Publish the xwiki-platform npm packages with the release manager's 2FA

Development
1

Hi all,

Every xwiki-platform release since 18.0.0 publishes the packages of xwiki-platform-node on npmjs.com. Today that is 66 @xwiki/platform-* packages, and we introduce new package regularly.

npm announced that from January 2027, tokens with “Bypass two-factor authentication” can no longer publish. They can only stage a publish, and a human must approve it with 2FA.
Our release process currently rely on this bypass, so we need to adapt it before the end of the year.

See below how I suggest adapting the release process to these new constraints.

Current release process

  • The release manager (RM) creates a token with Bypass two-factor authentication (2FA) checked (see Release Plan Help).
  • maven-release.sh asks all its questions first, then runs release:prepare and release:perform unattended.
  • During release:perform, the deploy phase of xwiki-platform-node runs pnpm -r publish (which uses the token defined previously).
  • If the release restarts after the npm step, SKIP_NPM_PUBLICATION=true avoids publishing twice.

Proposal

The release manager approves the npm publication with their own 2FA, in the browser, at the end of the release.

  1. The release manager creates the release token as today, but Bypass two-factor authentication (2FA) stays unchecked.
  2. Maven no longer publishes to npm for release versions. Snapshots keep going to our Nexus as today (see rational below)
  3. After release:perform succeeds, maven-release.sh runs the pnpm publication. pnpm prints a link to a form where the RM input their 2FA code and checks the option to use the same code for the next 5mns (avoid inputting 66 codes, currently a single code is required, a second one might be needed if we increase a lot the number of packages and/of if the publication is slow)

Each RM keep using npm account, nothing change on this aspect.
The main change is that a human intervention to input a code is required near the end of the release script.

Motivations to move the npm publication step outside Maven

  • Improved error handling. Today a failed npm publication fails the whole release:perform. As a separate last step, the release manager only reruns that step.
  • It is a first step away from the monolithic xwiki-platform-node module. Today every npm package must live in that module, because its Maven deploy phase publishes them. Once the publication no longer depends on that module, the packages can move closer to the code they belong to.

Options not retained

Staged publishing

When I tried I found the UX awkward and unless I missed something, required one manual intervention per package (66+). I did not explore this direction further as the 2FA link option proposed above is satisfying.

2FA in the terminal

(p)npm also offer the possibility to input the 2FA code in the terminal instead of the browser. I tried it and found some limitations (e.g., rate limited errors) that did not occur with the web link option.
I did not explore this direction further as well, as the 2FA link option proposed above is satisfying.

Trusted publishing

A trusted mechanism exists, simplifying the whole process, but only available for GitHub Actions, GitLab.com and CircleCI cloud runners.
As I believe we want to keep the whole release process inside the release machine, I currently consider this option out of scope.

Conclusion

Here’s my +1.

Thanks for reading.

2

Sounds good to me, +1. The only question I would have is what we should do if the NPM release fails for some reason that would require a code change - at the moment, this would abort the release, and thus we could restart the release after the fix. I hope this shouldn’t happen as we still run the build inside the Maven build and the build hopefully checks enough, I’m just wondering if it could happen that the Maven and NPM release aren’t identical anymore.

3

That’s a good point!
We already have quite a few checks (e.g., publint) to catch issues early, and so far the publication process went well.
I don’t think moving it slightly later changes much.
Though, what we can do is to run a dry run pnpm -r publish --dry-run during the maven execution, to catch even more problems early.

4

“a forum”? you mean something related to npm? RM needs to have credentials there first?

Also is there some reactiveness needed? What if I start the release late thinking it will process during the night: the link will remain valid?

5

I meant form sorry fo the typo (fixed in the initial message).

Good point, I’ll look into it. But quick answer, if it somehow times out we can add an option to resume from this specific step in the release script.

6

+1

7

+1

Thanks,
Marius