From b06f04f24c04aa5de34128459fd9bfbf280106cf Mon Sep 17 00:00:00 2001 From: meh Date: Wed, 2 Sep 2026 13:24:44 +0700 Subject: [PATCH] ci(release): publish from a GitHub-hosted runner, and say why Moving the publish jobs to Ubicloud looked like closing a gap: every other job in the repository is on Ubicloud, and nothing about downloading a tarball and running `npm publish` wants a particular runner. It is not that. npm signs a provenance statement on publish, and the registry refuses one signed anywhere it reads as self-hosted, which is what an Ubicloud runner is: npm error 422 Error verifying sigstore provenance bundle: Unsupported GitHub Actions runner environment: "self-hosted". Only "github-hosted" runners are supported when publishing with provenance. It fails at the registry rather than at the runner, so nothing local catches it: the release ran, decided, packed a correct 0.2.2 tarball, signed it, and died on the PUT. Nothing was published, and because the decider reads npm rather than the diff, landing this makes the same release go out unchanged. Both publish jobs move back, each with the reason in place so the next reader does not close the same gap again. --- .github/workflows/release-js.yml | 12 +++++++++++- .github/workflows/release-oxc.yml | 5 ++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-js.yml b/.github/workflows/release-js.yml index f4b7bb1..e1ae6e5 100644 --- a/.github/workflows/release-js.yml +++ b/.github/workflows/release-js.yml @@ -155,7 +155,17 @@ jobs: publish: needs: [decide, package] if: needs.decide.outputs.publish == 'true' - runs-on: ubicloud-standard-2 + # The one job in this repository that may not run on Ubicloud. npm signs a + # provenance statement on publish and the registry rejects the result from + # anything it reads as self-hosted, which is what an Ubicloud runner is: + # + # npm error 422 Error verifying sigstore provenance bundle: Unsupported + # GitHub Actions runner environment: "self-hosted". Only "github-hosted" + # runners are supported when publishing with provenance. + # + # It fails at the registry rather than at the runner, so the release gets + # all the way to a packed tarball before it dies. Leave this alone. + runs-on: ubuntu-latest strategy: fail-fast: false matrix: diff --git a/.github/workflows/release-oxc.yml b/.github/workflows/release-oxc.yml index 8b085c1..6b5f82d 100644 --- a/.github/workflows/release-oxc.yml +++ b/.github/workflows/release-oxc.yml @@ -180,7 +180,10 @@ jobs: publish: needs: [decide, package] if: needs.decide.outputs.publish == 'true' - runs-on: ubicloud-standard-2 + # GitHub-hosted for the same reason as `release-js`: npm rejects a + # provenance statement signed on a runner it reads as self-hosted, which + # an Ubicloud runner is. See that file for the registry's error. + runs-on: ubuntu-latest permissions: contents: read id-token: write