From 10a29ded6a088c35e27d53b4d0ecc72b574cded4 Mon Sep 17 00:00:00 2001 From: Jason Stedwell Date: Fri, 7 Aug 2026 15:00:35 -0500 Subject: [PATCH] chore: gitignore .npmrc so a registry token can't be committed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Publishing to the Gitea npm registry needs an _authToken, and the natural place to put it is a .npmrc in the repo root — which was not ignored. The committed .npmrc.example invites exactly that mistake. The pattern matches the exact filename, so .npmrc.example is unaffected. Nothing was leaked: no .npmrc has ever been committed here. This is preventative. Better still, publish with `npm publish --userconfig ` and keep the token out of the working tree entirely — that is how v0.5.0 was published. Co-Authored-By: Claude Opus 5 --- .gitignore | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitignore b/.gitignore index 82cd0f6..34eb815 100755 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,10 @@ dist-demo/ # tsup temp (mount cannot unlink) tsup.config.bundled_*.mjs + +# A real .npmrc carries the Gitea registry _authToken — never commit it. +# This pattern matches the exact filename only, so .npmrc.example (which is +# meant to be committed) is unaffected. +# Publishing from a clone: prefer `npm publish --userconfig ` over writing a token into the working tree at all. +.npmrc