QuesbyDec 3
Zach Leatherman

This took a lot of tedious work but I’m now npm token free, weee!

The @11ty ecosystem is now using Trusted Publishers (https://docs.npmjs.com/trusted-publishers)

Dec 2 at 10:30pmWeb
Show threadZach LeathermanDec 2
As a security precaution I had previously configured every single 11ty repository to have its own single-package-scoped npm token (there were probably ~30 or so), so this is a lovely improvement 😅
Show threadAlex GrantDec 2

@zachleat

I did this, but I didn't get the OIDC badges. Do I have to delete all the granular tokens, too?

Show threadZach LeathermanDec 2
@localnerve I wouldn’t expect so (but I couldn’t say 100%). Sounds like you made a config error somewhere? I locked down npm publishing access to require 2FA and disallow tokens and deleted my tokens from GitHub Settings too — I’d also check your Actions yml to make sure the token isn’t being used there
Show threadAlex GrantDec 3

@zachleat

Totally probable misconfig, more probable than not...
I saw that option, but my brain can't grok how I can have 2fa with GHA deployment... Looks like I have more reading to do...

Show threadZach LeathermanDec 3
@localnerve it doesn’t do 2FA with GHA, fwiw 😅
Show threadAlex GrantDec 10

@zachleat

Fwiw, my problem was an older version of npm in the GHA runner...

Show threadZach LeathermanDec 10

@localnerve ugh, sorry I should have remembered that I ran into that same issue. The error message on that one was very vague too iirc 😭

Appreciate you circling back!

Show threadFredericDec 3
@zachleat Uh, thanks for reminding me. Still had one token there which hadn't been used in years. 🙈
Show threadZach LeathermanDec 3
@frederic death to tokens!
Show threadQuesbyDec 3
@zachleat Tedious work but a great improvement. Working with long-lived credentials is a risk when you deal with a bunch of packages. CI releases just aren’t necessary for my setup, so I publish locally.