ci(publish-npm): upgrade npm so OIDC Trusted Publishing works - #80
Conversation
npm OIDC Trusted Publishing requires npm >= 11.5.1, but the publish job
runs on Node 20 which bundles npm 10.x. On npm 10 the OIDC publish step
signs provenance but cannot authenticate tokenlessly, so it falls through
to an unauthenticated publish and fails with E404 ("not in this
registry"). Install npm@latest after setup-node, before the publish
steps, so the OIDC path can actually authenticate.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
📝 WalkthroughWalkthroughAdd npm global upgrade step to the npm publishing composite action. Before OIDC Trusted Publishing, the action now upgrades npm to the latest version and logs the version to ensure compatibility with the tokenless publish flow on Node 20. Changesnpm OIDC Publishing Setup
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
📄 README may need an updateThis PR introduces changes that might not be reflected in Reason:
|
📚 Skills documentation may need an updateThis PR introduces changes that might not be reflected in the skills documentation. Reason:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/blocks/publish-npm/action.yaml (1)
49-56: ⚡ Quick winKeep the npm >= 11.5.1 claim, but pin the npm upgrade instead of using
@latest.The “npm >= 11.5.1 for OIDC Trusted Publishing” requirement is consistent with npm Trusted Publishing docs; your step’s logic is sound. To improve CI/CD reproducibility, avoid
npm@latestdrifting over time—pin to the minimum compatible version range instead.Suggested change
- npm install -g npm@latest + npm install -g npm@^11.5.1🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/blocks/publish-npm/action.yaml around lines 49 - 56, The "Upgrade npm for OIDC Trusted Publishing" step currently installs npm@latest; change it to pin a concrete compatible version (e.g., replace the install command in that step with a pinned version like npm install -g npm@11.5.1 or a caret range such as npm install -g npm@^11.5.1) so CI is reproducible while still meeting the npm >= 11.5.1 requirement; keep the rest of the step (shell: bash and the version echo) intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/blocks/publish-npm/action.yaml:
- Around line 49-56: The "Upgrade npm for OIDC Trusted Publishing" step
currently installs npm@latest; change it to pin a concrete compatible version
(e.g., replace the install command in that step with a pinned version like npm
install -g npm@11.5.1 or a caret range such as npm install -g npm@^11.5.1) so CI
is reproducible while still meeting the npm >= 11.5.1 requirement; keep the rest
of the step (shell: bash and the version echo) intact.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 70906a49-6fdc-4906-aad1-019e09d24e6c
📒 Files selected for processing (1)
.github/blocks/publish-npm/action.yaml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Agent
- GitHub Check: check-skills / check-skills
- GitHub Check: check-readme / check-readme
Problem
npm OIDC Trusted Publishing requires npm ≥ 11.5.1, but
publish-npmruns on Node 20, which bundles npm 10.x. On npm 10 the OIDC publish step signs provenance (that's supported) but cannot authenticate tokenlessly — so it effectively runs an unauthenticated publish and fails:(Surfaced while onboarding
@photon-ai/clito trusted publishing — the trusted-publisher config was correct, but the publish could never authenticate via OIDC on npm 10.)Fix
Install
npm@latestaftersetup-node, before the publish steps, so the OIDC path can authenticate. ~10s added to the publish job; affects every repo that publishes throughpublish-npm.Note
This is necessary but not always sufficient for a given package — the trusted publisher must also be configured on npmjs.com (GitHub org/user, repo, caller workflow filename, matching
Allow npm publish).🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmithwith what you need. Autofix is disabled.Summary by CodeRabbit