14 replies

1. Zach Leatherman Mastodon 9 min later

   As a security precaution I had previously configured every single 11ty repository to have its own single-package-scoped npm token (there were probably ~30 or so), so this is a lovely improvement 😅

   1. Alex Grant Mastodon 36 min later

      @zachleat

      I did this, but I didn't get the OIDC badges. Do I have to delete all the granular tokens, too?

      1. Zach Leatherman Mastodon 47 min later

         @localnerve I wouldn’t expect so (but I couldn’t say 100%). Sounds like you made a config error somewhere? I locked down npm publishing access to require 2FA and disallow tokens and deleted my tokens from GitHub Settings too — I’d also check your Actions yml to make sure the token isn’t being used there

         1. Alex Grant Mastodon 18 hr later

            @zachleat

            Totally probable misconfig, more probable than not...
            I saw that option, but my brain can't grok how I can have 2fa with GHA deployment... Looks like I have more reading to do...

            1. Zach Leatherman Mastodon 18 hr later

               @localnerve it doesn’t do 2FA with GHA, fwiw 😅

               1. Alex Grant Mastodon 8 days later

                  @zachleat

                  Fwiw, my problem was an older version of npm in the GHA runner...

                  1. Zach Leatherman Mastodon 8 days later

                     @localnerve ugh, sorry I should have remembered that I ran into that same issue. The error message on that one was very vague too iirc 😭

                     Appreciate you circling back!

2. Zach Leatherman Bluesky 10 min later

   As a security precaution I had previously configured every single 11ty repository to have its own single-package-scoped npm token (there were probably ~30 or so), so this is a lovely improvement 😅

   1. Will Boyd Bluesky 23 min later

      you're a lovely improvement

      1. Zach Leatherman Bluesky 26 min later

         no YOU

3. Private reply Mastodon 7 hr later
   1. Private reply Mastodon 15 hr later
4. Quesby Mastodon 9 hr later

   @zachleat Tedious work but a great improvement. Working with long-lived credentials is a risk when you deal with a bunch of packages. CI releases just aren’t necessary for my setup, so I publish locally.

5. Rodrigo Dias Bluesky 16 hr later

   Fewer secrets to rotate.