Skip to content

Commit f841eb9

Browse files
mythzmythz
authored
Merge pull request #3 from ServiceStack/claude/create-npx-project-script-014KBKErgkQjXM1eXSndDaZi
Claude/create npx project script 014 kbk ergk qj xm1e x snd da zi
2 parents fd0d16e + 3a84b51 commit f841eb9

File tree

5 files changed

+214
-6
lines changed

5 files changed

+214
-6
lines changed

‎.github/workflows/README.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# GitHub Actions Workflows
2+
3+
This directory contains GitHub Actions workflows for the create-net project.
4+
5+
## Workflows
6+
7+
### CI (`ci.yml`)
8+
9+
Runs on every push to `main` and on all pull requests.
10+
11+
**What it does:**
12+
- Tests the package on multiple Node.js versions (14, 16, 18, 20)
13+
- Runs the test suite (`npm test`)
14+
- Verifies the CLI script is executable
15+
16+
### Publish to npm (`publish.yml`)
17+
18+
Runs automatically when a new GitHub release is created.
19+
20+
**What it does:**
21+
- Installs dependencies
22+
- Runs tests to ensure quality
23+
- Publishes the package to npm with provenance using OIDC authentication
24+
25+
**Features:**
26+
- Uses OpenID Connect (OIDC) for secure authentication
27+
- Publishes with `--provenance` flag for supply chain security
28+
- Automatically makes the package public with `--access public`
29+
30+
## Publishing to npm
31+
32+
To publish a new version:
33+
34+
1. Update the version in `package.json`:
35+
```bash
36+
npm version patch # for bug fixes
37+
npm version minor # for new features
38+
npm version major # for breaking changes
39+
```
40+
41+
2. Push the changes and tags:
42+
```bash
43+
git push && git push --tags
44+
```
45+
46+
3. Create a GitHub release:
47+
- Go to https://github.com/ServiceStack/create-net/releases/new
48+
- Select the version tag you just pushed
49+
- Add release notes describing the changes
50+
- Click "Publish release"
51+
52+
4. The `publish.yml` workflow will automatically:
53+
- Run tests
54+
- Publish to npm if tests pass
55+
56+
## Required Setup
57+
58+
### NPM Authentication
59+
60+
The workflow uses OIDC (OpenID Connect) authentication with provenance for enhanced security. You still need to configure an `NPM_TOKEN` secret:
61+
62+
1. Generate an npm Automation token:
63+
- Log in to https://www.npmjs.com
64+
- Go to Account Settings → Access Tokens
65+
- Click "Generate New Token" → Choose "Automation"
66+
- Copy the generated token
67+
68+
2. Add the token to GitHub:
69+
- Go to repository Settings → Secrets and variables → Actions
70+
- Click "New repository secret"
71+
- Name: `NPM_TOKEN`
72+
- Value: Your npm automation token
73+
- Click "Add secret"
74+
75+
### OIDC Permissions
76+
77+
The workflow includes the required permissions:
78+
```yaml
79+
permissions:
80+
id-token: write # Required for OIDC authentication
81+
contents: read
82+
```
83+
84+
These permissions allow the workflow to:
85+
- Authenticate with npm using OIDC
86+
- Generate provenance attestations for supply chain security
87+
- Read repository contents for publishing
88+
89+
## Manual Publishing
90+
91+
If you prefer to publish manually:
92+
93+
```bash
94+
npm login
95+
npm publish --access public
96+
```
97+
98+
To publish with provenance locally (requires npm 9.5.0+):
99+
100+
```bash
101+
npm publish --provenance --access public
102+
```
103+
104+
**Note:** Provenance generation may not work from all environments. GitHub Actions is the recommended way to publish with provenance.

‎.github/workflows/ci.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
branches: [ main ]
8+
9+
jobs:
10+
test:
11+
runs-on: ubuntu-latest
12+
13+
strategy:
14+
matrix:
15+
node-version: [14, 16, 18, 20]
16+
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
21+
- name: Setup Node.js ${{ matrix.node-version }}
22+
uses: actions/setup-node@v4
23+
with:
24+
node-version: ${{ matrix.node-version }}
25+
26+
- name: Install dependencies
27+
run: npm install
28+
29+
- name: Run tests
30+
run: npm test
31+
32+
- name: Verify bin script is executable
33+
run: |
34+
chmod +x bin/create-net.js
35+
node bin/create-net.js 2>&1 | grep -q "Usage: npx create-net"

‎.github/workflows/publish.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Publish to npm
2+
3+
on:
4+
release:
5+
types: [created]
6+
7+
jobs:
8+
publish:
9+
runs-on: ubuntu-latest
10+
11+
permissions:
12+
id-token: write # Required for OIDC authentication
13+
contents: read
14+
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@v4
18+
19+
- name: Setup Node.js
20+
uses: actions/setup-node@v4
21+
with:
22+
node-version: '18'
23+
registry-url: 'https://registry.npmjs.org'
24+
25+
- name: Install dependencies
26+
run: npm install
27+
28+
- name: Run tests
29+
run: npm test
30+
31+
- name: Publish to npm with provenance
32+
run: npm publish --provenance --access public
33+
env:
34+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

‎README.md‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,12 +88,41 @@ This creates test projects in `test-manual/` for manual verification. Clean up w
8888

8989
## Publishing
9090

91-
To publish this package to npm:
91+
### Automated Publishing (Recommended)
92+
93+
The package is automatically published to npm with provenance when a new GitHub release is created:
94+
95+
1. Update the version:
96+
```bash
97+
npm version patch # for bug fixes (1.0.0 → 1.0.1)
98+
npm version minor # for new features (1.0.0 → 1.1.0)
99+
npm version major # for breaking changes (1.0.0 → 2.0.0)
100+
```
101+
102+
2. Push changes and tags:
103+
```bash
104+
git push && git push --tags
105+
```
106+
107+
3. Create a GitHub release at https://github.com/ServiceStack/create-net/releases/new
108+
- The GitHub Action will automatically run tests and publish to npm with provenance
109+
110+
**Security Features:**
111+
- Uses OIDC authentication for secure publishing
112+
- Generates provenance attestations for supply chain security
113+
- Published with `--access public` flag
114+
115+
### Manual Publishing
116+
117+
To publish manually:
92118

93119
```bash
94-
npm publish
120+
npm login
121+
npm publish --access public
95122
```
96123

124+
**Note:** You need to configure the `NPM_TOKEN` secret in GitHub repository settings for automated publishing. See [`.github/workflows/README.md`](.github/workflows/README.md) for details.
125+
97126
## License
98127

99128
MIT

‎package.json‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,28 @@
22
"name": "create-net",
33
"version": "1.0.0",
44
"description": "Create .NET and other projects from NetCoreTemplates GitHub repositories",
5-
"main": "index.js",
65
"bin": {
76
"create-net": "./bin/create-net.js"
87
},
98
"scripts": {
10-
"test": "echo \"Error: no test specified\" && exit 1"
9+
"test": "./test.sh"
1110
},
1211
"keywords": [
1312
"create",
1413
"template",
1514
"project",
1615
"NetCoreTemplates",
17-
"scaffold"
16+
"scaffold",
17+
"cli",
18+
"generator"
1819
],
19-
"author": "",
20+
"author": "ServiceStack",
2021
"license": "MIT",
22+
"repository": {
23+
"type": "git",
24+
"url": "https://github.com/ServiceStack/create-net"
25+
},
26+
"private": false,
2127
"dependencies": {
2228
"adm-zip": "^0.5.10"
2329
},

0 commit comments

Comments
 (0)