docs(release): document npm dist-tag fallback auth · openclaw/openclaw@bdb6aeb
steipete
·
2026-04-23
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -318,6 +318,22 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
|
318 | 318 | `openclaw/releases-private/.github/workflows/openclaw-npm-dist-tags.yml` |
319 | 319 | workflow because `npm dist-tag` management needs `NPM_TOKEN`, while the |
320 | 320 | public npm release workflow stays OIDC-only. |
| 321 | +- If the private dist-tag workflow cannot promote because `NPM_TOKEN` is absent |
| 322 | + or stale, use the local tmux + 1Password fallback: |
| 323 | +- Start or reuse a tmux session so interactive `npm login` and OTP prompts |
| 324 | + are observable and recoverable. |
| 325 | +- Use the 1Password item `op://Private/Npmjs` for npm credentials and OTP. |
| 326 | + Do not print passwords, tokens, or OTPs to the transcript; send them through |
| 327 | + tmux buffers, env vars scoped to the tmux command, or `expect` with |
| 328 | +`log_user 0`. |
| 329 | +- Re-authenticate npm inside that tmux session with |
| 330 | +`npm login --auth-type=legacy`, then confirm `npm whoami` reports |
| 331 | +`steipete`. |
| 332 | +- Promote with a fresh OTP: |
| 333 | +`npm dist-tag add openclaw@YYYY.M.D latest --otp "$OTP"`. |
| 334 | +- Verify with a cache-bypassed registry read, for example: |
| 335 | +`npm view openclaw dist-tags --json --prefer-online --cache /tmp/openclaw-npm-cache-verify-$$` |
| 336 | + and `npm view openclaw@latest version dist.tarball --json --prefer-online`. |
321 | 337 | - Direct stable publishes can also use that private dist-tag workflow to point |
322 | 338 | `beta` at the already-published `latest` version when the operator wants both |
323 | 339 | tags aligned immediately. |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
