Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions .github/workflows/publish.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
name: Publish package

on:
push:
tags:
- 'v*'
workflow_dispatch:

jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
steps:
- name: Checkout repository
Comment on lines +15 to +18

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Scope npm token to publish step

NODE_AUTH_TOKEN is configured at the job level, which means the secret is passed to npm ci and npm test as well as the publish step. Any dependency install script or test code could print or exfiltrate the token, giving the secret to untrusted code when the workflow runs. For least privilege, set the environment variable only on the Publish package step (or use actions/setup-node with token) so that only the actual publish command receives the secret.

Useful? React with 👍 / 👎.

uses: actions/checkout@v4

- name: Use Node.js 20
uses: actions/setup-node@v4
with:
node-version: '20'
registry-url: 'https://registry.npmjs.org'

- name: Install dependencies
run: |
if [ -f package-lock.json ]; then
npm ci
else
npm install
fi

- name: Run tests
run: npm test

- name: Publish package
run: npm publish --access public
12 changes: 12 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -135,3 +135,15 @@ node example.js
```

El script carga la configuración `external-checks.json`, simula resolvers externos y muestra los errores detectados.

## Publicar una nueva versión

El empaquetado y la publicación ahora se realizan a través de un flujo de GitHub Actions. Para liberar una nueva versión:

1. Actualizá la versión en `package.json` usando `npm version <major|minor|patch>`.
2. Subí el commit y el tag (`git push origin main --follow-tags`).
3. El workflow [`publish.yml`](.github/workflows/publish.yml) se activará al detectar el tag (`v*`), ejecutará los tests y publicará el paquete con `npm publish` usando el secreto `NPM_TOKEN`.

> **Nota:** el workflow instala dependencias con `npm ci` cuando existe `package-lock.json` y utiliza `npm install` como respaldo, por lo que no es obligatorio versionar el lockfile.

Asegurate de configurar el secreto `NPM_TOKEN` en el repositorio con un token de acceso a npm que tenga permisos de publicación.