coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(exec): wire real npm publish (dry-run) through secrets-engine exec

Browse source 
scripts/npm-publish-demo.sh boots a throwaway OpenBao, applies + provisions the
whynot-design lane, and runs `npm publish --dry-run` via `secrets-engine exec`
against a scratch package. npm resolves its auth token from the injected temp
.npmrc and builds/announces the tarball; the parent shell never holds the token
and the temp config is cleaned up. Documented in docs/cli.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-06-28 12:31:43 +02:00
parent a852d3f1ff
commit 147cf8acda
2 changed files with 103 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/cli.md
View file

@ -59,6 +59,19 @@ Boots a throwaway in-memory OpenBao dev server and runs the whole pilot chain:
plan → apply → provision → verify(+/-) → exec (npm-config injection) → route →
revoke. Nothing is persisted; the token is a throwaway local string.
## npm publish wiring (dry-run)
```bash
bash scripts/npm-publish-demo.sh
```
Boots a throwaway OpenBao, applies + provisions the lane with a *fake* token, and
runs a **real `npm publish --dry-run`** through `secrets-engine exec` against a
scratch package. Proves npm in the child resolves its auth token from the temp
`.npmrc` secrets-engine injected, builds the tarball, and reaches the publish
step — while the parent shell never holds the token. For a real publish,
provision a real npm automation token the same way and drop `--dry-run`.
## Pilot: whynot-design npm publish
```bash