chore(scripts): add cloudflare-client to npm trusted-publisher PACKAGES - #1723
Merged
Conversation
The cloudflare-client package (added in #1720) is publishable but was missing from the PACKAGES array in setup-npm-trusted-publishers.sh, which would trip the script's forward-drift check. Add it alphabetically alongside the other clients.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1. Abstract
Adds
@adobe/spacecat-shared-cloudflare-clientto thePACKAGESarray inscripts/setup-npm-trusted-publishers.shso the npm OIDC trusted-publisher setup script recognises it and its forward-drift check passes.2. Reasoning
spacecat-shared-cloudflare-clientwas introduced in #1720 as a publishable package but was never added to thePACKAGESarray the trusted-publisher setup script audits. That script's forward-drift check fails closed when a publishable workspace package is missing fromPACKAGES, so leaving it out would abort the next trusted-publisher setup/verify run. This is the same onboarding step already done for the other client packages.3. High-level overview of the changes
One-line addition to a release-tooling array - no application code, no package release.
scripts/setup-npm-trusted-publishers.sh:@adobe/spacecat-shared-cloudflare-clientadded toPACKAGES, alphabetically betweencloud-manager-clientandcontent-client. After this the script's drift check sees zero forward drift and the package is covered by trusted-publisher registration/audit.No behaviour change for any running service.
4. Required information
6. Additional information outside the code
Done this session, out of band from this PR (the OIDC bootstrap proper):
@adobe/spacecat-shared-cloudflare-client@1.0.0manually published to npmjs.org (OIDC cannot bootstrap a name that does not yet exist on npm). Verified via the version-specific manifest and the tarball (both 200).{repository: adobe/spacecat-shared, workflow: main.yaml, environment: npm-publish}- matching the other packages.PACKAGESarray - no forward drift, no stale entries.7. Test plan
(a) Local: replicated the setup script's drift check (node enumeration of publishable workspace packages diffed against
PACKAGES) - clean in both directions.(b) On merge: no package release is triggered - the commit touches
scripts/, not anypackages/<pkg>source, so semantic-release does not cut a version. The next run ofsetup-npm-trusted-publishers.shnow has cloudflare-client in scope. The package's first OIDC release happens on the next merge tomaintouching its source, publishing with no npm token.