Repository navigation
NPM_TOKEN for node-core-utils to auto publish to npm #618
Description
Request to create a NPM_TOKEN on node-core-utils containing an npm automation token for the nodejs-foundation npm user so that we can automate releases for node-core-utils.
Requires 2 approvals from @nodejs/tsc and 2 approvals from @nodejs/community-committee.
Activity
richardlau commentedon Jun 10, 2021
This would be a change in policy:
https://github.com/nodejs/admin/blob/main/npm-management.md
mmarchini commentedon Jun 10, 2021
Nice catch, although I don't interpret that item as "don't use tokens with this user", but rather "you shouldn't login into this user to publish the module manually" (and I'm pretty sure we've done that with some modules anyway).
Either way, we can change our policy or create a new user for each module (saving the credentials on 1password/lastpass), which is a pain but would prevent the "token can publish any module" security concern.
Trott commentedon Jun 11, 2021
I'm 👍 on this, and would also happily 👍 something that clarified the policy.
mhdawson commentedon Jun 11, 2021
It was the ""you shouldn't login into this user to publish the module manually" part that was intended.
I think for auto publishing this makes sense, and I don't see why we'd create another user. I'm +1 to this as well.
joyeecheung commentedon Jun 11, 2021
Don't we do that sort of thing with the secrets repo using dotgpg?
mmarchini commentedon Jun 11, 2021
Yes but that also makes it harder of us to manage access to secrets, which is why I also opened nodejs/build#2647.
bnb commentedon Jun 14, 2021
+1
mhdawson commentedon Oct 19, 2021
@mmarchini do you want to get together to create the required token. I can access the nodejs-foundation account but would like to do it together so that we create what you need (which I'm not 100% sure I'd get right on my own).
targos commentedon Mar 30, 2022
@mhdawson
NPM_TOKEN secret to publish node-core-utils?Type: "Automation"
Click "Generate Token"
Value: the token you copied at 4.
Click "Add secret"
mhdawson commentedon Apr 7, 2022
@targos ok, done but not sure that will be enough since 2FA is enabled.
targos commentedon Apr 8, 2022
It should be fine. Automation tokens bypass 2FA. Thank you!
targos commentedon Apr 8, 2022
Looks like you were right: https://github.com/nodejs/node-core-utils/runs/5885136215?check_suite_focus=true
I don't know what's blocking it, though. I have setup automation tokens without issues before (on an account that has 2FA enabled too).
targos commentedon Apr 14, 2022
I checked on https://www.npmjs.com/package/node-core-utils/access and the package doesn't enforce 2FA so I really don't know what's wrong.
targos commentedon Apr 14, 2022
nodejs-foundationalso has access:targos commentedon Apr 14, 2022
@mhdawson are you sure that you didn't create a publish token instead of an automation token?
mhdawson commentedon Apr 19, 2022
@targos I thought I followed your instructions above exactly. What would be the difference between the two (ie what did I miss in the instructions above that would result in a publish instead of automation token). Once I understand that I can try again.
aduh95 commentedon Apr 19, 2022
See https://github.blog/changelog/2020-10-02-npm-automation-tokens/
An automation token will bypass the 2FA when publishing, while the publish token will not:
mhdawson commentedon Apr 19, 2022
@aduh95 k thanks, updated and I should have it correct this time.
targos commentedon Apr 19, 2022
It worked this time: https://github.com/nodejs/node-core-utils/runs/6081510688?check_suite_focus=true
Thanks!