3b6ef3add8
Harden template and example code paths, redact sensitive output, and pin safe transitive npm packages. Consolidate the todo backend on better-sqlite3 so the example no longer pulls the vulnerable sqlite3 chain and still passes build and CRUD smoke checks. Co-Authored-By: Claude <noreply@anthropic.com>
32 lines
780 B
YAML
32 lines
780 B
YAML
# Publish antigravity-awesome-skills to npm on release.
|
|
# Requires NPM_TOKEN secret (npm → Access Tokens → Granular token with Publish).
|
|
# Before creating a Release: bump package.json "version" (npm forbids republishing the same version).
|
|
# Release tag (e.g. v4.6.1) should match package.json version.
|
|
|
|
name: Publish to npm
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
registry-url: "https://registry.npmjs.org"
|
|
|
|
- name: Publish
|
|
run: npm publish
|
|
env:
|
|
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|