fix(release): enter npm-publish environment for scoped token - #27
Merged
qmarcelle merged 1 commit intoAug 19, 2026
Merged
Conversation
…s in scope
`@workspacejson/cli@0.6.1` was tagged but never published. Its run cleared every
gate — guards, build, typecheck, tests, and the tarball verification that
stopped 0.6.0 — then failed the credential check with both variables empty:
NODE_AUTH_TOKEN:
NPM_TOKEN:
NPM_TOKEN is an ENVIRONMENT secret on `npm-publish`, and this repository holds
no repository-level NPM_TOKEN at all. GitHub exposes an environment secret only
to a job that declares `environment:`. This job never did, so
`${{ secrets.NPM_TOKEN }}` resolved to the empty string and the guard reported a
missing credential on a repository whose credential was correct all along.
`publish` is the job id. `npm-publish` is the environment. Nothing in the run
output distinguished them, which is most of why this read as a token problem.
The job now declares `environment: npm-publish`, and takes `name: npm-publish`
so a reader of a failed run sees the same word in the job label and in the scope
it needs. The header said "Required repository secret"; it now names the
environment secret actually required, and records why the token is scoped that
way — the environment is the reviewer-gateable boundary the standard's own
releases publish behind, so widening the token to the repository would have been
the wrong repair.
Not re-run, re-tagged: a re-run replays the workflow as it existed at the tagged
commit, and cli-v0.6.1 points at a commit with no `environment:` line, so it
would fail identically. The failed tags stay. 0.6.0 and 0.6.1 each record a real
defect stopped before anything reached the registry, which is better evidence
than a history in which the gates never fired.
Version bumped to 0.6.2. No package, mining, retrieval, provenance or artifact
behavior changes; the 0.5.0 authority migration and the 0.6.1 packaging-boundary
repair both ship here unchanged.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
qmarcelle has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
Reviewer's GuideFixes the CLI publish workflow so the npm-publish environment (and its NPM_TOKEN secret) is actually entered, and bumps the CLI from 0.6.1 to 0.6.2 with documentation clarifying the failed 0.6.0/0.6.1 releases and the environment-scoped token choice. Flow diagram for publish job entering npm-publish environmentflowchart LR
JobPublish[Job publish]
Env[Environment npm-publish]
Secret[Environment secret NPM_TOKEN]
Registry[NPM registry]
JobPublish -->|environment: npm-publish| Env
Env --> Secret
JobPublish -->|uses secrets.NPM_TOKEN| Secret
JobPublish -->|npm publish| Registry
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- The workflow header and inline comments around the
npm-publishenvironment are very long; consider tightening this prose to the minimum needed to explain the environment vs repository secret distinction so the CI file stays easy to scan. - The detailed release history and failure narratives for 0.6.0/0.6.1 are repeated across the changelog and README; consider centralizing that explanation in one place and referencing it from the other to avoid future divergence.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The workflow header and inline comments around the `npm-publish` environment are very long; consider tightening this prose to the minimum needed to explain the environment vs repository secret distinction so the CI file stays easy to scan.
- The detailed release history and failure narratives for 0.6.0/0.6.1 are repeated across the changelog and README; consider centralizing that explanation in one place and referencing it from the other to avoid future divergence.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Repairs the distinct release defect exposed by
cli-v0.6.1: the publish job cleared architecture, build, typecheck, tests, and tarball verification, then failed the credential guard becauseNPM_TOKENis an environment secret onnpm-publishand the job never entered that environment.0.6.1never reached npm. This PR prepares@workspacejson/cli@0.6.2with no package, mining, retrieval, provenance, or artifact behavior changes.Change
environment: npm-publishto the publish job so the scoped environment secret is availablename: npm-publishso the Actions UI label matches the environment boundaryNPM_TOKENto repository scope would be the wrong repair0.6.1to0.6.20.6.0and0.6.1tags and their distinct pre-publish failures as release evidenceRelease history
cli-v0.6.0: stopped at tarball integrity gate; never publishedcli-v0.6.1: passed the repaired tarball gate, stopped at credential-scope gate; never publishedcli-v0.6.2: candidate containing both prior repairs plus the environment declarationVerification reported on branch
Merge only after GitHub CI confirms the branch from a clean checkout.
Summary by Sourcery
Enable the CLI publish workflow to release version 0.6.2 using the correctly scoped npm publishing environment.
Bug Fixes:
CI:
Documentation:
Chores: