Reply to thread

Message

<blockquote data-quote="Hacker News" data-source="post: 76665" data-attributes="member: 365">The backstory about this GitHub Action:I discussed with an open-source maintainer why they publish npm packages from their local machine and do not use CI/CD pipelines.They said publishing should require human intervention and want to continue using multi-factor authentication to publish to the npm registry.This led to building the wait-for-secrets GitHub Action. It prints a URL in the build log and waits for secrets to be entered using a browser. Once entered, the workflow continues, and secrets can be used in future steps.The latest release of &quot;eslint-plugin-react&quot; to the npm registry used a one-time password (OTP) from a GitHub Actions workflow! <a href="https://github.com/jsx-eslint/eslint-plugin-react/actions/runs/3498968497/jobs/5860126389#step:9:1" target="_blank">https://github.com/jsx-eslint/eslint-plugin-react/actions/ru...</a><hr />Comments URL: <a href="https://news.ycombinator.com/item?id=33884424" target="_blank">https://news.ycombinator.com/item?id=33884424</a>Points: 10# Comments: 1<a href="https://github.com/step-security/wait-for-secrets" target="_blank">Continue reading...</a></blockquote>

[QUOTE="Hacker News, post: 76665, member: 365"] The backstory about this GitHub Action: I discussed with an open-source maintainer why they publish npm packages from their local machine and do not use CI/CD pipelines. They said publishing should require human intervention and want to continue using multi-factor authentication to publish to the npm registry. This led to building the wait-for-secrets GitHub Action. It prints a URL in the build log and waits for secrets to be entered using a browser. Once entered, the workflow continues, and secrets can be used in future steps. The latest release of "eslint-plugin-react" to the npm registry used a one-time password (OTP) from a GitHub Actions workflow! [URL='https://github.com/jsx-eslint/eslint-plugin-react/actions/runs/3498968497/jobs/5860126389#step:9:1']https://github.com/jsx-eslint/eslint-plugin-react/actions/ru...[/URL] [HR][/HR] Comments URL: [URL]https://news.ycombinator.com/item?id=33884424[/URL] Points: 10 # Comments: 1 [url="https://github.com/step-security/wait-for-secrets"]Continue reading...[/url] [/QUOTE]

Verification