Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Publish NPM Package with GitHub Actions

juffalow.com

Post reply on HN
Print view View original

11–20 of 29 posts

Re: Publish NPM Package with GitHub Actions

#11

Post by pafo »

tracker1 wrote: post #8
ikornaselur wrote: post #5

Earlier quoted context omitted.

I really like the idea of automating this whole process. While not generic to publishing to pypi, I was playing around with this process in a toy repo I have, where it builds a Rust/Python package, creates a release on Github if I bump the version number, build the package and publishes it on Pypi. It probably not the cleanest way to do it, but I liked having it "spelled out" in steps manually to play around and lear…

since npm version creates a tag, I have an action for v* tags that will build/publish... have migrated a couple projects from travis-ci ... TFA is a bit mixed, you don't need to push to npmrc for this behavior though. (I did post this link in direct thread, copied here) https://gist.github.com/tracker1/fdd5ceab8f532afc3a05ab9c0bd...

Yes, you do not need .npmrc for publishing. But I am using Yarn and it didn't work for me to just set NODE_AUTH_TOKEN :-(

Re: Publish NPM Package with GitHub Actions

#12

Post by tracker1 »

pafo wrote: post #11
tracker1 wrote: post #8

Earlier quoted context omitted.

since npm version creates a tag, I have an action for v* tags that will build/publish... have migrated a couple projects from travis-ci ... TFA is a bit mixed, you don't need to push to npmrc for this behavior though. (I did post this link in direct thread, copied here) https://gist.github.com/tracker1/fdd5ceab8f532afc3a05ab9c0bd...

Yes, you do not need .npmrc for publishing. But I am using Yarn and it didn't work for me to just set NODE_AUTH_TOKEN :-(

It does work for `npm publish` ... I'd submit a bug with yarn, and/or github.

Re: Publish NPM Package with GitHub Actions

#14

Post by robrtsql »

NathanKP wrote: post #6

Note that you need to be very careful about this if you have a public repository that accepts PR's from third parties. There is nothing stopping someone from adding this via a PR: - name: Give me this person's NPM token run: cat ~/.npmrc Even if you have it locked down so they can't see the build output, they could just add a curl command to post the contents of your .npmrc file to their server. A number of open sour…

Does this rely on the `.npmrc` file being cached from a previous run (which will only happen if you use a self-hosted runner)? Or does this vulnerability mean that PR contributors basically have direct access to all of the secrets that you put on your GitHub repo?

Re: Publish NPM Package with GitHub Actions

#15

Post by [deleted] »

tracker1 wrote: post #10
NathanKP wrote: post #6

Note that you need to be very careful about this if you have a public repository that accepts PR's from third parties. There is nothing stopping someone from adding this via a PR: - name: Give me this person's NPM token run: cat ~/.npmrc Even if you have it locked down so they can't see the build output, they could just add a curl command to post the contents of your .npmrc file to their server. A number of open sour…

absolutely... I think Github should probably put a warning statement on any PRs that include changes to .github/

[deleted]

Re: Publish NPM Package with GitHub Actions

#16

Post by judge2020 »

tracker1 wrote: post #10
NathanKP wrote: post #6

Note that you need to be very careful about this if you have a public repository that accepts PR's from third parties. There is nothing stopping someone from adding this via a PR: - name: Give me this person's NPM token run: cat ~/.npmrc Even if you have it locked down so they can't see the build output, they could just add a curl command to post the contents of your .npmrc file to their server. A number of open sour…

absolutely... I think Github should probably put a warning statement on any PRs that include changes to .github/

That would be good for the UI, but PRs that modify .github/workflows already never run the checks. I guess they could also modify your npm `scripts` to `cat .npmrc` but that's another issue.

Re: Publish NPM Package with GitHub Actions

#17

Post by Latty »

toomuchtodo wrote: post #2

Could something similar be used to publish an artifact to Pypi?

I am actively doing this for a project of mine: https://github.com/Lattyware/unrpa

I also do a MyPy type check as well with the actions stuff. It's very similar to the GitLab CI stuff, if you have used that.

Re: Publish NPM Package with GitHub Actions

#18

Post by xPaw »

NathanKP wrote: post #6

Note that you need to be very careful about this if you have a public repository that accepts PR's from third parties. There is nothing stopping someone from adding this via a PR: - name: Give me this person's NPM token run: cat ~/.npmrc Even if you have it locked down so they can't see the build output, they could just add a curl command to post the contents of your .npmrc file to their server. A number of open sour…

How would the workflow run if they specify `on: release: types: [published]`?

Re: Publish NPM Package with GitHub Actions

#19

Post by NathanKP »

robrtsql wrote: post #14
NathanKP wrote: post #6

Note that you need to be very careful about this if you have a public repository that accepts PR's from third parties. There is nothing stopping someone from adding this via a PR: - name: Give me this person's NPM token run: cat ~/.npmrc Even if you have it locked down so they can't see the build output, they could just add a curl command to post the contents of your .npmrc file to their server. A number of open sour…

Does this rely on the `.npmrc` file being cached from a previous run (which will only happen if you use a self-hosted runner)? Or does this vulnerability mean that PR contributors basically have direct access to all of the secrets that you put on your GitHub repo?

Yeah in the authors example they are writing a .npmrc file but it could also just as easily be outputting the env variable of the secret. Fundamentally if NPM can access the secret in the build that means anyone who can modify the build process can also access the secret.

There are so many vectors of vulnerability: from modifying NPM package.json scripts, to modifying makefiles, to modifying the build scripts, etc that I find the only true solution is to have one public repo that accepts PR's from the public and only does checks like linting and running the tests, but does not have any access to secrets for publish. Ideally the public repo also does not contain your actual publish scripts either, only you as the package owner have access to them, as they are stored in your own private repo.

Then have another private repo that you sync into or an external, fully private build system that keeps the secrets, and does the real NPM publish. I think it is just far too dangerous to do the NPM publish from the public facing repo. I assume the author is well aware of this too, but just wanted to include a warning in case anyone else hasn't run into this or thought of it yet.

Post reply on HN