From 1238a9733fdf817b175264f998c4861da701db7f Mon Sep 17 00:00:00 2001 From: Minsu Lee Date: Mon, 1 Jun 2026 23:49:50 +0900 Subject: [PATCH 1/2] ci: publish via npm (bun pm pack) for provenance/trusted publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit bun publish supports neither npm OIDC trusted publishing nor --provenance (oven-sh/bun#22423), so the publish job failed with 'missing authentication'. Switch the publisher to the npm CLI: - bun pm pack builds the tarball, npm publish --provenance uploads it - actions/setup-node provisions the registry .npmrc + an npm new enough for provenance; id-token: write grants the OIDC token - npm view guards make the job idempotent (skip already-published vers) - add the missing @pleaseai/code-style (cli) publish step — it was stuck at 0.0.1 on npm while the manifest tracks 0.0.3 --- .github/workflows/release-please.yml | 53 ++++++++++++++++++++++++---- 1 file changed, 46 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 4408dd0..c602213 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -16,6 +16,7 @@ jobs: releases_created: ${{ steps.release.outputs.releases_created }} eslint-config-released: ${{ steps.release.outputs['packages/eslint-config--release_created'] }} prettier-config-released: ${{ steps.release.outputs['packages/perttier-config--release_created'] }} + code-style-released: ${{ steps.release.outputs['packages/cli--release_created'] }} steps: - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 id: app-token @@ -34,6 +35,9 @@ jobs: needs: release-please if: ${{ needs.release-please.outputs.releases_created == 'true' }} runs-on: ubuntu-latest + permissions: + contents: read + id-token: write # npm provenance / trusted publishing (OIDC) steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -41,23 +45,58 @@ jobs: with: bun-version: latest + # npm CLI is the publisher: bun publish supports neither npm OIDC + # trusted publishing nor --provenance (oven-sh/bun#22423). setup-node + # provisions the registry .npmrc and an npm new enough for provenance. + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + with: + node-version-file: .nvmrc + registry-url: https://registry.npmjs.org + - name: Install dependencies run: bun install - name: Build run: bun run build - - name: Set npm auth token - run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc - env: - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - - name: Publish @pleaseai/eslint-config if: ${{ needs.release-please.outputs.eslint-config-released == 'true' }} - run: bun publish --access public working-directory: packages/eslint-config + run: | + VERSION=$(node -p "require('./package.json').version") + if npm view "@pleaseai/eslint-config@$VERSION" version 2>/dev/null; then + echo "⚠ @pleaseai/eslint-config@$VERSION already published, skipping" + else + bun pm pack + npm publish pleaseai-eslint-config-*.tgz --provenance --access public + fi + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Publish @pleaseai/prettier-config if: ${{ needs.release-please.outputs.prettier-config-released == 'true' }} - run: bun publish --access public working-directory: packages/perttier-config + run: | + VERSION=$(node -p "require('./package.json').version") + if npm view "@pleaseai/prettier-config@$VERSION" version 2>/dev/null; then + echo "⚠ @pleaseai/prettier-config@$VERSION already published, skipping" + else + bun pm pack + npm publish pleaseai-prettier-config-*.tgz --provenance --access public + fi + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + + - name: Publish @pleaseai/code-style + if: ${{ needs.release-please.outputs.code-style-released == 'true' }} + working-directory: packages/cli + run: | + VERSION=$(node -p "require('./package.json').version") + if npm view "@pleaseai/code-style@$VERSION" version 2>/dev/null; then + echo "⚠ @pleaseai/code-style@$VERSION already published, skipping" + else + bun pm pack + npm publish pleaseai-code-style-*.tgz --provenance --access public + fi + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} From d3a842c1e534e50fab410c374f7315eac448dc2a Mon Sep 17 00:00:00 2001 From: Minsu Lee Date: Tue, 2 Jun 2026 00:04:04 +0900 Subject: [PATCH 2/2] ci: use tokenless OIDC trusted publishing (drop NPM_TOKEN) Authenticate to npm purely via OIDC: id-token: write mints the token, a trusted publisher configured on npmjs.com authorizes it. Removes the NODE_AUTH_TOKEN/NPM_TOKEN secret entirely. - ensure npm >= 11.5.1 (OIDC trusted-publishing minimum) before publish - no long-lived registry token in CI --- .github/workflows/release-please.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index c602213..ff79a09 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -47,12 +47,18 @@ jobs: # npm CLI is the publisher: bun publish supports neither npm OIDC # trusted publishing nor --provenance (oven-sh/bun#22423). setup-node - # provisions the registry .npmrc and an npm new enough for provenance. + # provisions the registry .npmrc; id-token: write + a trusted publisher + # configured on npmjs.com let npm authenticate tokenlessly via OIDC. - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version-file: .nvmrc registry-url: https://registry.npmjs.org + # OIDC trusted publishing requires npm >= 11.5.1; pin to the latest 11.x + # in case the runner's bundled npm predates it. + - name: Ensure npm supports trusted publishing + run: npm install -g npm@^11.5.1 + - name: Install dependencies run: bun install @@ -70,8 +76,6 @@ jobs: bun pm pack npm publish pleaseai-eslint-config-*.tgz --provenance --access public fi - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Publish @pleaseai/prettier-config if: ${{ needs.release-please.outputs.prettier-config-released == 'true' }} @@ -84,8 +88,6 @@ jobs: bun pm pack npm publish pleaseai-prettier-config-*.tgz --provenance --access public fi - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Publish @pleaseai/code-style if: ${{ needs.release-please.outputs.code-style-released == 'true' }} @@ -98,5 +100,3 @@ jobs: bun pm pack npm publish pleaseai-code-style-*.tgz --provenance --access public fi - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}