Expanded shared library publishing guide with step-by-step instructio… - #141
Expanded shared library publishing guide with step-by-step instructio…#141cedricbrasey wants to merge 2 commits into
Conversation
…ns and images for configuring npm Trusted Publishing and manual publishing steps. Updated hosting details for sensitive libraries. Added new images.
…ns and images for configuring npm Trusted Publishing and manual publishing steps. Updated hosting details for sensitive libraries. Added new images.
ben-sagar
left a comment
ben-sagar
left a comment
There was a problem hiding this comment.
I think there are a few minor wording tweaks needed and a couple of things that need clarifying (if only for my benefit!)
| ## Where to host a shared library | ||
|
|
||
| Use the ecosystem's native registry by default. That means [npmjs.com](https://www.npmjs.com) for npm packages and [nuget.org](https://www.nuget.org) for NuGet packages. These registries are well supported, encourage good security practices and offer low-friction adoption for consumers. They also support Defra's commitment to working in the open and publishing code openly. | ||
| Use the ecosystem's native registry by default. That means using [npmjs.com](https://www.npmjs.com) for npm packages and [nuget.org](https://www.nuget.org) for NuGet packages. These registries are well supported, encourage good security practices and offer low-friction adoption for consumers. They also support Defra's commitment to working in the open and publishing code openly. |
There was a problem hiding this comment.
I think this was still fine without the word "using" but it doesn't do any harm I suppose.
| Use the ecosystem's native registry by default. That means using [npmjs.com](https://www.npmjs.com) for npm packages and [nuget.org](https://www.nuget.org) for NuGet packages. These registries are well supported, encourage good security practices and offer low-friction adoption for consumers. They also support Defra's commitment to working in the open and publishing code openly. | ||
|
|
||
| For libraries containing sensitive or private code, use GitHub Packages instead. | ||
| Use [github.com](https://github.com/orgs/DEFRA/packages) for libraries containing sensitive or private code, use GitHub Packages instead. |
There was a problem hiding this comment.
This sentence no longer makes sense, should the link be around GitHub Packages?
i.e.
Use GitHub Packages for libraries containing sensitive or private code.
|
|
||
| For onboarding, contact [`#npm-support`](https://defra-digital.slack.com/archives/C0BA4SW20NS) in Slack. Defra npm org admins can be found there. | ||
|
|
||
| A Defra npm org admin must perform the first publish of any new `@defra`-scoped package. After that, your npm account can be made maintainer of the specific package. Teams can also be created within the organisation to manage access to one or more packages. |
There was a problem hiding this comment.
I think this line will need changing based on the guidance you've added for publishing your own packages.
I don't think this part is true?
A Defra npm org admin must perform the first publish of any new
@defra-scoped package.
| - confirmation the package is suitable for public publishing | ||
|
|
||
| A Defra npm org admin will configure the Trusted Publishing policy on npmjs.com and perform the first publish. | ||
| A Defra npm org admin will then create an `npm` team and add you to this team as a member. You will receive to your registered email address an invitation to join the team. Make sure you follow the instructions in that email. |
There was a problem hiding this comment.
This is only true if we're putting people into specific teams, which we won't always necessarily do.
Also, this invitation only happens the first time someone is invited to the organisation - if they are already a member of the organisation they won't receive another invite when we add them to another team.
| You should now see something along these lines. Press the enter key to open the browser. | ||
| ```text | ||
| npm notice Log in on https://registry.npmjs.org/ | ||
| npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation |
There was a problem hiding this comment.
It might be worth excluding this notification - I know it's just an example, but this particular message will disappear shortly and having it here could be a bit misleading.
| npm notice integrity: sha512-cV+gqctmZPrIi[...]SV67n3Qg0qGlQ== | ||
| npm notice total files: 3 | ||
| npm notice | ||
| npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation |
| npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2349495965 | ||
| + @defra/your-package-name@0.1.0 | ||
| ``` | ||
| You have now published your package to npm. |
There was a problem hiding this comment.
Did you ever discover why I couldn't initially see the settings page for your package, despite being an org owner?
Did you have to do anything, or do we think it was just a weird UI bug or something?
2 participants
…ns and images for configuring npm Trusted Publishing and manual publishing steps. Updated hosting details for sensitive libraries. Added new images.