From 5a1204fbcb2a6c2ea9426ae13d79a41eaa6cc0a2 Mon Sep 17 00:00:00 2001 From: Vishesh 'ironeagle' Bangotra Date: Wed, 21 Oct 2026 00:57:08 +0530 Subject: [PATCH] Add npm backfill pipeline, shared htpasswd registry auth docs - drone npm template gains backfill-npm-from-tags (mirrors PyPI) - document the shared /auth/htpasswd credential model (npm + PyPI + docker) and Verdaccio's bcrypt requirement - point doc-weaver source/path at ../react/doc-weaver --- config.yml | 2 +- standards/lib/90_drone_pipelines/index.html | 37 +++++++--- standards/lib/93_library_registry/index.html | 18 +++++ standards/lib/search/search_index.json | 2 +- standards/mcp/modules/drone_pipelines.json | 2 +- standards/mcp/modules/library_registry.json | 2 +- .../modules/wiki_development_releasing.json | 2 +- standards/mcp/repos.json | 2 +- standards/mcp/templates/drone/npm-lib.yaml | 67 +++++++++++++++++++ standards/src/lib/90_drone_pipelines.md | 40 +++++++---- standards/src/lib/93_library_registry.md | 11 +++ standards/src/repos.json | 2 +- standards/src/templates/drone/npm-lib.yaml | 67 +++++++++++++++++++ .../src/wiki/04_development/02_releasing.md | 7 +- .../04_development/02_releasing/index.html | 7 +- standards/wiki/search/search_index.json | 2 +- 16 files changed, 234 insertions(+), 36 deletions(-) diff --git a/config.yml b/config.yml index 4850717..e029851 100644 --- a/config.yml +++ b/config.yml @@ -42,7 +42,7 @@ repos: mcp: { bundle: docs/mcp, server: docforge, port: 8001 } - name: doc-weaver - source: ../doc-weaver + source: ../react/doc-weaver title: Doc Weaver description: TypeScript documentation compiler using TypeDoc + JSDoc (RDFC), generating a TypeDoc site and a doc-forge-shaped MCP bundle for React packages. section: libraries diff --git a/standards/lib/90_drone_pipelines/index.html b/standards/lib/90_drone_pipelines/index.html index 51048f9..4db8b6d 100644 --- a/standards/lib/90_drone_pipelines/index.html +++ b/standards/lib/90_drone_pipelines/index.html @@ -733,18 +733,25 @@ with from_secret — never commit credentials.

Type B — npm package (npm-lib.yaml)

-

For internal npm libraries (the React packages). One pipeline, -build-and-publish-npm, triggered on tag:

- + $NPM_REPO_URL. +
  • backfill-npm-from-tags — triggered on custom:
    • +
  • fetch-tags — git fetch --tags --force.
    • +
  • build-and-publish-missing — walk every tag in version order, skip the + ones already on the registry, git checkout the rest, verify + tag == package.json version at that commit, build, and publish. This is + the disaster-recovery / replay path.
    • +

    Secrets: NPM_REPO_URL, NPM_USERNAME, NPM_PASSWORD. Auth is a generated .npmrc (registry= + _auth= base64 of user:pass) written from secrets at runtime — the committed .npmrc in a repo only points at the registry URL.

    @@ -752,6 +759,16 @@ runtime — the committed .npmrc in a repo only points at the regis
  • Ship as-is. Name and version come from package.json, so the same file is reused verbatim across every npm package.
    • +
    +

    Registry credentials are shared. The private npm registry (Verdaccio at +npm.aetoskia.com) authenticates against the same htpasswd file as the +private PyPI index and the Docker registry (/auth/htpasswd), with +registration disabled (max_users: -1). NPM_USERNAME / NPM_PASSWORD are +therefore the same credentials as PIP_USERNAME / PIP_PASSWORD — no +separate npm account exists. Verdaccio's htpasswd plugin accepts bcrypt +hashes ($2y$…); non-bcrypt entries that pypiserver tolerates will not +authenticate against npm. See 93 – Library Registry.

    +

    Type C — Docker deployment (service-docker.yaml)

    For a service that ships a container image — a long-running API/worker, e.g. @@ -821,8 +838,8 @@ triggered on tag:

    package.json version; a service needs a root VERSION file. See 91 – Versioning & Changelog.
  • Do not rename the pipelines; tooling and runbooks key off - build-and-publish-pypi, build-and-publish-npm, and - build-and-deploy-service.
    • + build-and-publish-pypi, build-and-publish-npm, + build-and-deploy-service, and their backfill-*-from-tags companions.
    diff --git a/standards/lib/93_library_registry/index.html b/standards/lib/93_library_registry/index.html index 34351ea..bd5f8d6 100644 --- a/standards/lib/93_library_registry/index.html +++ b/standards/lib/93_library_registry/index.html @@ -626,6 +626,15 @@ + + +
  • + + + Publishing & registry auth + + +
  • @@ -821,6 +830,15 @@ matching library, its import name, its "use instead of" guidance, and its MCP endpoint (or, for the auth-server service, a spec pointer). It also serves the pinned auth-server OpenAPI contract at docs://spec. Query it before writing any infrastructure.

    +

    Publishing & registry auth

    +

    Python packages publish to the private index (pip.aetoskia.com, pypiserver) +and npm packages to the private registry (npm.aetoskia.com, Verdaccio). Both +authenticate against the same htpasswd file (/auth/htpasswd) used by the +Docker registry and the Traefik basic-auth middleware; registration is disabled, +so the CI credentials (PIP_USERNAME / PIP_PASSWORD, NPM_USERNAME / +NPM_PASSWORD) are one and the same account — there is no separate npm user. +Verdaccio requires bcrypt htpasswd entries; see +90 – Drone Pipelines for the CI wiring.

    Notes