From 876bdce63a8a2da7c9c70c4300122ebbb4e9a0c3 Mon Sep 17 00:00:00 2001 From: jbiskur Date: Sun, 5 Jul 2026 19:43:19 +0100 Subject: [PATCH] fix(ci): use OIDC id-token for npm publish MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm publish failed ENEEDAUTH on v0.4.0 — NPM_TOKEN is not usable and node 20's bundled npm is too old for Trusted Publisher OIDC. Update npm to latest and publish without NODE_AUTH_TOKEN (provenance disabled on the self-hosted Blacksmith runner), mirroring flowcore-sdk's fix. Also add workflow_dispatch so a failed publish can be retried from main, with the jsr step skipping versions that are already published. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01MmTkzbSACo6PhBj9o1Sr8A --- .github/workflows/build.yml | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d541451..fb554b1 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -3,6 +3,7 @@ name: Build and Publish to jsr on: release: types: [published] + workflow_dispatch: permissions: id-token: write @@ -33,14 +34,26 @@ jobs: run: deno install --frozen-lockfile - name: Lint run: deno lint + # Skip-if-exists keeps workflow_dispatch re-runs (e.g. to retry a failed + # npm publish) from failing on the already-published jsr version. - name: Publish to JSR - run: deno publish + run: | + VERSION=$(jq -r .version deno.json) + if curl -fsS "https://jsr.io/@flowcore/hono-api/meta.json" | jq -e --arg v "$VERSION" '.versions[$v]' >/dev/null; then + echo "jsr already has ${VERSION} — skipping" + else + deno publish + fi - name: Build for NPM run: deno run -A bin/build-npm.ts - uses: useblacksmith/setup-node@v5 with: node-version: "20.x" registry-url: "https://registry.npmjs.org" - - run: ( cd npm && npm publish --access public ) - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + # OIDC Trusted Publisher auth (no NPM_TOKEN): needs npm >= 11.5, node 20's + # bundled npm is too old. Provenance stays disabled (self-hosted Blacksmith + # runner). Mirrors flowcore-sdk build.yml. + - name: Update npm to latest + run: npm install -g npm@latest + - name: Publish to NPM + run: ( cd npm && npm publish --access public --provenance=false )