fix(cli): recover npm publication verification - #256
Conversation
|
Warning Review limit reached
Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe CLI publishing workflow now checks existing package integrity, publishes with provenance when required, and waits for registry integrity and attestation verification. Tests and release documentation describe the verified ChangesCLI publication verification
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant ReviewedTarball
participant NpmRegistry
participant Provenance
GitHubActions->>ReviewedTarball: compute reviewed tarball integrity
GitHubActions->>NpmRegistry: query requested version
NpmRegistry-->>GitHubActions: return package version and integrity
GitHubActions->>NpmRegistry: publish with provenance when required
GitHubActions->>NpmRegistry: poll for matching integrity
NpmRegistry->>Provenance: expose attestation
Provenance-->>GitHubActions: return provenance URL
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
TegamiThis repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under Create a changelog → · Changelog format Release preview
Changelogs in this PR
Run Managed by Tegami. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/publish-cli.yml (1)
161-183: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRun
npm audit signaturesbefore executing the published CLI.Checking
dist.attestations.urlonly confirms attestation metadata; provenance and registry signatures must be verified withnpm audit signaturesagainst an isolated installation before runningorgmemory. Add the isolated install audit step to.github/workflows/publish-cli.ymland a matching assertion toscripts/npm-publish-workflow-policy.test.mjs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish-cli.yml around lines 161 - 183, Before the published CLI execution in .github/workflows/publish-cli.yml lines 161-183, add an isolated installation of the exact package version and run npm audit signatures against that installation, failing before npm exec if signature verification fails. Update the corresponding workflow assertions in scripts/npm-publish-workflow-policy.test.mjs lines 44-48 to require the isolated install audit step and its placement before CLI execution.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/publish-cli.yml:
- Around line 161-183: Before the published CLI execution in
.github/workflows/publish-cli.yml lines 161-183, add an isolated installation of
the exact package version and run npm audit signatures against that
installation, failing before npm exec if signature verification fails. Update
the corresponding workflow assertions in
scripts/npm-publish-workflow-policy.test.mjs lines 44-48 to require the isolated
install audit step and its placement before CLI execution.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 06180107-c206-4c1b-b320-40036a34c295
⛔ Files ignored due to path filters (5)
docs/guidelines/cli-publication.mdis excluded by!docs/**docs/increments/active/2026-08-01-skill-cli-distribution-lifecycle/design.mdis excluded by!docs/**docs/increments/active/2026-08-01-skill-cli-distribution-lifecycle/plan.mdis excluded by!docs/**docs/specs/domains/asset-registry.mdis excluded by!docs/**docs/tests/domains/asset-registry.mdis excluded by!docs/**
📒 Files selected for processing (5)
.github/workflows/publish-cli.yml.tegami/cli-publish-verification-recovery.mdARCHITECTURE.mdapps/cli/README.mdscripts/npm-publish-workflow-policy.test.mjs
📜 Review details
🧰 Additional context used
📓 Path-based instructions (2)
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Treat the repository and runtime evidence as the engineering system of record; do not treat chat or Northstar as authoritative.
Before changing a domain, read its specification, test-coverage document, and applicable decision filenames.
Material decisions about domain boundaries, authorization, persistence, publication, concurrency, cache isolation, parity scope, or deployment require an independent architecture challenge and documented alternatives before implementation.
Do not use completed increment documents as the source for current behavior; use them only for history or archaeology.
Before using unfamiliar Spring Boot, Spring Modulith, Spring AI, Gradle, React, Vite, Tailwind, TypeScript, Next.js, or Fumadocs APIs, consult current official documentation, Context7, and the relevant verification skill.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work; never commit secrets or customer data.
Keepddl-auto=validateand pair every persisted-model change with a Flyway migration.
Use the testing harness; a terminating clean test is the JVM context gate, andbootRunis not verification.
Files:
apps/cli/README.mdscripts/npm-publish-workflow-policy.test.mjsARCHITECTURE.md
.github/**/*.{yml,yaml}
⚙️ CodeRabbit configuration file
.github/**/*.{yml,yaml}: Require least-privilege permissions, explicit release tags for actions,
bounded job timeouts, concurrency cancellation, frozen lockfiles, and no
secrets in pull-request workflows. GitHub Actions are intentionally not
pinned to commit SHAs; Dependabot owns their scheduled version updates.
Files:
.github/workflows/publish-cli.yml
🧠 Learnings (1)
📚 Learning: 2026-07-24T22:52:57.466Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 40
File: .github/workflows/ci.yml:126-126
Timestamp: 2026-07-24T22:52:57.466Z
Learning: In this repository’s GitHub Actions workflows, the `uses:` field may intentionally reference GitHub Actions by explicit release tags (not immutable commit SHAs) per the project’s OrgMemory policy. Do not flag tag-based `uses:` references as “unpinned” if they are release-tag-based (e.g., `owner/repovX.Y.Z`) and follow the repo’s Dependabot-owned scheduled updates approach.
Applied to files:
.github/workflows/publish-cli.yml
🪛 markdownlint-cli2 (0.23.1)
.tegami/cli-publish-verification-recovery.md
[warning] 7-7: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
🔇 Additional comments (4)
.github/workflows/publish-cli.yml (1)
113-139: LGTM!.tegami/cli-publish-verification-recovery.md (1)
1-11: LGTM!ARCHITECTURE.md (1)
47-50: LGTM!apps/cli/README.md (1)
70-76: LGTM!
|
CodeRabbit finding verified and fixed in 97ea445. The workflow now installs the exact registry package in an isolated directory with lifecycle scripts disabled, runs npm audit signatures, and only then executes the published CLI. The policy test enforces both presence and ordering. Local proof: 97 packages with verified registry signatures, 10 with verified attestations; release:check and focused policy tests pass. |
1 participant
Summary
@orgmemory/cli@0.1.0publication and observed one-time bootstrap boundaryVerification
node --test scripts/npm-publish-workflow-policy.test.mjscorepack pnpm check:clicorepack pnpm release:check@orgmemory/cli@0.1.0integrity, SLSA provenance URL, and executable version0.1.0Merge
Use a merge commit and preserve both reviewed commits. Do not squash.
Summary by CodeRabbit
New Features
Documentation
Tests