From 35c0be3221ec22c4db6e6f9c37c3e3c8dc91b633 Mon Sep 17 00:00:00 2001 From: Raghu Betina Date: Wed, 9 Sep 2026 22:52:36 -0500 Subject: [PATCH] Avoid repeated npm login for OIDC releases Treat authenticated access and trust checks as configuration audits. Routine releases verify the retained workflow binding and protected tag, while an existing-version dist-tag move still needs npm auth. --- AGENTS.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 3620f20..f3fd08b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -11,3 +11,7 @@ in `docs/release-history.md`. When behavior changes, update its owning document is complete only after that exact candidate passes its explicitly named release-specific qualification, is separately approved, and is selected by npm's `latest` dist-tag. Preserve dated alpha observations as history rather than describing them as current channel state. +- The authenticated npm access and trust checks in `RELEASING.md` are configuration audits. For an ordinary release, + verify the retained GitHub workflow/environment binding and protected tag; do not require another npm login or + `npm trust list`/2FA ceremony unless that configuration changed. OIDC publication confirms the retained binding. + Moving an existing version's `latest` dist-tag still requires ordinary npm authentication.