What changed, and why it matters
This commit is a routine packaging and publishing cleanup for the JavaScript client. It renames the npm package from 'ledger-bitcoin' to '@ledgerhq/ledger-bitcoin', updates the README and package-lock.json accordingly, and moves the JS client deployment from a separate workflow triggered on pushes to the 'develop' branch into the main CI workflow triggered only by tags starting with 'jsclient-'. There is no change to the Bitcoin app firmware, cryptographic code, or any user-facing security behavior.
No security action required. Treat as normal maintenance; verify the new scoped package name is correctly published to the npm registry if you depend on it.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies four files: (1) ‘.github/workflows/ci-workflow.yml’ adds tag-based triggers and two new jobs that verify a pushed tag matches the version in package.json/CHANGELOG.md before invoking a reusable npm deployment workflow; (2) ‘.github/workflows/deploy_packages.yml’ is deleted, removing the previous branch-push deployment; (3) ‘bitcoin_client_js/README.md’ updates install/build instructions and import statements to use the scoped package name ‘@ledgerhq/ledger-bitcoin’; (4) ‘bitcoin_client_js/package-lock.json’ updates peerDependencies and peerDependenciesMeta to reference the scoped package name. No source code, APDU handling, transaction parsing, or signature logic is changed.
Changed components
bitcoin_client_js/README.mdbitcoin_client_js/package-lock.json.github/workflows/ci-workflow.yml.github/workflows/deploy_packages.ymlInspect captured patch +38 / −22
diff --git a/.github/workflows/ci-workflow.yml b/.github/workflows/ci-workflow.yml
index fc7b634..7bce7d6 100644
--- a/.github/workflows/ci-workflow.yml
+++ b/.github/workflows/ci-workflow.yml
@@ -6,6 +6,8 @@ on:
branches:
- master
- develop
+ tags:
+ - '*'
pull_request:
branches:
- master
@@ -281,6 +283,35 @@ jobs:
LOG_SPECULOS=1 LOG_APDUS=1 SPECULOS="/speculos/speculos.py" yarn test
+ deploy_js_client_check_tag:
+ name: Check that tag matches version in package.json prior to deploying on JFrog
+ needs: job_test_js_lib
+ runs-on: ubuntu-latest
+ if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/jsclient')
+ steps:
+ - name: Clone
+ uses: actions/checkout@v4
+
+ - name: Check that tag matches semver in CHANGELOG.md
+ run: |
+ cd bitcoin_client_js
+ package_version=$(sed -r -n -e '/"version":/s/^\s+"version": "([[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+)",$/\1/p' package.json)
+ tag_version=${GITHUB_REF#refs/tags/jsclient-}
+ if [[ $package_version == $tag_version ]]; then
+ echo "[INFO] Tag matches version in package.json. Continuing."
+ else
+ echo "[ERROR] mismatch between version in tag and package.json. Aborting."
+ exit 1
+ fi
+
+ deploy_js_client:
+ name: Deploy
+ needs: deploy_js_client_check_tag
+ uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_npm_deployment.yml@v1
+ if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/jsclient')
+ with:
+ package_directory: "bitcoin_client_js"
+
job_test_rust_client:
name: Tests for rust client library
needs: job_build
diff --git a/.github/workflows/deploy_packages.yml b/.github/workflows/deploy_packages.yml
deleted file mode 100644
index 68a5287..0000000
--- a/.github/workflows/deploy_packages.yml
+++ /dev/null
@@ -1,14 +0,0 @@
----
-name: Deploy packages on JFrog
-
-on:
- push:
- branches:
- - develop
-
-jobs:
- deploy_js_client:
- name: Deploy js client to jfrog and npmjs.com
- uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_npm_deployment.yml@v1
- with:
- package_directory: "bitcoin_client_js"
diff --git a/bitcoin_client_js/README.md b/bitcoin_client_js/README.md
index efd4ab5..6dad550 100644
--- a/bitcoin_client_js/README.md
+++ b/bitcoin_client_js/README.md
@@ -9,21 +9,20 @@ Main repository and documentation: https://github.com/LedgerHQ/app-bitcoin-new
## Install
```bash
-$ yarn add ledger-bitcoin
+$ yarn add @ledgerhq/ledger-bitcoin
```
Or if you prefer using npm:
```bash
-$ npm install ledger-bitcoin
+$ npm install @ledgerhq/ledger-bitcoin
```
## Building
```bash
-$ yarn
-
-$ yarn build
+$ npm install
+$ npm run build
```
## Getting started
@@ -35,7 +34,7 @@ More examples can be found in the [test suite](src/__tests__/appClient.test.ts).
Testing the `signPsbt` method requires a valid PSBT, and provide the corresponding wallet policy; it is skipped by default in the following example.
```javascript
-import { AppClient, DefaultWalletPolicy, WalletPolicy } from 'ledger-bitcoin';
+import { AppClient, DefaultWalletPolicy, WalletPolicy } from '@ledgerhq/ledger-bitcoin';
import Transport from '@ledgerhq/hw-transport-node-hid';
// This examples assumes the Bitcoin Testnet app is running.
diff --git a/bitcoin_client_js/package-lock.json b/bitcoin_client_js/package-lock.json
index 66f4155..5b12cd5 100644
--- a/bitcoin_client_js/package-lock.json
+++ b/bitcoin_client_js/package-lock.json
@@ -1761,10 +1761,10 @@
"ecpair": "^2.1.0"
},
"peerDependencies": {
- "ledger-bitcoin": "^0.2.2"
+ "@ledgerhq/ledger-bitcoin": "^0.2.2"
},
"peerDependenciesMeta": {
- "ledger-bitcoin": {
+ "@ledgerhq/ledger-bitcoin": {
"optional": true
}
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.