Publish every package through staged trusted publishing (owner approves each release)
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 35/100
调研方向
Start with one publish-*.yml workflow (for example the agent-pay-openfort one, which already uses staged publishing) and compare it with a workflow still calling npm publish. Apply the npm stage publish change to the remaining package workflows and add a short section to docs/REVIEWING.md. Step 2, unticking "Allow npm publish" on npmjs.com, needs the owner, so a contributor should only prepare the workflow and docs changes. Done means every listed workflow stages its release, and the docs describe the approval flow.
由索引模型根据 Issue 内容生成。
描述
@deepfirstsearch/agent-pay-openfort now publishes with npm trusted publishing and direct publishing off. The workflow runs npm stage publish (npm 12), and a version only goes live after the owner approves it on npmjs.com with 2FA. This was validated with 0.1.1 on 2026-10-09: the staged tarball was downloaded and diffed against a local build of the tag, and was identical.
The other packages (agent-pay, agent-pay-mcp, -ai-sdk, -langchain, -agentkit, -turnkey, -privy, -cdp, order-guard) still publish directly from their workflows. If a workflow or the repo were compromised, a release could go out unreviewed.
For each package:
- In its
publish-*.yml, install npm 12 and replacenpm publishwithnpm stage publish . --provenance --access public --ignore-scripts. - On npmjs.com, untick "Allow npm publish" on its trusted publisher (owner only).
- Validate with the next release: download the staged tarball (
npm stage download <id>), diff it against the tag build, then approve.
The publish flow also gets a short section in docs/REVIEWING.md.
- 主要语言
- TypeScript
- 星标
- 0
- 派生
- 0
- 平均合并
- 3 小时 51 分钟
- 30 天内合并 PR
- 3
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
DeepFirstHQ/deepfirstsearch 的其他 Issue
-
documentation help wanted
难度 2/5 1-3 小时 新手友好度 72/100
-
enhancement help wanted integration
难度 4/5 3-5 天 新手友好度 52/100
-
难度 3/5 1-2 天 新手友好度 28/100
-
enhancement
难度 3/5 1-2 天 新手友好度 58/100
-
enhancement good first issue
难度 3/5 1-2 天 新手友好度 55/100
查看 DeepFirstHQ/deepfirstsearch 的全部 Issue
相似的 Issue
-
area: repo priority: P2 type: bug
难度 2/5 1-3 小时 新手友好度 76/100
appandflow/stim#4107 · 1 条评论 ·
维护者通常 1 天内回复
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
难度 1/5 1-3 小时 新手友好度 60/100
lingdojo/kana-dojo#32859 · 1 条评论 · 5 个 reaction ·
维护者通常 1 天内回复
-
code-quality refactoring
难度 2/5 1-3 小时 新手友好度 78/100
github/gh-aw-firewall#10364 ·
维护者通常 1 天内回复
-
Merge the duplicate kaffir_corn record into sorghum可能已有人在做 @Crypto-Shroom 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 65/100
Crypto-Shroom/Bird-Feed-Calculator#322 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
drizzle-team/drizzle-orm#6552 ·
维护者通常 2 天内回复