ci: publish with NPM_TOKEN again - #312
Merged
Merged
Conversation
Two OIDC attempts, two failures with npm reporting no credential at all. The second one was worth it — it found a real bug in this file, where setup-node's `registry-url` left an empty auth token that stopped npm attempting the exchange — but fixing that only moved the error from E404 to ENEEDAUTH. The npmjs.com registration remains unconfirmed, and it is not something this repository can check or set. So: back to the path that demonstrably works. v0.24.2 published this way, with a provenance attestation. Carrying forward what the attempts taught, in the header and at the step: `registry-url` is required for token auth and fatal for OIDC. That asymmetry is the whole trap, and it is now written down next to the line it applies to. Keeps node 24 from #311 — unrelated to auth, and the tests pass on it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan92 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 42
…and 42 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Back to the stored-token path, which demonstrably works — v0.24.2 published this way with a provenance attestation.
What the two OIDC attempts established
E404on PUTregistry-urlremoved)ENEEDAUTHThe second attempt was worth making: it found a genuine bug in this workflow —
setup-node'sregistry-urlwrites//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}, which under OIDC resolves to an empty credential and stops npm attempting the exchange (actions/setup-node#1551). But fixing it only moved the error, so the npmjs.com registration remains unconfirmed — and nothing in this repo can check or set it.The trap, now written down
registry-urlis required for token auth and fatal for OIDC. That asymmetry is the whole trick, and it's now documented in the header and at the step it applies to, so a future switch starts by deleting the right line.Also
--provenanceretained, withid-token: write, which is what produced v0.24.2's attestationNoted, deliberately not fixed here
Every publish logs
"bin[moshcode]" script name bin/moshcode.mjs was invalid and removed. It sounds fatal and isn't — npm strips the./prefix from thebinvalues, and both 0.24.0 and 0.24.2 published with working bins (verified against the registry). Dropping the./inpackage.jsonwould silence it, but that would changepackage.jsonafterv0.24.3was tagged, and publishing content that differs from its tag is what #308 went out of its way to avoid.Next
Main is at 0.24.3 and unpublished, so a dispatch finishes it — no new release needed.
🤖 Generated with Claude Code