ci: use npm OIDC trusted publishing instead of a publish token#2
Conversation
Matches the shape used by relayfile, relaycron, and relayflows: tokenless auth via `id-token: write`, with the registry exchanging a short-lived GitHub OIDC token. - Remove the `NODE_AUTH_TOKEN` env from the publish step - Remove the "Require NPM_TOKEN" guard step - Pin npm to the 11 line (OIDC trusted publishing needs >= 11.5.1) - Align the dry-run invocation with the reference repos (--tag passed) - README documents the trusted-publisher setup and provenance package.json already matched the reference convention (repository set, publishConfig.access public, license, files), so it needs no change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
khaliqgant
added
the
no-agent-relay-review
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the README.md documentation to reflect a transition from using manual NPM_TOKEN secrets to npm OIDC trusted publishing for package releases. There are no review comments, and I have no additional feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ab921047e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| - name: Publish | ||
| if: ${{ github.event.inputs.dry_run != 'true' }} | ||
| run: npm publish --access public --provenance --tag ${{ github.event.inputs.tag }} --ignore-scripts |
There was a problem hiding this comment.
For the first release of this new 0.0.0 package, this tokenless command cannot succeed: npm's trusted publishing documentation requires the package to already exist before a trusted publisher can be configured. Since the commit removes the only token-based path, the owner cannot perform the initial publish needed to create @agent-relay/sandbox; retain a one-time authenticated bootstrap path or document and implement a separate initial-publish procedure before switching entirely to OIDC.
Useful? React with 👍 / 👎.
1 participant
Aligns this repo's publish workflow with the house standard used by
relayfile,relaycron, andrelayflows: tokenless OIDC trusted publishing. Publish-config only — no runtime code touched.Changes
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}from the publish stepnpm install -g npm@11— OIDC trusted publishing requires npm ≥ 11.5.1--dry-run --access public --tag <input> --ignore-scripts)Unchanged and already correct:
permissions: id-token: write,npm publish --access public --provenance --tag <input> --ignore-scripts,registry-url, dispatch-only trigger, dry-run default.package.json— already compliant, no change neededVerified against
@relayfile/coreand@relaycron/sdk. Both use exactlypublishConfig: {"access": "public"}(provenance comes from the CLI flag, not this field) plus arepositoryfield, which provenance needs to link the source. This package already has both, pluslicense,files, andtype. The references addrepository.directoryonly because they are monorepo leaves; a single-package repo correctly omits it.They agree on everything else, but not this:
relayfilenpm@1122relaycronnpm@latest22.14.0relayflowsnpm@latestI matched
relayfile'snpm@11, deliberately.npm@latestwill eventually resolve to npm 12, which requires Node ≥ 22.22.2 — so on a workflow pinned to Node22.14.0,@latestis a latent break waiting for the npm 12 rollout. This exact trap is already documented inrelayauth's publish workflow, which pinsnpm@11.18.0and explains why. Pinning the 11 line keeps OIDC support while staying Node-22 compatible.Worth a follow-up on
relaycron/relayflows, which carry the same latent risk. Out of scope here.Operator step required before a real publish
This workflow cannot publish until the repository owner registers a trusted publisher for
@agent-relay/sandboxon npmjs.org — repoAgentWorkforce/sandbox, workflow.github/workflows/publish.yml. That registration is the OIDC equivalent of granting a token, and it is the owner's step, exactly as addingNPM_TOKENwould have been. Until then a non-dry-run publish fails at the registry.I have not published and will not publish.
Summary by cubic
Switch the publish workflow to
npmOIDC trusted publishing (tokenless) for safer, simpler releases. Removes token steps, pinsnpmto the 11 line for OIDC support, and updates docs; no runtime code changed.Refactors
NODE_AUTH_TOKENand theNPM_TOKENguard step in the workflow.npm install -g npm@11to ensure OIDC support while staying compatible with Node 22.--dry-run --access public --tag <input> --ignore-scripts.Migration
@agent-relay/sandboxon npmjs.org; until then only dry-run will succeed.Written for commit 4ab9210. Summary will update on new commits.