Support "bot"/organization tokens

[SimenB]

I'd like to generate tokens that come from https://www.npmjs.com/org/jest or https://www.npmjs.com/org/jest-community rather than them being personal tokens for my user.

[MylesBorins]

Is this specifically for publishing?

[alexanderniebuhr]

we have the same requirement for publishing with the GitHub Actions. We have many changes in the team, therefore having one token specific to one user is not quite optimal.
We would request that just Automation Tokens can be created for an company, to be used in the CI/CD.

The workaround with an additional user org-bot, seems to be against a secure setup, as 2FA other security ideas are not as strong if a shared mailbox ist used for this.

@MylesBorins any roadmap?

[SimenB]

Feels like this is sorta what github/roadmap#557 and github/roadmap#554 are for

[MylesBorins]

It is indeed! We'll see about getting you earlier access if we can.

[gr2m]

Can we get early access as well to test with @semantic-release?

We ran into problems when the automation tokens were introduced. The tokens worked for publishing, but didn't work for managing dist-tags. And I think the whoami endpoint failed, which we use for token verification before attempting the actual publish.

[SimenB]

Yes. Sorta related to npm/feedback#636, but instead of my face and email being attached as publisher, have some bot/organization/shared user.

Of course still public information if you go to owner or some such, but having "published by" noot be a person when it's from CI would add clarity and better separation of concerns (IMO 😀)

[travi]

typically i create a new user account (for example, maybe one named jest-bot) for this purpose and use the tokens from that account for publishing from CI. i do wish it was simpler to configure org permissions to only allow publishing from this account and not from other org members, though (while retaining permissions to make other changes).

are there details that you are looking for that are distinct from creating a dedicated "bot" user?

[SimenB]

(oops, messed up threading here. haven't used Discussions before 😅 ).

I don't want to juggle another email address, credentials to it and and the account when managing a shared resource in an org. In Jest's case I'd probably set up a dedicated email address for it in the case where it makes sense to communicate with "the publishers/maintainers", but it makes more sense to me that a bot user on npm is a separate thing, just like it is on GitHub. More people can configure it, use it and grant it accesses, and it's not tied to a single person. Mostly for reduced bus factor clarity - there's IMO a difference when npm says "Published by John Doe" vs "Published by Jest".