Apply CSA package-naming convention (completes F-10-05) - #6
Merged
Conversation
Establishes and applies the org-wide rule: - Registries WITH a namespace/scope keep a simple name under the org namespace: npm -> @cloudsecurityalliance/secid; Go module path unchanged. - Flat registries carry the org prefix on the distribution name: PyPI -> cloudsecurityalliance-secid (default to the full cloudsecurityalliance- prefix; csa- only when length-constrained). - Import modules (secid_client) and the CLI command (secid) stay simple. Adds publishConfig.access=public so the scoped npm package publishes public. Updates install/import docs across the three READMEs and the client doc comment. The convention is documented in the README. Note: the npm rename was claimed in the earlier hardening PR but the package.json change was never actually committed (staging miss) — corrected here along with the PyPI name, which was left open at the time. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Establishes and applies the CSA package-naming convention, and completes audit finding F-10-05 (package rename).
The convention
@cloudsecurityalliance/secid,github.com/CloudSecurityAlliance/…(unchanged).cloudsecurityalliance-secid. Default to the fullcloudsecurityalliance-prefix; fall back tocsa-only when the name would be too long or the registry constrains length.import secid_client/ thesecidcommand.Changes
typescript/package.json: name →@cloudsecurityalliance/secid, pluspublishConfig.access = public(scoped packages default to private otherwise).python/pyproject.toml: name →cloudsecurityalliance-secid(import modulesecid_clientandsecidCLI entry point unchanged).github.com/CloudSecurityAlliance/SecID-Client-SDK/goalready conforms.Verified:
tscbuild OK under the scoped name,pyproject.tomlparses, Python client imports andmainentry point intact.The npm rename was claimed in the earlier hardening PR (#5) but the
package.jsonchange was never actually committed — a staging miss on my part (the working-tree edit was dropped on checkout). This PR corrects that and adds the PyPI name, which was deliberately left open at the time pending this naming decision.Note
Actual publishing under the new names (npm
@cloudsecurityalliance/secid, PyPIcloudsecurityalliance-secid) remains your manual release step. Org-wide, this convention would ideally live in a CSA contributor-docs location rather than only this repo's README.🤖 Generated with Claude Code