Create a Node.js org account on pypi registry about admin HOT 19 CLOSED

I believe the pypi account can follow the npm account ownership.

from admin.

Account created and saved in 1password.

from admin.

I rotated the npm credentials and saved them in 1Password too.

from admin.

Secrets repo updated.

from admin.

SGTM

from admin.

+1. there is also this package that can benefit from such an account: nodejs/tap2junit#56

from admin.

Should this be owned by the build WG or the TSC?

from admin.

Is https://www.npmjs.com/~nodejs-foundation owned by the build WG or the TSC?

from admin.

Build WG

from admin.

@nodejs/build wdyt?

from admin.

I think the question is, who needs access to it?

The original reasons that the Build WG owns the npm account was as an emergency access in the event that people become inactive/leave the project (so we could manage who could publish modules). Initially we did not actively use the account (i.e. individuals published the modules under their own accounts). Over time that changed and I think we now publish modules under that account via GitHub Actions. Possibly another reason might be the TSC at the time didn't have a solution for storing secrets (there's a 1Password account now, I believe), i.e. the account's log in details (I may be misremembering this one).

from admin.

+1 from me. I think using 1password might make the most sense unless this is somehow related to build/infra

from admin.

+1 on 1password + moving the npm credentials there too

from admin.

I have submitted request to create a orgnanization named nodejs on pypi.org. Still waiting for response.

from admin.

+1 on using 1 password to manage credentials

from admin.

I rotated the npm credentials and saved them in 1Password too.

@targos could you update build/test/test_logins.md in the secrets repo, which previously recorded the account name, password and 2fa recovery codes? I don't mind if we move that to 1Password, but we currently document

from admin.

Ok but can I move them to infra level? IMO this doesn't belong to test

from admin.

Ok but can I move them to infra level? IMO this doesn't belong to test

SGTM

from admin.

+1 to moving to infra or storing all the info in 1 password. We need the recovery info.

from admin.