ci: npm@latest for trusted publishing + OIDC diagnostics + npm pkg fix - #21
Conversation
The 0.2.0 publish attempt hit plain ENEEDAUTH with no OIDC exchange traces — npm never attempted trusted publishing. Upgrade npm to latest before publish (Node-bundled npm may predate support) and log node/npm versions plus ACTIONS_ID_TOKEN var presence so the next failure names its own cause. npm pkg fix applied so npm stops auto-correcting bin/repository at publish time (its 'correction' threatened to strip the bin entry entirely). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GtAjJabU9hUkrzoWF3Xtzm
|
Warning Review limit reached
Next review available in: 50 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Nitpick review — approve
The change updates the GitHub Actions release workflow and build configuration to support npm trusted publishing. Because this modifies the CI release pipeline without accompanying automated tests, human review is recommended to ensure the release process remains stable.
0 inline comment(s).
Verdict was
approve, posted as a comment — this repo does not allow GitHub Actions to approve PRs.
|
🎉 This PR is included in version 0.2.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
1 participant
The 0.2.0 attempt failed
ENEEDAUTHwith zero OIDC traces — npm never attempted the trusted-publishing exchange despiteid-token: writeand Node 24. Two suspects remain: the runner's bundled npm predating trusted-publishing support, or the OIDC env vars not reaching the job. This PR settles it:npm install -g npm@latestbefore publish (guarantees a trusted-publishing-capable CLI)ACTIONS_ID_TOKEN_REQUEST_URLis present — the next failure, if any, names its own causenpm pkg fixapplied:binwithout./, normalizedrepository.url— npm's publish-time "auto-correction" warned it removed the bin entry, which would have shipped a CLI package with no CLIIf this run still ENEEDAUTHs with OIDC vars present and current npm, the remaining cause is the npmjs.com trusted-publisher registration not matching (
queso/FlowSpec/release.yml, environment blank).Merging this triggers the release run: semantic-release will again compute v0.2.0 from everything since v0.1.2. No tag/release was created by the failed runs — state is clean.
🤖 Generated with Claude Code
https://claude.ai/code/session_01GtAjJabU9hUkrzoWF3Xtzm