Post

So I guess this is helpful because it blocks people from being able to publish from like your local system or untrusted CI/CD. But what happens if your GitHub account is compromised? Like that guy-- recently?

If your GitHub account is compromised than the attacker can publish from your trusted CI/CD.

Yeah, exactly. Doesn't completely eliminate the risk. Do you know if JSR is using the same thing to authenticate? OpenID connect OIDC. However they're doing it, it's really freaking easy.

Follow-up question: if I have new packages to publish, do I have to publish them all manually one by one before setting up trusted publishing?

I, overworked, am waiting until the ABSOLUTE LAST POSSIBLE DAY to tackle this in the hopes someone will have made it much better by then.

I was considering doing the same but the problem is that I don't understand exactly when the last possible day is 😂

It's mid November. Isn't that clear enough?! 😅

Please somebody tell me you have a script to automate this 🙏

@antfu.me has one to semi-automate it: bsky.app/profile/antf...

Uhhhh thanks, it's not what I was hoping for but better than nothing. Maybe I can automate it more with puppeteer