ci: Use OIDC for npm publish - #41900
Conversation
npm generates provenance attestations automatically when publishing with trusted publishing (OIDC), and rejects the publish when `repository.url` is missing or does not match the repository the workflow ran in. Six published packages had no `repository` field at all; `message-parser` and `peggy-loader` still pointed at `RocketChat/fuselage`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`createNpmFile()` interpolated `process.env.NPM_TOKEN` unconditionally, so without the secret it wrote `//registry.npmjs.org/:_authToken=undefined`. npm honours that auth line instead of exchanging the OIDC token, failing with a misleading E401/E404. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
npm allows one trusted publisher per package and validates the entry-point workflow filename (`workflow_ref`), which rules out `workflow_call` reusable workflows. Publishing happened from three files — publish-release.yml, new-release.yml and release-candidate.yml — so no single filename could be registered. Merge them into release.yml, keeping all three triggers and deriving the release-action `action` from the event. Also grant `id-token: write` and install npm >= 11.5.1, both required for the OIDC exchange (Node 22 bundles npm 10). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Covers what release.yml does, why publishing must live in a single workflow file, how to register a trusted publisher for a package, the repository-field requirement for provenance, and the common OIDC failure modes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
|
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
`.changeset/config.json` already sets `access: "public"` globally, which changesets turns into `--access public` on every `npm publish`. The nine per-package copies were inconsistent — the other six published packages never had one — and the copy in `fuselage-ui-kit` was dead, since that package is private. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`using: "node20"` is a deprecated GitHub Actions runtime. Bump the esbuild target alongside it so the bundle matches the runtime it executes on. This does not affect the OIDC exchange either way — the publish runs in a subprocess (`yarn changeset publish`) under the Node from setup-node, and inherits `ACTIONS_ID_TOKEN_REQUEST_*` from the job. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #41900 +/- ##
===========================================
- Coverage 69.33% 69.32% -0.01%
===========================================
Files 4255 4255
Lines 168644 168644
Branches 30052 30030 -22
===========================================
- Hits 116929 116920 -9
- Misses 46534 46544 +10
+ Partials 5181 5180 -1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
It declared `yarn@4.12.0` while the root declares `4.18.0`. No other workspace package pins a package manager, and this one already inherits the toolchain via `volta.extends`, so remove the field rather than bump it — otherwise it just drifts again. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 participant
Proposed changes (including videos or screenshots)
Issue(s)
Steps to test or reproduce
Further comments