ci: restructure publish workflow for OIDC authentication#25
Conversation
Adopt the Reactist publishing pattern to fix npm registry authentication failures. The previous approach had GITHUB_TOKEN leaking between publish steps, preventing OIDC from working. Changes: - Add .npmrc with @Doist registry config for OIDC-based npm publishing - Reverse publish order: npm first, GitHub Packages second - Remove setup-node registry-url for initial npm publish (uses .npmrc) - Add config cleanup step between registry publishes Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
![doistbot-app[bot]](https://avatars.githubusercontent.com/in/2345791?s=60&v=4){kind=small}
There was a problem hiding this comment.
The PR adopts a dual-registry publishing strategy but breaks the OIDC authentication for the npm registry. While the intention to use .npmrc for configuration is good, setup-node requires specific inputs to trigger the OIDC token exchange necessary for provenance generation. Without this, the first publish step will fail.
frankieyan
force-pushed
the
frankieyan/fix-publish-flow
branch
2 times, most recently
from
2c74939 to
77b126d
Compare
…d in package.json on CI Update .node-version to 22.22.0 to satisfy the engine requirement (^22.22.0 || >=24.13.0) while keeping engine-strict=true in .npmrc. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
frankieyan
force-pushed
the
frankieyan/fix-publish-flow
branch
from
77b126d to
9a5391d
Compare
frankieyan
force-pushed
the
frankieyan/fix-publish-flow
branch
from
578fc28 to
7fcbd2f
Compare
|
It took a few tries, but we now have a "successful" publish run here, and v2.0.1 has been published to the npm registry. I made a mistake of setting the org name to "doist" instead of "Doist" when setting up the trusted publishing flow on npmjs.com 🤦 (success is in quotes because it can't publish v2.0.1 again to the GH registry, since it already exists) Edit: green publish run for v2.0.2 here |
frankieyan
changed the title
1 participant
This fixes the broken publish flow to the npm registry. Hopefully, third time's the charm.
scopeparameterThe
NODE_AUTH_TOKENenvironment variable was persisting into the npm registry publish step, blocking OIDC authentication. Addingscopewasn't enough; the token persistence between steps was the real culprit.Adopts the Reactist publishing pattern:
setup-noderegistry-url, uses.npmrcwith@doist:registry=https://registry.npmjs.org/)npm config delete @doist:registry --location=projectsetup-node+GITHUB_TOKENTest plan
Trigger workflow via manual dispatch from this branch.