|
| Description: |
From January 2027, npm no longer lets a token that bypasses two-factor authentication publish packages. Our releases publish the {{@xwiki/platform-*}} packages with such a token, so the first release after that date will fail to publish them.
h2. Proposed change
* The release manager approves the npm publication with their own npm account and two-factor authentication, at the end of the release.
* The release token no longer bypasses two-factor authentication.
* A failed npm publication can be resumed without publishing the already published packages again.
* The Maven build still builds and tests the npm packages, and checks that they can be published ({{pnpm -r publish --dry-run}}). A package npm would reject still fails the release before anything is published.
Forum proposal: https://forum.xwiki.org/t/publish-the-xwiki-platform-npm-packages-with-the-release-managers-2fa/19010 |
|
