Repository navigation
Conversation
Publish immutable release tags with short-lived OIDC credentials instead of the long-lived npm token. Reject mismatched or already-published versions before building, and remove the workflow's main-branch commits and forced tag updates. Document the required npm trusted publisher and release version process. Keep release installs uncached, validate generated types, and publish provenance with the correct stable or prerelease dist-tag.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The November 11 release reached
npm publishonly after committing version changes tomainand force-updating the release tag. It attemptedinteractor.js@3.6.1, which had already been published on March 31;3.6.2is also already on npm. The publishing step failed, although GitHub's log-download endpoints currently return 502, so its exact npm error could not be retrieved.The workflow also still relies on a long-lived
NPM_TOKENinstead of trusted publishing.Approach
Publish the immutable release tag with npm OIDC credentials and provenance. Keep checkout read-only, remove branch/tag mutations, and reject tag/version mismatches or versions already on npm before building. Pin an OIDC-capable npm CLI, install dependencies without lifecycle scripts, explicitly build and check declarations, and publish prereleases under
next.Release versions now need to be bumped in a PR before creating the matching GitHub release. The workflow never changes an existing tag to make a package version fit.
Evidence
Workflow validation passes. The actual version guard rejects the already-published
3.6.1, rejects a mismatchedv3.6.2tag, and accepts unpublished3.6.3. The release build and type checks pass, and the package dry run includes the bundle and declarations.Required npm setup
An npm package maintainer must authorize
wwilsman/interactor.js→release.yml, with no environment and directnpm publishallowed, before the first OIDC release. The exact setup is documented in.github/RELEASING.md. Current CLI authentication cannot configure or inspect that publisher, and npm listswwilsmanas the package maintainer. No credentials were changed and no package was published.