posit-dev / posit-dev/shinyreact
Add NPM_TOKEN secret for @posit/shinyreact publishing
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 14
- Forks
- 3
- Avg merge
- 9h 12m
- Merged PRs (30d)
- 74
Description
The npm publish workflow (.github/workflows/release-js.yaml, added in #215) publishes @posit/shinyreact with provenance on js-v* tags or manual dispatch. It requires an NPM_TOKEN repository secret that does not exist yet.
Task
- Create an npm granular access token with publish rights for the
@positscope (@posit/shinyreact) - Add it as the
NPM_TOKENrepository secret (Settings → Secrets and variables → Actions) - Verify with a first publish (tag
js-v0.0.1orworkflow_dispatch)
Requires npm org access to the posit scope, so this needs a maintainer with those rights.
Blocks the first npm publish tracked in decisions/2026-08-17-js-distribution.md (#172).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with .github/workflows/release-js.yaml to confirm how NPM_TOKEN is consumed, then read decisions/2026-08-17-js-distribution.md and issue #172 for the publishing context. Create the scoped npm token, add it as the repository's NPM_TOKEN secret, and verify a first publish using the documented tag or workflow dispatch.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, typescript
- Domain
- ci-cd, release
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100