Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🚀 Feature: Create NPM_TOKEN npm automation publish tokens for the user automatically #1900

Open
2 tasks done
JoshuaKGoldberg opened this issue Jan 17, 2025 · 0 comments
Open
2 tasks done
Labels
status: blocked Waiting for something else to be resolved type: feature New enhancement or request

Comments

@JoshuaKGoldberg
Copy link
Owner

Bug Report Checklist

Overview

Right now, CTA asks that upon creation of a repository you manually add an npm automation token under NPM_TOKEN:

1. Create two tokens in [repository secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets) _(unless you chose to opt out of releases)_:
- `ACCESS_TOKEN`: A [GitHub PAT](https://github.com/settings/tokens/new) with _repo_ and _workflow_ permissions
- `NPM_TOKEN`: An [npm access token](https://docs.npmjs.com/creating-and-viewing-access-tokens/) with _Automation_ permissions

This is clunky and annoying to do every single time a repository is created. I'd strongly prefer to have this be done automatically through the npm API for users.

Additional Info

Per https://docs.npmjs.com/creating-and-viewing-access-tokens#creating-tokens-with-the-cli & https://docs.npmjs.com/creating-and-viewing-access-tokens#creating-granular-access-tokens-on-the-website, it doesn't look like this can be done automatically for automation tokens. 😞. I'd wager that's a security concern. So, marking this as blocked.

@JoshuaKGoldberg JoshuaKGoldberg added status: blocked Waiting for something else to be resolved type: feature New enhancement or request labels Jan 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: blocked Waiting for something else to be resolved type: feature New enhancement or request
Projects
None yet
Development

No branches or pull requests

1 participant