TYL: npx setup-trusted-publishing

I'm moving all of the Adonis.js AT Protocol packages that I maintain on my GitHub across to an organization so they're all cleanly organised. All of the package names are also going to change as part of that, so I need to:

pnpm dlx setup-trusted-publishing

It works with npm, pnpm, partially with yarn too! Learn more at:

What does it do?

What that tool does is really, really neat: it uses a temporary login with the npm registry to take the package.json in the current directory, strip it of pretty much everything apart from the very basic metadata, and then it publishes that as a new package to the registry. The newly published package's README that says, "Hey, this is just a temporary placeholder whilst we set up trusted publishing. Check back later."

This means that you can deploy a very simple, very safe initial package outside of the GitHub Actions trusted publishing workflows. Once the temporary package is published, you can open up the package on the registry, go to the settings, set up trusted publishing, link it to GitHub, and do all of the stuff that you need to do in order to actually set up trusted publishing. This means that you're never publishing any runnable code without trusted publishing, or without true provenance set up, so the security of the package is always maintained

Then next time that you do a release, trusted publishing will just hopefully work, fingers crossed. No more messing around with getting the repository name right and getting whatever it is all set up correctly, because it always is a pain in the butt to set up trusted publishing, but it's well worth it because of the security benefits!

That said, though, you do still need to bring your own GitHub Actions workflow and configure things properly that way. In the future that might be setup with templates, but for now it is a manual setup because everybody has their own custom deployment process, whether that's release it, changesets, or whatever other systems exist for doing releases automatically. Maybe you also do manual releases for now, it's entirely up to you.

If you have a look at those packages that I mentioned for Adonis JS, then you can see what those workflows are and how that works with changesets. another place that you can check is the setup trusted publishing repository itself, which has a more up-to-date version of those workflows. I'm still migrating and upgrading everything.

This was a tool that I wrote a couple of months ago, and I think everybody should know about it. Breaking from the blog format, this is a "today you learned" instead of "today I learned." Hope you enjoy the tool, and hopefully I'll see people using it.

Also, longer post because Brookie introduced me to Wispr Flow, I have a referral code for that as well if you want to use it.