Harden npm package publishing - #42
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f7bff933ed
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| echo "tarball=${TARBALLS[0]}" >> "$GITHUB_ENV" | ||
|
|
||
| - name: Publish with OIDC provenance | ||
| run: npm publish "$tarball" --provenance --access public |
There was a problem hiding this comment.
When the tag workflow reaches this publish step, find package ... stores a value like package/formo-cli-1.2.1.tgz in tarball; passing that unqualified one-slash spec to npm publish is not treated as the downloaded local tarball. npm's package-spec docs show local tarballs as ./my-package.tgz while username/project is GitHub shorthand (https://docs.npmjs.com/cli/v11/using-npm/package-spec/), and npm publish --dry-run package/foo.tgz resolves as a GitHub repo, so releases will fail before publishing. Use ./${TARBALLS[0]} or an absolute path from find.
Useful? React with 👍 / 👎.
| name: npm-package | ||
| path: ${{ runner.temp }}/package/*.tgz | ||
| if-no-files-found: error | ||
| retention-days: 1 |
There was a problem hiding this comment.
When the npm-publish environment has required reviewers or a wait timer, the publish job can remain pending for more than 24 hours after the build uploaded this tarball; with retention-days: 1, GitHub is allowed to expire the only package candidate before the protected job starts, so download-artifact fails and the validated release cannot be published. Use the repository default or a retention window that comfortably exceeds the expected approval SLA.
Useful? React with 👍 / 👎.
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
What changed
npm-publishenvironmentnpm@latestinstall and disables publish-job cachingWhy
The release job previously combined repository write access, npm OIDC, dependency execution, and a test secret. The new jobs keep each credential boundary minimal.
Validation
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.