Setup workflows #43
Setup workflows #43
Conversation
WalkthroughAdds two GitHub Actions workflows: one that publishes on pushes to master and one that runs a PR dry-run; and renames the published package from Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Developer
participant GH as GitHub Actions
participant GCP as Google Cloud (Workload Identity)
participant AR as Artifact Registry (npm)
Dev->>GH: Push to master
activate GH
GH->>GH: actions/checkout\nsetup-node@v20
GH->>GCP: Authenticate (workload identity)\nAssume service account
GCP-->>GH: Access token
GH->>AR: Configure npm auth (token)
GH->>GH: npm install
GH->>AR: npm publish
AR-->>GH: Publish result
deactivate GH
sequenceDiagram
autonumber
participant Dev as Developer
participant GH as GitHub Actions (PR workflow)
participant GCP as Google Cloud (Workload Identity)
participant AR as Artifact Registry (npm)
Dev->>GH: Open/sync/reopen PR -> target master
activate GH
GH->>GH: actions/checkout\nsetup-node@v24
GH->>GCP: Authenticate (workload identity)\nAssume service account
GCP-->>GH: Access token
GH->>AR: Configure npm auth (token)
GH->>GH: npm install
GH->>AR: npm publish (dry-run)
AR-->>GH: Dry-run result
deactivate GH
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
package.json (1)
2-2: AddpublishConfigto lock the publish target.Right now a developer running
npm publishlocally would fall back to the default registry if their.npmrcisn’t primed, risking an accidental push to npmjs. Add apublishConfig.registrypointing at Artifact Registry so every publish path stays scoped correctly.(docs.github.com)"name": "@spotdraft/liquidjs", "version": "3.1.0", ... "postversion": "git push && git push --tags" - } + }, + "publishConfig": { + "registry": "https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/" + }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/master.yaml(1 hunks)package.json(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/master.yaml
8-8: label "ubicloud-standard-2" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-2019", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "ubuntu-20.04", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
| - name: Configure NPM to use Artifact Registry | ||
| run: | | ||
| TOKEN=$(gcloud auth print-access-token) | ||
| rm -rf .npmrc | ||
| echo -e "\n//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=\"$TOKEN\"" >> .npmrc | ||
| echo "@spotdraft:registry=https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/" >> .npmrc |
There was a problem hiding this comment.
Add always-auth=true so npm actually sends the token.
Artifact Registry’s own guidance keeps an always-auth=true entry alongside the _authToken. Without it, npm can skip attaching the token on preliminary GET/HEAD requests when publishing, which leads to intermittent 401s during npm publish. Please add the flag when building .npmrc.(cloud.google.com)
TOKEN=$(gcloud auth print-access-token)
rm -rf .npmrc
- echo -e "\n//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=\"$TOKEN\"" >> .npmrc
+ echo -e "\n//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:always-auth=true" >> .npmrc
+ echo "//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=\"$TOKEN\"" >> .npmrc
echo "@spotdraft:registry=https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/" >> .npmrc📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Configure NPM to use Artifact Registry | |
| run: | | |
| TOKEN=$(gcloud auth print-access-token) | |
| rm -rf .npmrc | |
| echo -e "\n//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=\"$TOKEN\"" >> .npmrc | |
| echo "@spotdraft:registry=https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/" >> .npmrc | |
| - name: Configure NPM to use Artifact Registry | |
| run: | | |
| TOKEN=$(gcloud auth print-access-token) | |
| rm -rf .npmrc | |
| echo -e "\n//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:always-auth=true" >> .npmrc | |
| echo "//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=\"$TOKEN\"" >> .npmrc | |
| echo "@spotdraft:registry=https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/" >> .npmrc |
🤖 Prompt for AI Agents
In .github/workflows/master.yaml around lines 35 to 40, the workflow writes an
.npmrc with the _authToken and registry but omits the always-auth flag; update
the script that builds .npmrc to append an always-auth=true entry (for the
registry in question) immediately after writing the _authToken so npm will
always send the token and avoid intermittent 401s during publish.
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/pr.yaml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/pr.yaml
8-8: label "ubicloud-standard-2" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-2019", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "ubuntu-20.04", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
| TOKEN=$(gcloud auth print-access-token) | ||
| rm -rf .npmrc | ||
| echo -e "\n//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=\"$TOKEN\"" >> .npmrc | ||
| echo "@spotdraft:registry=https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/" >> .npmrc |
There was a problem hiding this comment.
Fix _authToken quoting to avoid authentication failure.
.npmrc keeps the double quotes you echo around ${TOKEN}, so npm sends Bearer "token" and Artifact Registry rejects the publish (dry-run or real). Drop the quotes and write the file in one shot.
- TOKEN=$(gcloud auth print-access-token)
- rm -rf .npmrc
- echo -e "\n//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=\"$TOKEN\"" >> .npmrc
- echo "@spotdraft:registry=https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/" >> .npmrc
+ TOKEN="$(gcloud auth print-access-token)"
+ cat <<'EOF' > .npmrc
+//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=${TOKEN}
+@spotdraft:registry=https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/
+EOFCommittable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In .github/workflows/pr.yaml around lines 37 to 40, the current echo adds
literal double quotes around the auth token and appends each line separately;
change it to write the .npmrc in a single write operation and remove the
surrounding quotes so the _authToken is written as ...:_authToken=<TOKEN> (no
quotes). Ensure the command writes both registry lines to .npmrc atomically
(overwrite, not append) and that the token is inserted raw so npm sends Bearer
<token> without embedded quotes.
Summary by CodeRabbit