Agent Wranglers

OSS-12Required

Keep at least two people who can publish

Give at least two maintainers admin rights on the repository, owner rights on every registry package and access to the release process. Each of them has published at least one release in the last 12 months.

By Agent Wranglers. Updated .

How to do it

When the only maintainer is ill, away or locked out, nobody can ship a security fix, and every user stays exposed. A second owner on paper who has never released cannot help either, so let them run a release. Add owners on each registry, such as npm, PyPI, crates.io or Maven Central, and on the code host organisation. Keep the release free of anything only one person has, such as a key on a laptop. Publish from CI as Publish your packages without stored tokens says. A project of one person can name a trusted second person and give them rights now, before they are needed.

Examples

JavaScript example

const OWNERS_REQUIRED = 2;
const packages = ['@example-shop/cart', '@example-shop/checkout'];
for (const name of packages) {
  const { maintainers } = await (await fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`)).json();
  if (maintainers.length < OWNERS_REQUIRED) throw new Error(`${name} has ${maintainers.length} owner(s)`);
}

Python example

import json, os, urllib.request

OWNERS_REQUIRED = 2
request = urllib.request.Request("https://api.github.com/orgs/example-shop/members?role=admin",
                                 headers={"Authorization": f"Bearer {os.environ['GITHUB_TOKEN']}"})
admins = json.load(urllib.request.urlopen(request))
assert len(admins) >= OWNERS_REQUIRED, f"only {len(admins)} admin(s) on the organisation"

How to check

The registry lists at least two owners for every package, and the code host lists at least two admins. The release history shows a release by each of them within 12 months.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/open-source/maintainers-and-governance/two-publishers">Agent Wranglers open source maintenance playbook</a>. In code you write, add a comment next to it with the same link.