fix(release): unblock npm trusted publishing (Node 24 + provenance flags) - #46
Merged
Conversation
…ags) PR #45 fixed the missing version-bump commit but ENEEDAUTH persisted on the publish step. Trust on npmjs.com was tightened (no environment filter), but the workflow was still not signaling OIDC intent to pnpm. Three aligned changes, mirroring the proven pattern in our other release workflows: 1. Release workflow: node-version 22 -> 24. The runner already defaults to Node 24; pinning 22 was unnecessarily old and predates the npm CLI >= 11.5.1 + Node >= 22.14.0 trusted-publishing prerequisites. 2. 'Publish packages' step: add env NPM_CONFIG_PROVENANCE: 'true'. pnpm reads this and routes publish through OIDC, not the legacy fallback path that requires a token. 3. packages/errors/package.json: add publishConfig.provenance: true. Belt + suspenders alongside the env var, and gives npm a default intent for provenance attestation on every publish. Adds a changeset to pass the new ci.yml lint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR #45 fixed the missing version-bump commit, but the publish step still hit
ENEEDAUTH. Root cause: pnpm was not routed to the OIDC code path, and Node 22 was older than the npm trusted-publishing prerequisites.Three changes
release.yml:node-version: 22→24. Runner default is already Node 24; pinning 22 predated the trusted-publishing prerequisites (npm CLI ≥ 11.5.1 + Node ≥ 22.14.0).release.yml:Publish packagesstep now carriesenv: NPM_CONFIG_PROVENANCE: 'true'. This forces pnpm down the OIDC publish path.packages/errors/package.json: addpublishConfig: { access: "public", provenance: true }.access: "public"was already being propagated by Changesets, but pulling it intopublishConfighere documents the intent and matches the proven pattern in our other release workflows.Why this should work
The npm trusted publisher on
deessejs/errors×release.ymlis configured correctly (no environment filter). The previous failures were a tooling artifact, not an npm-side auth issue.Effect on next merge to main
The release workflow runs again. If OIDC succeeds,
@deessejs/errors@1.2.1is published with provenance, the tag is pushed at the version-bump commit, and the GitHub Release is created.Files changed
.github/workflows/release.ymlpackages/errors/package.json.changeset/fix-oidc-publish.md🤖 Generated with Claude Code