ci(release): disable OIDC for bootstrap publish (0.1.1)

[Yan Xue (yanxue06)]

Context

The first Release run on main (run #26429138962) failed at npm-publish-oidc:

🔑 Publishing via NPM token...
npm error 404 Not Found - PUT https://registry.npmjs.org/create-spectrum-project

The OIDC job's NPM_TOKEN fallback was used and got E404 on the PUT. The proximate cause is that npm OIDC Trusted Publishing needs a trusted publisher configured on npmjs.com for this repo + workflow, which can only be set up after the package exists on the registry. Classic chicken-and-egg.

Change

use-oidc: true → use-oidc: false. First publish goes via NPM_TOKEN (inherited org secret, same one spectrum-ts has access to). Flip back to true once create-spectrum-project is live on npm and the trusted publisher is configured.

What happens on merge

This PR carries the release label, so merging triggers the Release workflow:

• release-info sees previous = 0.1.0 (from the existing tag on the failed run), classifies this ci: commit as patch → next = 0.1.1.
• bump-version writes 0.1.1 to package.json, creates tag v0.1.1.
• github-release creates the release.
• npm-publish (non-OIDC path now) publishes create-spectrum-project@0.1.1 to public npm via NPM_TOKEN.

The dangling v0.1.0 tag + GitHub release stay as-is. 0.1.1 will be the first version actually on npm.

Heads up (separate issues, not blocking)

• The failed run had: npm warn publish "bin[create-spectrum-project]" script name dist/bin.js was invalid and removed. npm pkg fix would resolve it locally. If that warning recurs and the bin entry gets stripped from the tarball, npm create spectrum-project won't work.
• package.json URLs now point at github.com/photon-hq/create-spectrum-project but the repo is still named create-spectrum-app — those links 404 until the repo is renamed.

If this run also fails with E404

That means the org NPM_TOKEN doesn't have create-new-package rights (likely scoped to existing packages / @photon-hq/ namespace). Fix is either (a) generate a broader token, (b) manually publish from local with a personal account, or (c) ship under the @photon-hq/ scope.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Chores
  • Updated release workflow authentication configuration for internal CI/CD operations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6309dbbe-41d0-46f4-846e-66edb6fdb634

📥 Commits

Reviewing files that changed from the base of the PR and between 8e0c0bb and 3118a0a.

📒 Files selected for processing (1)

• .github/workflows/release.yaml

📜 Recent review details

🔇 Additional comments (1)

.github/workflows/release.yaml (1)

19-24: LGTM!

---

📝 Walkthrough

Walkthrough

The GitHub Actions release workflow for the create-spectrum-project service is updated to use token-based authentication instead of OIDC for the bootstrap phase. The reusable workflow input use-oidc is set to false with comments indicating the transition to trusted publisher/OIDC will occur later.

Changes

Release Workflow Authentication Mode

Layer / File(s)	Summary
OIDC to token-based publishing transition .github/workflows/release.yaml	The use-oidc input in the reusable workflow call is set to false, switching release authentication from OIDC to token-based publishing for the bootstrap phase, with comments documenting the intended migration path.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Possibly related PRs

• photon-hq/create-spectrum-project#1: Both PRs modify the same GitHub Actions .github/workflows/release.yaml reusable workflow inputs, specifically toggling the use-oidc value between OIDC-enabled and token-based authentication modes.

Suggested reviewers

• soradotwav

Poem

🐰 A token hops in, OIDC takes a rest,
Bootstrap needs auth before the trusted test,
Soon trusted publishers will have their day,
But first the token lights the way! 🔐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: disabling OIDC in the release CI workflow for the bootstrap publish step, with the version bump as context.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/disable-oidc-for-bootstrap-publish

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR adjusts the Release workflow configuration to allow the initial npm publish to succeed by disabling npm OIDC trusted publishing during the bootstrap phase, falling back to token-based publishing until the package exists on the registry.

Changes:

• Set use-oidc to false in the Release reusable workflow inputs.
• Added inline documentation explaining the bootstrap rationale and when to revert.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.