fix(ci): grant id-token: write at release-please.yml top level#115
Merged
Conversation
The release.yml npm-publish job's `id-token: write` permission was silently dropped because the calling workflow (release-please.yml) had top-level `permissions: contents: read`. Per-job permissions can only narrow the top-level ceiling; they cannot grant permissions the top level didn't include. Symptom on every release attempt: Skipped OIDC: ERR_PNPM_AUTH_TOKEN_EXCHANGE: Failed token exchange request with body message: Unknown error (status code 404) The job's GITHUB_TOKEN Permissions block in the run log showed only `Contents: read, Metadata: read` — `id-token: write` was missing despite being declared at the job level in release.yml. Fix: top-level `permissions:` now lists every permission used by any job, including transitively via workflow_call. Each job still narrows to its own least-privilege subset, so Scorecard's Token-Permissions check still passes. Trusted publisher relationships were already correctly configured for all 17 @opencodehub/* packages; the OIDC failure was downstream of npm, purely a GitHub Actions permission propagation bug. Durable lesson: .erpaval/solutions/conventions/workflow-call-permissions-ceiling.md
theagenticguy
force-pushed
the
fix/release-please-permissions-ceiling
branch
from
b741791 to
ed05bba
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Top-level
permissions: contents: readin.github/workflows/release-please.ymlwas capping every job below it. Thereleasejob (which fans out torelease.ymlviaworkflow_callfor the npm-publish step) declaredid-token: writeandcontents: writeat its own job level, but those declarations are silently a no-op when not in the top-level set.Verified by inspecting the failing job's log header:
id-token: writemissing despite being declared at the job level in release.yml.This is the root cause of every recent npm-publish failure on this repo:
The 404 isn't from npm rejecting trust — it's from GitHub returning no OIDC token because
id-token: writewasn't actually granted to the runner. Verified all 17@opencodehub/*packages already have the correct trust relationship (release.yml+theagenticguy/opencodehub) configured on npmjs.com vianpm trust list.Fix
Top-level
permissions:is now the union of every permission used by any job, including those reached transitively viaworkflow_call. Each job continues to narrow to its own least-privilege subset, so Scorecard's Token-Permissions check still passes.Test plan
npm trust list @opencodehub/cli→ confirms trust relationship exists with workflowrelease.ymlRelease Pleaseworkflow.feat!:npm view @opencodehub/cli versionreturns0.4.0npm install -g @opencodehub/cli@latestworks on a clean machineProvenance
Durable lesson persisted:
.erpaval/solutions/conventions/workflow-call-permissions-ceiling.md