Publish NPM Package with GitHub Actions
juffalow.com
Publish NPM Package with GitHub Actions
1–10 of 29 posts
Re: Publish NPM Package with GitHub Actions
#2Could something similar be used to publish an artifact to Pypi?
Re: Publish NPM Package with GitHub Actions
#3Could something similar be used to publish an artifact to Pypi?
https://github.com/marketplace/actions/pypi-publish seems it exists!
Re: Publish NPM Package with GitHub Actions
#4Re: Publish NPM Package with GitHub Actions
#5Could something similar be used to publish an artifact to Pypi?
I really like the idea of automating this whole process. While not generic to publishing to pypi, I was playing around with this process in a toy repo I have, where it builds a Rust/Python package, creates a release on Github if I bump the version number, build the package and publishes it on Pypi.
It probably not the cleanest way to do it, but I liked having it "spelled out" in steps manually to play around and learn more about how to do this.
You can see my workflow in the toy repo here: https://github.com/ikornaselur/img-utils/blob/master/.github...
Re: Publish NPM Package with GitHub Actions
#6Note that you need to be very careful about this if you have a public repository that accepts PR's from third parties. There is nothing stopping someone from adding this via a PR:
- name: Give me this person's NPM token
run: cat ~/.npmrc
A number of open source projects have been hacked this way in the past. This is why I keep my NPM publish entirely isolated from the Github repo. I review every PR that is submitted to me carefully, but don't want any chance of accidentally merging in a malicious PR that will compromise my NPM packages.
Re: Publish NPM Package with GitHub Actions
#7You don't need to write the environment variable to the .npmrc file... just setting the NODE_AUTH token and registry_url parameters. Here's mine...
https://gist.github.com/tracker1/fdd5ceab8f532afc3a05ab9c0bd...
Re: Publish NPM Package with GitHub Actions
#8Could something similar be used to publish an artifact to Pypi?
I really like the idea of automating this whole process. While not generic to publishing to pypi, I was playing around with this process in a toy repo I have, where it builds a Rust/Python package, creates a release on Github if I bump the version number, build the package and publishes it on Pypi. It probably not the cleanest way to do it, but I liked having it "spelled out" in steps manually to play around and lear…
since npm version creates a tag, I have an action for v* tags that will build/publish... have migrated a couple projects from travis-ci ... TFA is a bit mixed, you don't need to push to npmrc for this behavior though.
(I did post this link in direct thread, copied here)
https://gist.github.com/tracker1/fdd5ceab8f532afc3a05ab9c0bd...
Re: Publish NPM Package with GitHub Actions
#9Note that you need to be very careful about this if you have a public repository that accepts PR's from third parties. There is nothing stopping someone from adding this via a PR: - name: Give me this person's NPM token run: cat ~/.npmrc Even if you have it locked down so they can't see the build output, they could just add a curl command to post the contents of your .npmrc file to their server. A number of open sour…
Thank you for this comment! It is a very good point.
Re: Publish NPM Package with GitHub Actions
#10Note that you need to be very careful about this if you have a public repository that accepts PR's from third parties. There is nothing stopping someone from adding this via a PR: - name: Give me this person's NPM token run: cat ~/.npmrc Even if you have it locked down so they can't see the build output, they could just add a curl command to post the contents of your .npmrc file to their server. A number of open sour…
absolutely... I think Github should probably put a warning statement on any PRs that include changes to .github/