From ee73b888162f13aeb1cf422e200a3c25c64d81ef Mon Sep 17 00:00:00 2001 From: raj pandey Date: Wed, 2 Sep 2026 14:27:27 +0530 Subject: [PATCH 1/3] fix(ci): pass GITHUB_TOKEN as env var to action-autotag and grant contents:write MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Klemensas/action-autotag@1.2.3 no longer accepts GITHUB_TOKEN as a with: input — it must be supplied via env:. Without a valid token the action's GitHub API calls returned 404 ("Not Found"), aborting the tag and all downstream release steps. Also bumps the release job's permissions from contents:read to contents:write, which is required for the autotag action to push a new git tag. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/release.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 67573e1..51c57a2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest needs: build permissions: - contents: read + contents: write packages: write steps: - name: Checkout @@ -57,8 +57,9 @@ jobs: run: ls -R - uses: Klemensas/action-autotag@1.2.3 id: update_tag - with: + env: GITHUB_TOKEN: "${{ secrets.PKG_TOKEN }}" + with: tag_prefix: "v" - name: Release if: steps.update_tag.outputs.tagname From dd1afff43ca214ecc171399a2aea644c247373ca Mon Sep 17 00:00:00 2001 From: raj pandey Date: Thu, 3 Sep 2026 11:14:42 +0530 Subject: [PATCH 2/3] fix(ci): rewrite release workflow with OIDC trusted publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Switch trigger from push:main to release:published — publishing is now gated on a deliberate GitHub Release rather than every push - Drop Klemensas/action-autotag@1.2.3 — broken action that hardcoded 'master' as the compare head, causing 404 failures; tags are now created by the person publishing the GitHub Release - Drop JS-DevTools/npm-publish + TYPES_GENERATOR_AUTOMATION token — replaced with plain 'npm publish --access public' which uses the OIDC token issued via id-token:write (trusted publishing); provenance is generated automatically, no --provenance flag needed - Add id-token:write to release job permissions for OIDC - Add registry-url to setup-node so .npmrc is written correctly - Upgrade Node 22.x → 24 (minimum required for npm trusted publishing) - npm install → npm ci for deterministic installs - Add 'npm install -g npm@latest' (requires npm ≥ 11.5.1 for OIDC) - Remove fetch-depth:0 (only needed for autotag history traversal) - Remove 'Display dirs' debug step - Keep GitHub Packages publish with PKG_TOKEN (separate registry, trusted publishing only applies to registry.npmjs.org) - Drop gh release create — release already exists when trigger fires Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/release.yml | 51 +++++++++-------------------------- 1 file changed, 13 insertions(+), 38 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 51c57a2..aceac8c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,9 +1,8 @@ name: Publish package to NPM and Git registry on: - push: - branches: - - main + release: + types: [published] jobs: build: @@ -12,14 +11,12 @@ jobs: steps: - name: Checkout uses: actions/checkout@v4 - with: - fetch-depth: 0 - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: "22.x" + node-version: '24' - name: Install dependencies - run: npm install + run: npm ci - name: Build run: | rm -rf dist @@ -37,54 +34,32 @@ jobs: permissions: contents: write packages: write + id-token: write steps: - name: Checkout uses: actions/checkout@v4 - with: - fetch-depth: 0 - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: "22.x" + node-version: '24' + registry-url: https://registry.npmjs.org/ - name: Install dependencies - run: npm install + run: npm ci - name: Download dist uses: actions/download-artifact@v4 with: name: dist path: dist - - name: Display dirs - run: ls -R - - uses: Klemensas/action-autotag@1.2.3 - id: update_tag - env: - GITHUB_TOKEN: "${{ secrets.PKG_TOKEN }}" - with: - tag_prefix: "v" - - name: Release - if: steps.update_tag.outputs.tagname - id: release-plugin - uses: JS-DevTools/npm-publish@v2.2.0 - with: - token: ${{ secrets.TYPES_GENERATOR_AUTOMATION }} - strategy: upgrade - # setup-node writes an .npmrc pointing at GitHub Packages, so the scoped - # publish below resolves there instead of npmjs. + - name: Update npm + run: npm install -g npm@latest + - name: Publish to npm + run: npm publish --access public - name: Setup Node.js for GitHub Packages - if: steps.update_tag.outputs.tagname uses: actions/setup-node@v4 with: - node-version: "22.x" + node-version: '24' registry-url: https://npm.pkg.github.com/ - name: Release to GitHub Packages - if: steps.update_tag.outputs.tagname run: npm publish env: NODE_AUTH_TOKEN: ${{ secrets.PKG_TOKEN }} - - name: GitHub Release - if: steps.update_tag.outputs.tagname - id: github-release - env: - GITHUB_TOKEN: ${{ secrets.PKG_TOKEN }} - VERSION: ${{ steps.release-plugin.outputs.version }} - run: gh release create v"$VERSION" --title "Release $VERSION" --generate-notes From 90ac05f26113458302a8e06cc425248929ebbc8b Mon Sep 17 00:00:00 2001 From: raj pandey Date: Thu, 3 Sep 2026 11:22:30 +0530 Subject: [PATCH 3/3] fix(ci): avoid empty _authToken in .npmrc for OIDC publish MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit setup-node with registry-url writes _authToken=${NODE_AUTH_TOKEN} to .npmrc; when NODE_AUTH_TOKEN is unset that entry is an empty string which can cause ENEEDAUTH before npm's OIDC detection kicks in. Remove registry-url from the setup-node step and pass the registry directly as npm_config_registry env var on the publish step only — npm reads this without touching .npmrc auth config, leaving OIDC detection unobstructed. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index aceac8c..0e6acfb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -42,7 +42,6 @@ jobs: uses: actions/setup-node@v4 with: node-version: '24' - registry-url: https://registry.npmjs.org/ - name: Install dependencies run: npm ci - name: Download dist @@ -54,6 +53,8 @@ jobs: run: npm install -g npm@latest - name: Publish to npm run: npm publish --access public + env: + npm_config_registry: https://registry.npmjs.org/ - name: Setup Node.js for GitHub Packages uses: actions/setup-node@v4 with: