Repository navigation
Create a Node.js org account on pypi registry #863
Description
At the moment, @ryzokuken is the maintainer of the gyp-next package on pypi: https://pypi.org/project/gyp-next/.
I discussed with @ryzokuken to setup a Node.js org account and host gyp-next under that org account so that we can better maintain the ownership of the package.
I would like to request to setup a Node.js organization for this purpose.
Activity
benjamingr commentedon Apr 25, 2024
SGTM
MoLow commentedon Apr 26, 2024
+1. there is also this package that can benefit from such an account: nodejs/tap2junit#56
targos commentedon Apr 26, 2024
Should this be owned by the build WG or the TSC?
legendecas commentedon Apr 29, 2024
Is https://www.npmjs.com/~nodejs-foundation owned by the build WG or the TSC?
targos commentedon Apr 29, 2024
Build WG
legendecas commentedon Apr 29, 2024
I believe the pypi account can follow the npm account ownership.
targos commentedon Apr 29, 2024
@nodejs/build wdyt?
richardlau commentedon Apr 29, 2024
I think the question is, who needs access to it?
The original reasons that the Build WG owns the npm account was as an emergency access in the event that people become inactive/leave the project (so we could manage who could publish modules). Initially we did not actively use the account (i.e. individuals published the modules under their own accounts). Over time that changed and I think we now publish modules under that account via GitHub Actions. Possibly another reason might be the TSC at the time didn't have a solution for storing secrets (there's a 1Password account now, I believe), i.e. the account's log in details (I may be misremembering this one).
mhdawson commentedon Apr 29, 2024
+1 from me. I think using 1password might make the most sense unless this is somehow related to build/infra
targos commentedon May 10, 2024
+1 on 1password + moving the npm credentials there too
legendecas commentedon May 13, 2024
I have submitted request to create a orgnanization named
nodejson pypi.org. Still waiting for response.abmusse commentedon May 14, 2024
+1 on using 1 password to manage credentials
legendecas commentedon May 29, 2024
Account created and saved in 1password.
targos commentedon May 30, 2024
I rotated the npm credentials and saved them in 1Password too.
richardlau commentedon May 30, 2024
@targos could you update
build/test/test_logins.mdin the secrets repo, which previously recorded the account name, password and 2fa recovery codes? I don't mind if we move that to 1Password, but we currently documentadmin/npm-management.md
Lines 37 to 38 in a2d01cf
targos commentedon May 30, 2024
Ok but can I move them to infra level? IMO this doesn't belong to test
richardlau commentedon May 30, 2024
SGTM
mhdawson commentedon May 30, 2024
+1 to moving to infra or storing all the info in 1 password. We need the recovery info.
targos commentedon May 31, 2024
Secrets repo updated.