chore: switch npm publish to trusted publishing and bump Node to 24#401
Merged
chore: switch npm publish to trusted publishing and bump Node to 24#401
Conversation
Use OIDC-based trusted publishing (--provenance) instead of NPM_TOKEN secret for npm publish. Bump Node from 22 to 24, update engines field, and bump GitHub Actions to latest major versions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for graypaper-reader ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (6)
📒 Files selected for processing (3)
✅ Files skipped from review due to trivial changes (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughNode.js runtime bumped from 22 → 24 across CI workflows, Dockerfiles, and Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Visual Regression Test Report ✅ PassedGithub run id: 24137496049 🔗 Artifacts: Download |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/node.js.yml (1)
21-21: Align tested Node versions with declared engine support.The
package.jsondeclaresengines.node: >=22.12.0, but all CI workflows test only Node 24. This gap can allow Node 22.12–23.x regressions to slip into releases while still advertising support. Either add Node 22 to the CI matrix or tighten the engine declaration to>=24.0.0.Proposed workflow adjustment (option a)
jobs: build: runs-on: ubuntu-latest + strategy: + matrix: + node-version: [22, 24] steps: - uses: actions/checkout@v6 - name: Use Node.js uses: actions/setup-node@v6 with: - node-version: 24 + node-version: ${{ matrix.node-version }} cache: "npm"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/node.js.yml at line 21, The CI is testing only node-version: 24 while package.json declares engines.node: >=22.12.0; align them by either (A) adding Node 22 (and optionally 23) to the GitHub Actions matrix by changing node-version to a list that includes 22 (e.g., ["22", "24"]) so CI runs the lowest declared supported runtime, or (B) tighten the engine declaration in package.json to ">=24.0.0" if you intend to only support Node 24+; update whichever you choose and ensure the symbol node-version in the workflow and the engines.node field in package.json match.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 40-45: The published packages shared/links-metadata and
tools/links-check are missing the repository metadata required for OIDC/trusted
publishing; open each package.json in the directories referenced
(shared/links-metadata and tools/links-check) and add a "repository" entry
(either a string or object with "type": "git" and "url":
"https://github.com/your-org/your-repo.git") so npm can verify the repository
during the npm publish steps; ensure the URL points to this repo and commit the
changes before the workflow runs.
---
Nitpick comments:
In @.github/workflows/node.js.yml:
- Line 21: The CI is testing only node-version: 24 while package.json declares
engines.node: >=22.12.0; align them by either (A) adding Node 22 (and optionally
23) to the GitHub Actions matrix by changing node-version to a list that
includes 22 (e.g., ["22", "24"]) so CI runs the lowest declared supported
runtime, or (B) tighten the engine declaration in package.json to ">=24.0.0" if
you intend to only support Node 24+; update whichever you choose and ensure the
symbol node-version in the workflow and the engines.node field in package.json
match.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2dd253bf-1fa0-4b70-81b9-50f3feec2c65
📒 Files selected for processing (10)
.github/workflows/deploy.yml.github/workflows/links-checker.yml.github/workflows/matrix-bot.yml.github/workflows/node.js.yml.github/workflows/publish.yml.github/workflows/visual-regression.yml.node-versionDockerfile.snapshot-testspackage.jsontools/matrix-bot/Dockerfile
Catches packaging issues (missing files, bad config) on every PR before they hit a real publish. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Required by npm trusted publishing to verify OIDC provenance. Also includes the `directory` field since these are monorepo packages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
NPM_TOKENsecret to OIDC trusted publishing (--provenance+id-token: write).node-version>=22.12.0(drops Node 20 support)configure-pagesv6,upload-pages-artifactv4,deploy-pagesv5,upload-artifactv7Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit