From 798ed841aff0d4b1242a2b372718e9743d44f371 Mon Sep 17 00:00:00 2001 From: Ivan K Date: Wed, 4 Nov 2026 13:35:56 +0700 Subject: [PATCH 1/2] ci: publish to npm with trusted publishing The NPM_TOKEN secret dates from 2020, so it was a classic token, and npm revoked all classic tokens in late 2025. Publish through OIDC instead: the job gets id-token: write and no token. repository.url moves to the https form, which trusted publishing matches against the repo. CLAUDE.md gets a Releasing section, since npm version's postversion push to main is now rejected by the branch ruleset. --- .github/workflows/npm-publish.yml | 14 +++++++------- CLAUDE.md | 5 +++++ package.json | 2 +- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 080a477..d391681 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -1,6 +1,3 @@ -# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created -# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages - name: Publish to NPM on: @@ -24,15 +21,18 @@ jobs: publish-npm: needs: build runs-on: ubuntu-latest + # npm trusted publishing: OIDC replaces NPM_TOKEN. npm needs this workflow's + # filename (npm-publish.yml) registered as the package's trusted publisher. + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v7 - uses: actions/setup-node@v7 with: node-version: 26 - registry-url: https://registry.npmjs.org/ + registry-url: https://registry.npmjs.org + package-manager-cache: false - run: npm ci - run: npm run build - - run: npm run lint - run: npm publish - env: - NODE_AUTH_TOKEN: ${{secrets.npm_token}} diff --git a/CLAUDE.md b/CLAUDE.md index 5d4b1da..11de1ad 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -42,6 +42,11 @@ Try the CLI locally with `node bin/cf ` after a build, or `npm link` to Tests live in `test/utils/` and cover only the utilities and `Config`, importing from `lib/`. `Config` tests stub `Config.getConfigFile` with sinon and copy `test/fixtures/config/` into a temp dir. There are no tests for commands or API classes. +## Releasing + +1. In a PR: set the version with `npm pkg set version=X.Y.Z && npm install --package-lock-only --ignore-scripts`, and move `CHANGELOG.md` entries from `[next]` to `[X.Y.Z] - `. Don't use `npm version`: its `postversion` script pushes straight to `main`, which the branch ruleset rejects. +2. After merge, create a GitHub release with tag `X.Y.Z` (no `v`, matching earlier tags). `.github/workflows/npm-publish.yml` publishes it through npm trusted publishing (OIDC), so there is no npm token in the repo. The package's trusted publisher on npmjs.com must name `ivankristianto/cloudflare-cli-node` and `npm-publish.yml`, and `repository.url` in `package.json` must keep pointing at that repo. + ## Reference `HOWTO.md` lists example invocations for every command, including the `xargs` pipeline pattern. Full command docs are in the project wiki: https://github.com/ivankristianto/cloudflare-cli-node/wiki diff --git a/package.json b/package.json index 88f6a33..5956ca3 100644 --- a/package.json +++ b/package.json @@ -56,7 +56,7 @@ "license": "MIT", "repository": { "type": "git", - "url": "git@github.com:ivankristianto/cloudflare-cli-node.git" + "url": "git+https://github.com/ivankristianto/cloudflare-cli-node.git" }, "keywords": [ "cloudflare", From 7ec4ad38d202e0f0c15ccdea67bcbdba4a88f277 Mon Sep 17 00:00:00 2001 From: Ivan K Date: Wed, 4 Nov 2026 13:35:56 +0700 Subject: [PATCH 2/2] chore(release): 0.8.0 --- CHANGELOG.md | 5 +++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 095bf62..becafc5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,11 +4,16 @@ All notable changes to this project will be documented in this file, per [the Ke ## [next] +## [0.8.0] - 2026-11-04 + ### Changed - Require Node.js 22.18 or above. - Bump all npm packages to the latest version, except yargs, which stays on 17. - Ship code compiled for Node 22.18, with native async/await. +### Security +- Clear all 6 npm audit advisories in production dependencies, including 1 critical in form-data and 2 high in lodash and tmp. + ## [0.7.0] - 2022-02-13 ### Added diff --git a/package-lock.json b/package-lock.json index 108fc99..e2758b7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "cloudflare-cli-node", - "version": "0.7.0", + "version": "0.8.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "cloudflare-cli-node", - "version": "0.7.0", + "version": "0.8.0", "license": "MIT", "dependencies": { "@babel/runtime": "^8.1.0", diff --git a/package.json b/package.json index 5956ca3..ed91824 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "cloudflare-cli-node", - "version": "0.7.0", + "version": "0.8.0", "description": "Cloudflare API CLI Interface with Node.js", "bin": { "cf": "bin/cf"