registry.npmjs.org`, and `CONSUMING.md` documents anonymous `pnpm add`). Workspace installs were unaffected (`workspace:*`), but the stale scope override would route any real `@kin0992` registry lookup to GitHub Packages (requiring a token), and the doc was misleading. No package source changed, so no changeset. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
What
Migrates
@kin0992/*package publishing from GitHub Packages to the public npm registry (npmjs.org) with Sigstore provenance. This satisfies OpenSSF Scorecard'sPackagingandSigned-Releaseschecks and removes the auth burden for consumers.Changes
release-reusable.ymlregistry-urldefault →https://registry.npmjs.orgnpm_tokensecret (the npmjs.org Automation token)provenanceinput (defaulttrue); setsNPM_CONFIG_PROVENANCEnpm_tokeninstead ofgithub.tokenpackages: writepermission (keptid-token: writefor provenance)release.yml— same permission trim;secrets: inheritalready forwardsNPM_TOKEN→npm_tokenpublishConfig(×4) —access: public,provenance: true, dropped the GitHub Packagesregistryoverride.changeset/config.json—access: publicinfra/index.ts— declares theNPM_TOKENActions secret as agithub.ActionsSecret, so the release credential is tracked as IaC. Value is supplied out-of-band via stack config, never in code.npm_tokensecret, provenance prerequisitesRequired before merge
@kin0992scope on npmjs.org.pulumi upto push theNPM_TOKENsecret to the repo.Provenance also requires the repo to be public (it is) and the job to grant
id-token: write(it does). Existing GitHub Packages versions remain available but stop receiving updates.🤖 Generated with Claude Code