Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -1,14 +1,21 @@
name: CI

# Same checks for PRs targeting main or beta (and for pushes to those branches).
on:
push:
branches:
- main
- beta
pull_request:
branches:
- main
- beta

jobs:
test:
name: Test
runs-on: ubuntu-latest

strategy:
matrix:
node-version: [22.x, 24.x]
Expand Down
11 changes: 11 additions & 0 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
@@ -1,9 +1,13 @@
name: Release

# Publishes to npm on push to:
# - main → stable (@latest)
# - beta → prerelease (@beta), e.g. 1.2.0-beta.1
on:
push:
branches:
- main
- beta

jobs:
test:
Expand Down Expand Up @@ -39,6 +43,11 @@ jobs:
name: Release
needs: test
runs-on: ubuntu-latest
permissions:
contents: write
issues: write
pull-requests: write
id-token: write

steps:
- name: Checkout code
Expand All @@ -52,6 +61,7 @@ jobs:
with:
node-version: 22.x
cache: 'npm'
registry-url: 'https://registry.npmjs.org/'

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

if rg -n 'registry-url|NODE_AUTH_TOKEN' .github/workflows/release.yml; then
  echo "Remove setup-node npm authentication for semantic-release." >&2
  exit 1
fi

Repository: TrustVC/trustvc-cli

Length of output: 328


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "## release workflow around setup-node"
sed -n '50,85p' .github/workflows/release.yml || true

echo
echo "## workflow trigger and dependencies"
sed -n '1,45p' .github/workflows/release.yml || true

echo
echo "## package type and scripts"
python3 - <<'PY'
import json
from pathlib import Path
p=Path('package.json')
if p.exists():
    data=json.loads(p.read_text())
    for k in ['name','type','scripts','devDependencies','dependencies']:
        if k in data:
            print(f"{k}:", data[k])
PY

Repository: TrustVC/trustvc-cli

Length of output: 2992


Remove setup-node npm authentication for semantic-release.

setup-node creates an .npmrc when registry-url is set, and semantic-release npm authentication can conflict with that file. Use NPM_TOKEN for token authentication, or switch fully to npm Trusted Publishing, but do not configure both mechanisms.

Proposed fix
       with:
         node-version: 22.x
         cache: 'npm'
-        registry-url: 'https://registry.npmjs.org/'

         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 64, Remove the registry-url
configuration from the setup-node step in the semantic-release workflow so it no
longer creates an .npmrc; retain a single authentication mechanism by using
NPM_TOKEN or fully adopting npm Trusted Publishing, without configuring both.


- name: Install dependencies
run: npm ci
Expand All @@ -64,3 +74,4 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
16 changes: 14 additions & 2 deletions .releaserc.json
Original file line number Diff line number Diff line change
@@ -1,5 +1,12 @@
{
"branches": ["main"],
"branches": [
"main",
{
"name": "beta",
"prerelease": "beta",
"channel": "beta"
}
],
"plugins": [
"@semantic-release/commit-analyzer",
"@semantic-release/release-notes-generator",
Expand All @@ -9,7 +16,12 @@
"changelogFile": "CHANGELOG.md"
}
],
"@semantic-release/npm",
[
"@semantic-release/npm",
{
"npmPublish": true
}
],
[
"@semantic-release/git",
{
Expand Down
768 changes: 572 additions & 196 deletions README.md

Large diffs are not rendered by default.

Loading
Loading