mirror of
https://github.com/przeprogramowani/10x-cli.git
synced 2026-09-19 03:30:01 +08:00
“mkczarkowski”
40e5b37b4f
- Auto-version from conventional commits (auto-version.mjs) with git-diff
gate: only releases when src/ or package.json actually changed
- 5-platform binary builds (linux x64/arm64, macOS x64/arm64, windows)
- npm publish with auth token wiring
- GitHub Release with auto-generated notes and binary attachments
- Smoke tests for package tarball and auto-version script
- Hardened: top-level permissions: {}, env bindings (no expression injection),
persist-credentials only where needed for git push
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
13 lines
562 B
Plaintext
13 lines
562 B
Plaintext
# Public npm registry (not GitHub Packages — that's internal-pkg only)
|
|
registry=https://registry.npmjs.org/
|
|
|
|
# Prevent install scripts from running automatically — the most common
|
|
# supply chain attack vector (malicious postinstall). If a legitimate
|
|
# dependency needs a script, allowlist it explicitly below.
|
|
ignore-scripts=true
|
|
|
|
# Refuse to install any package version published less than 7 days ago.
|
|
# Most supply chain attacks are detected and pulled within this window.
|
|
# npm v11: min-release-age / Bun: --minimum-release-age
|
|
minimum-release-age=604800
|