Skip to content
This repository was archived by the owner on Jul 30, 2026. It is now read-only.

chore: migrate to the @j4k scope on the Forge npm registry #38

Merged
Jercik merged 1 commit into from
Jul 11, 2026
Merged

chore: migrate to the @j4k scope on the Forge npm registry #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,24 +30,24 @@ jobs:

- name: Verify install secret
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.FORGEJO_NPM_TOKEN }}
run: |
set -eu
if [ -z "${NODE_AUTH_TOKEN:-}" ]; then
echo "::error::Missing required install secret NPM_TOKEN; set it in the repo or org Actions secrets."
echo "::error::Missing required install secret FORGEJO_NPM_TOKEN; set it in the repo Actions secrets."
exit 1
fi

- name: Configure registry auth
run: echo "//npm.j4k.dev/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
run: echo "//code.j4k.dev/api/packages/j4k/npm/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.FORGEJO_NPM_TOKEN }}

- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile

- name: Strip registry token
# pull_request gets secrets on same-repo PRs; remove the token before any PR-controlled script reads ~/.npmrc.
# pull_request runs PR-controlled scripts below; remove the token before any of them reads ~/.npmrc.
run: rm -f ~/.npmrc

- name: Run knip
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/dedupe-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
uses: actions/checkout@v6

- name: Strip untrusted project install config
# pull_request checks out attacker-controlled code: drop committed .npmrc (redirects installs / leaks the registry token) and both pnpmfile variants .pnpmfile.cjs/.pnpmfile.mjs (pnpm 11 loads .mjs first, and their hooks run under --ignore-scripts during both install and dedupe, which keep the token on disk).
# pull_request checks out attacker-controlled code: drop committed .npmrc (redirects installs / leaks the registry token) and both pnpmfile variants .pnpmfile.cjs/.pnpmfile.mjs (pnpm 11 loads .mjs first, and their install hooks run even under --ignore-scripts).
run: rm -f .npmrc .pnpmfile.cjs .pnpmfile.mjs

- name: Setup pnpm
Expand All @@ -34,22 +34,22 @@ jobs:

- name: Verify install secret
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.FORGEJO_NPM_TOKEN }}
run: |
set -eu
if [ -z "${NODE_AUTH_TOKEN:-}" ]; then
echo "::error::Missing required install secret NPM_TOKEN; set it in the repo or org Actions secrets."
echo "::error::Missing required install secret FORGEJO_NPM_TOKEN; set it in the repo Actions secrets."
exit 1
fi

- name: Configure registry auth
run: echo "//npm.j4k.dev/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
run: echo "//code.j4k.dev/api/packages/j4k/npm/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.FORGEJO_NPM_TOKEN }}

- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile

- name: Check for dedupe opportunities
# No token strip here (unlike checks.yml, which strips before untrusted build/test): install ran --ignore-scripts --ignore-pnpmfile and `pnpm dedupe --check` is a builtin, so no untrusted code runs with ~/.npmrc present — stripping it would only risk breaking dedupe on private-registry repos.
run: pnpm dedupe --check --ignore-scripts
# --ignore-pnpmfile is load-bearing: pnpm dedupe runs the full install pipeline and loads pnpmfiles gated only by ignore-pnpmfile, NOT --ignore-scripts, so without it a PR-set pnpmfile: path in pnpm-workspace.yaml (surviving the .pnpmfile.* strip) executes arbitrary code with the registry token in ~/.npmrc. No token strip: dedupe needs the private registry and both ignore flags block every untrusted code path.
run: pnpm dedupe --check --ignore-scripts --ignore-pnpmfile
6 changes: 4 additions & 2 deletions .github/workflows/pr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,9 @@ jobs:
recipes: '[{"recipe":"pr-review-approach-smart","name":"smart draw 1"},{"recipe":"pr-review-approach-smart","name":"smart draw 2"},"pr-review-approach-2","pr-review-approach-3"]'
pr_number: ${{ github.event.pull_request.number || inputs.pr_number }}
secrets:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
# The reusable workflow's secret input keeps its legacy NPM_TOKEN name; the
# value is the Forgejo read:package PAT for code.j4k.dev.
NPM_TOKEN: ${{ secrets.FORGEJO_NPM_TOKEN }}
AXRECIPE_API_KEY: ${{ secrets.AXRECIPE_API_KEY }}

code:
Expand All @@ -38,5 +40,5 @@ jobs:
recipes: '[{"recipe":"pr-review-code-smart","name":"smart draw 1"},{"recipe":"pr-review-code-smart","name":"smart draw 2"}]'
pr_number: ${{ github.event.pull_request.number || inputs.pr_number }}
secrets:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
NPM_TOKEN: ${{ secrets.FORGEJO_NPM_TOKEN }}
AXRECIPE_API_KEY: ${{ secrets.AXRECIPE_API_KEY }}
12 changes: 6 additions & 6 deletions .github/workflows/release-npm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,27 +46,27 @@ jobs:

- name: Verify install secret
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.FORGEJO_NPM_TOKEN }}
run: |
set -eu
if [ -z "${NODE_AUTH_TOKEN:-}" ]; then
echo "::error::Missing required install secret NPM_TOKEN; set it in the repo or org Actions secrets."
echo "::error::Missing required install secret FORGEJO_NPM_TOKEN; set it in the repo Actions secrets."
exit 1
fi

- name: Configure registry auth (install)
run: echo "//npm.j4k.dev/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
run: echo "//code.j4k.dev/api/packages/j4k/npm/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.FORGEJO_NPM_TOKEN }}

- name: Install dependencies
run: pnpm install --frozen-lockfile
# Lifecycle scripts must not run while the FORGEJO_NPM_TOKEN read:package PAT is in ~/.npmrc — a non-expiring PAT that reads the whole private @j4k tree; prepack still builds at publish time.
run: pnpm install --frozen-lockfile --ignore-scripts

- name: Configure public npm registry (publish)
run: echo "registry=https://registry.npmjs.org/" >> ~/.npmrc

- name: Release
id: release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: pnpm exec semantic-release
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,3 +138,4 @@ dist
.yarn/build-state.yml
.yarn/install-state.gz
.pnp.*
.claude/worktrees/
2 changes: 1 addition & 1 deletion knip.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"$schema": "https://unpkg.com/knip@6/schema.json",
"entry": ["src/cli/main.ts", "types/ts-reset.d.ts"],
"entry": ["src/cli/main.ts", "types/ts-reset.d.ts", "types/css-modules.d.ts"],
"project": ["src/**/*.ts", "types/**/*.d.ts"]
}
2 changes: 1 addition & 1 deletion oxlint.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
import { compose, node, vitest } from "oxlint-config-j4k";
import { compose, node, vitest } from "@j4k/oxlint-config";

export default compose(node, vitest);
10 changes: 5 additions & 5 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@
"knip": "knip",
"lint": "oxlint --deny-warnings --report-unused-disable-directives .",
"prepack": "pnpm run rebuild",
"prepare": "git config core.hooksPath .githooks",
"prepare": "if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then git config core.hooksPath .githooks; fi",

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep the prepare script cross-platform

On Windows developer machines, npm/pnpm lifecycle scripts run through cmd.exe by default, so this POSIX if ...; then ...; fi guard and /dev/null redirection are not parsed and pnpm install fails as soon as prepare runs. The previous direct git config command was shell-neutral; please move the guard into a small Node script or another cross-platform form.

Useful? React with 👍 / 👎.

"rebuild": "pnpm run clean && pnpm run build",
"start": "node bin/sync-rules",
"test": "vitest run",
Expand All @@ -54,17 +54,17 @@
"zod": "^4.3.6"
},
"devDependencies": {
"@j4k/oxlint-config": "^2.11.0",
"@total-typescript/ts-reset": "^0.6.1",
"@types/node": "^25.6.0",
"@typescript/native-preview": "beta",
"@vitest/coverage-v8": "^4.1.5",
"fta-check": "^1.5.2",
"fta-cli": "^3.0.0",
"knip": "^6.6.3",
"oxfmt": "^0.46.0",
"oxlint": "^1.61.0",
"oxlint-config-j4k": "^2.3.0",
"oxlint-tsgolint": "^0.22.0",
"oxfmt": "^0.57.0",
"oxlint": "^1.72.0",
"oxlint-tsgolint": "^0.23.0",
"semantic-release": "^25.0.3",
"vitest": "^4.1.5"
},
Expand Down
Loading
Loading