User Story
As an OpenShell SDK consumer,
I want to install @nvidia/openshell-sdk from the public npm registry (npmjs.com),
so that I can use it without configuring a custom .npmrc scope or providing a GITHUB_TOKEN with read:packages permission.
Problem Statement
The TypeScript SDK (@nvidia/openshell-sdk) is currently published exclusively to GitHub Packages. Consumers must configure the @nvidia scope to point at https://npm.pkg.github.com and authenticate with a GitHub personal access token that has read:packages scope. This is a friction barrier for every new consumer and every CI pipeline that depends on the SDK.
Impact / Why This Matters
Without this feature, users must:
- Create or obtain a GitHub personal access token with
read:packages scope.
- Add a project-level
.npmrc with @nvidia:registry=https://npm.pkg.github.com and an //npm.pkg.github.com/:_authToken= line (or use npm login --registry).
- Manage token rotation and ensure CI environments have the token available as a secret.
This results in:
- Onboarding friction: New SDK consumers hit an auth wall before they can run
npm install. The default npm install @nvidia/openshell-sdk fails without configuration.
- CI complexity: Every CI pipeline consuming the SDK needs a GitHub token secret wired in, even when the package is public and open-source.
- Ecosystem discoverability: The package does not appear on npmjs.com search, reducing visibility to the broader Node.js community.
- Inconsistency: The Python SDK is published to PyPI (the public registry for Python); the TypeScript SDK should follow the same pattern for its ecosystem.
This matters because reducing installation friction directly affects SDK adoption.
Proposed Design
- Configure the
@nvidia/openshell-sdk package as a trusted publisher on npmjs.com, linking it to the NVIDIA/OpenShell GitHub repository and the release workflow. This uses npm Trusted Publishers (OIDC) — the workflow authenticates via GitHub Actions' OIDC identity provider, so no long-lived npm token or repository secret is needed.
- Update
publishConfig.registry in sdk/typescript/package.json from https://npm.pkg.github.com to https://registry.npmjs.org.
- Update the release CI workflow (
.github/workflows/release-tag.yml) to:
- Request an OIDC token from GitHub Actions (
permissions: id-token: write).
- Use the
id-token to authenticate with npmjs.com via the trusted publisher flow (e.g., npm publish --provenance).
- The
--provenance flag attaches a Sigstore attestation, tying each published version to its source commit and workflow run.
- Update
sdk/typescript/README.md to remove the .npmrc / GitHub token instructions and replace with a plain npm install @nvidia/openshell-sdk.
- Optionally, continue publishing to GitHub Packages as a secondary registry for consumers who prefer it.
From the user's perspective, the install experience becomes:
npm install @nvidia/openshell-sdk
No .npmrc, no token, no scope configuration.
Acceptance Criteria
Alternatives Considered
- Keep GitHub Packages only. This is the status quo. It works for internal consumers who already have GitHub tokens but creates unnecessary friction for the open-source community.
- Use a long-lived npm access token as a repository secret. This works but requires manual token rotation, is less secure than OIDC, and does not produce provenance attestations. Trusted Publishers is the npm-recommended approach for GitHub Actions.
- Publish to both registries. This preserves backward compatibility for existing consumers using GitHub Packages while making the public registry the default. Viable but adds CI complexity for marginal benefit — once npmjs.com is available, the GitHub Packages path becomes redundant.
User Story
As an OpenShell SDK consumer,
I want to install
@nvidia/openshell-sdkfrom the public npm registry (npmjs.com),so that I can use it without configuring a custom
.npmrcscope or providing aGITHUB_TOKENwithread:packagespermission.Problem Statement
The TypeScript SDK (
@nvidia/openshell-sdk) is currently published exclusively to GitHub Packages. Consumers must configure the@nvidiascope to point athttps://npm.pkg.github.comand authenticate with a GitHub personal access token that hasread:packagesscope. This is a friction barrier for every new consumer and every CI pipeline that depends on the SDK.Impact / Why This Matters
Without this feature, users must:
read:packagesscope..npmrcwith@nvidia:registry=https://npm.pkg.github.comand an//npm.pkg.github.com/:_authToken=line (or usenpm login --registry).This results in:
npm install. The defaultnpm install @nvidia/openshell-sdkfails without configuration.This matters because reducing installation friction directly affects SDK adoption.
Proposed Design
@nvidia/openshell-sdkpackage as a trusted publisher on npmjs.com, linking it to theNVIDIA/OpenShellGitHub repository and the release workflow. This uses npm Trusted Publishers (OIDC) — the workflow authenticates via GitHub Actions' OIDC identity provider, so no long-lived npm token or repository secret is needed.publishConfig.registryinsdk/typescript/package.jsonfromhttps://npm.pkg.github.comtohttps://registry.npmjs.org..github/workflows/release-tag.yml) to:permissions: id-token: write).id-tokento authenticate with npmjs.com via the trusted publisher flow (e.g.,npm publish --provenance).--provenanceflag attaches a Sigstore attestation, tying each published version to its source commit and workflow run.sdk/typescript/README.mdto remove the.npmrc/ GitHub token instructions and replace with a plainnpm install @nvidia/openshell-sdk.From the user's perspective, the install experience becomes:
No
.npmrc, no token, no scope configuration.Acceptance Criteria
npm install @nvidia/openshell-sdkworks from the public npm registry without any.npmrcoverrides or authentication@nvidia/openshell-sdkpackage is registered as a trusted publisher on npmjs.com, linked to theNVIDIA/OpenShellrepository and release workflow--provenance)sdk/typescript/README.mdinstall instructions reflect the public registryAlternatives Considered