fix(release): publish through GitHub token and npm OIDC - #247
raysonmeng wants to merge 1 commit into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 31d36a0754
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (registry(`${PACKAGE}@${wanted}`, "dist").shasum !== shasum) throw new Error(`Published ${wanted} differs from the checked artifact`); | ||
| console.log(`${PACKAGE}@${wanted} already contains this artifact; skipping duplicate upload`); | ||
| } else { | ||
| run("npm", ["publish", tarball, "--access=public", "--tag=latest", "--ignore-scripts", "--registry", REGISTRY], |
There was a problem hiding this comment.
If another publisher releases a higher version after the registry check at line 206 but before this command starts, explicitly supplying --tag=latest allows this older publish to move latest backward, so unversioned installs receive the older build. npm's bundled documentation states that publishing already applies latest by default, and its publish implementation rejects a higher existing version only when the tag configuration remains default (highestVersionIsGreater && isDefaultTag); passing --tag makes that condition false. Omit the explicit tag so npm performs its later higher-version check.
Useful? React with 👍 / 👎.
1 participant
Automatic releases failed when the stored GitHub and npm credentials were rejected. Use the native per-job GITHUB_TOKEN and npm trusted publishing so future releases do not depend on a long-lived PAT or npm token.
One workflow now explicitly validates, prepares a version PR, squash-merges through the existing master rules, validates the canonical source again, creates the tag/Release and publishes the checked tarball. Recovery verifies existing tags and package checksums, avoids duplicate bumps, and prevents latest from moving backwards. npm provenance uses the actual packaged commit. The release SOP and legacy script handoff match this flow.
Validation:
GitHub setup has been configured and read back: release environment allows only the master branch, Actions can create version PRs, and the existing master protection ruleset is unchanged. Before merging, the package owner must save the npm Trusted Publisher binding for raysonmeng/agent-bridge, publish.yml, environment release, with direct npm publish allowed. That form is prepared but has not been submitted. The first normal master push after this change will prepare0.1.32 and exercise the real OIDC publish path.0.1.31 is already public and must not be republished.