problems with the repository

[pfi79]

Problems have been identified, but I lack the competence to figure out how to fix it.

1. The pipeline for nodejs ends in red. It seems that there are not enough keys to upload the modules somewhere in the repository.
2. Dependabot creates changes that don't merge due to DCO errors (Required status check "DCO" was not set by the expected GitHub app.) Bump the bundler group across 1 directory with 2 updates #275 Bump @protobufjs/utf8 from 1.1.0 to 1.1.1 in /bindings/node in the npm_and_yarn group across 1 directory #274

Does anyone have any ideas on how to fix this?

[bestbeforetoday]

For the npm publishing, the workflow likely needs to be updated for trusted publishing rather than the (now unsupported) npm auth token authentication. See the npm docs on trusted publishing. The key things are:

• In the GitHub Actions workflow:
  1. Add the id-token: write workflow permission.
  2. Remove the NODE_AUTH_TOKEN environment variable from the workflow
• In npmjs.com, ask @ryjones to:
  1. Configure a trusted publisher using the following information:
     • Organization or user: hyperledger
     • Repository: fabric-protos
     • Workflow filename: node-bindings.yml
  2. Change Publishing access for @hyperledger/fabric-protos to Require two-factor authentication and disallow tokens.

[ryjones]

@bestbeforetoday @pfi79 take a look at https://github.com/hyperledger/fabric-protos/pull/263/changes

[jt-nti]

I just had a quick look at that PR for #262 and the only thing I spotted was that it would be better to have the write permission at the job level rather than at the workflow level. It might even be better to move the publish step to a separate job just to minimise parts of the workflow with the elevated permission.

[ryjones]

I just had a quick look at that PR for #262 and the only thing I spotted was that it would be better to have the write permission at the job level rather than at the workflow level. It might even be better to move the publish step to a separate job just to minimise parts of the workflow with the elevated permission.

@jwagantall could you take a look?

[pfi79]

Do I understand correctly that all of the above applies only to nodejs?
Any suggestions on what's wrong with dependabot DCO?

[pfi79]

It seems that someone has deleted the DCO app.
And he left only DCO-2.

dependabot/dependabot-core#3480 (comment)

[ryjones]

@pfi79 that was me. I've replaced the check with DCO-2. At some point we need to move to branch rulesets and away from the current model.

[pfi79]

@pfi79 that was me. I've replaced the check with DCO-2. At some point we need to move to branch rulesets and away from the current model.

I agree with you. I don't have rights to this repository, so I can only observe for now, not participate.