publish-npm cannot publish. Two releases have now reached the step and failed, and the remaining blocker is configuration on npmjs.com rather than anything in this repository.
What was wrong, and is now fixed
Before #53, the step never reached npm at all. npm publish npm-dist/*.tgz handed npm npm-dist/agentrust-io-telemetry-0.1.0-alpha.3.tgz, and npm parses any a/b argument as a GitHub shorthand rather than a path:
npm error command git --no-replace-objects ls-remote \
ssh://git@github.com/npm-dist/agentrust-io-telemetry-0.1.0-alpha.3.tgz.git
npm error git@github.com: Permission denied (publickey).
#53 changed it to ./npm-dist/*.tgz. That fix is correct and is confirmed working: on v0.1.0-alpha.4 npm packed the tarball normally, 71 files and 179.5 kB, and issued a real publish request.
What is still wrong
npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@agentrust-io%2ftelemetry - Not found
npm error 404 The requested resource '@agentrust-io/telemetry@0.1.0-alpha.4' could not be found
or you do not have permission to access it.
The package exists: @agentrust-io/telemetry is published at 0.1.0-alpha.1. npm returns 404 rather than 403 on an unauthorized publish so that it does not disclose whether a package exists, so this is an authorization failure.
publish-npm supplies no NODE_AUTH_TOKEN and no secret. It declares id-token: write and a registry-url and relies entirely on npm trusted publishing. So the account side needs a trusted publisher for @agentrust-io/telemetry naming this repository and .github/workflows/release.yml. That is the npm counterpart of the PyPI pending publisher, which activated on the alpha.3 publish and is now working.
Consequences until it is configured
@agentrust-io/telemetry stays at 0.1.0-alpha.1 while PyPI carries 0.1.0a3 and 0.1.0a4.release-assets needs both publishers, so it has skipped on both releases and neither v0.1.0-alpha.3 nor v0.1.0-alpha.4 has attested assets.
No code change will clear this. Once the trusted publisher exists, the next tag publishes both registries and produces the assets.
publish-npmcannot publish. Two releases have now reached the step and failed, and the remaining blocker is configuration on npmjs.com rather than anything in this repository.What was wrong, and is now fixed
Before #53, the step never reached npm at all.
npm publish npm-dist/*.tgzhanded npmnpm-dist/agentrust-io-telemetry-0.1.0-alpha.3.tgz, and npm parses anya/bargument as a GitHub shorthand rather than a path:#53 changed it to
./npm-dist/*.tgz. That fix is correct and is confirmed working: onv0.1.0-alpha.4npm packed the tarball normally, 71 files and 179.5 kB, and issued a real publish request.What is still wrong
The package exists:
@agentrust-io/telemetryis published at0.1.0-alpha.1. npm returns 404 rather than 403 on an unauthorized publish so that it does not disclose whether a package exists, so this is an authorization failure.publish-npmsupplies noNODE_AUTH_TOKENand no secret. It declaresid-token: writeand aregistry-urland relies entirely on npm trusted publishing. So the account side needs a trusted publisher for@agentrust-io/telemetrynaming this repository and.github/workflows/release.yml. That is the npm counterpart of the PyPI pending publisher, which activated on the alpha.3 publish and is now working.Consequences until it is configured
@agentrust-io/telemetrystays at0.1.0-alpha.1while PyPI carries0.1.0a3and0.1.0a4.release-assetsneeds both publishers, so it has skipped on both releases and neitherv0.1.0-alpha.3norv0.1.0-alpha.4has attested assets.No code change will clear this. Once the trusted publisher exists, the next tag publishes both registries and produces the assets.