Expose OIDC and staging signals in packument
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Many tools in the ecosystem use the _npmUser of a packument to know if a package was created via trusted publishing or not.
When it is, the npm user is the oidc user.
However, now that staging is a thing - the npm user will correctly be the human who approved the publish rather than the automation.
This means there's no longer any way to determine if a package was published via oidc or not.
Due to this, many existing tools in the ecosystem break when encountering staged packages. (e.g. pnpm).
Solution
I think we just need two signals instead of inferring this stuff:
- Whether OIDC was used or not
- Whether staged publishing was used or not
e.g. {_npmMeta: {staged: true, oidc: true}}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are identified in the issue. Trace where the npm CLI constructs packuments and where staged and OIDC publish metadata are represented; done means exposing separate staged and oidc signals without relying on _npmUser, with coverage for both publishing cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100