From 8fbcc5424acc4d8b92b7113bc1e43f0a9d1d40ce Mon Sep 17 00:00:00 2001 From: Klink <85062+dogmar@users.noreply.github.com> Date: Wed, 8 Apr 2026 15:10:12 -0700 Subject: [PATCH 1/6] ci: add semantic-release dry-run to PR checks Verifies the release pipeline (version calculation, changelog generation, npm pack) without actually publishing. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/ci.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8953af4..704d705 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,11 +4,16 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: check: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + with: + fetch-depth: 0 - uses: voidzero-dev/setup-vp@v1 with: @@ -18,3 +23,7 @@ jobs: - run: vp install - run: vp run ready + + - run: npx semantic-release --dry-run + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 55cd5932f9d46b52433d3453eb962a129ac4e306 Mon Sep 17 00:00:00 2001 From: Klink <85062+dogmar@users.noreply.github.com> Date: Wed, 8 Apr 2026 15:19:17 -0700 Subject: [PATCH 2/6] fix: remove changelog and git plugins from semantic-release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Branch protection prevents pushing directly to main. Remove @semantic-release/changelog and @semantic-release/git — GitHub Releases are sufficient for changelog. Co-Authored-By: Claude Opus 4.6 (1M context) --- .releaserc.json | 8 --- package.json | 2 - pnpm-lock.yaml | 145 -------------------------------------------- pnpm-workspace.yaml | 2 - 4 files changed, 157 deletions(-) diff --git a/.releaserc.json b/.releaserc.json index 904a3c2..ba23b25 100644 --- a/.releaserc.json +++ b/.releaserc.json @@ -13,7 +13,6 @@ "preset": "conventionalcommits" } ], - "@semantic-release/changelog", [ "@semantic-release/npm", { @@ -21,13 +20,6 @@ "provenance": true } ], - [ - "@semantic-release/git", - { - "assets": ["CHANGELOG.md", "package/package.json"], - "message": "chore(release): ${nextRelease.version} [skip ci]" - } - ], "@semantic-release/github" ] } diff --git a/package.json b/package.json index 1891772..f857c51 100644 --- a/package.json +++ b/package.json @@ -9,8 +9,6 @@ "prepare": "vp config" }, "devDependencies": { - "@semantic-release/changelog": "catalog:", - "@semantic-release/git": "catalog:", "@types/node": "catalog:", "conventional-changelog-conventionalcommits": "catalog:", "semantic-release": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 54bbeac..4388870 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,12 +6,6 @@ settings: catalogs: default: - '@semantic-release/changelog': - specifier: ^6.0.3 - version: 6.0.3 - '@semantic-release/git': - specifier: ^10.0.1 - version: 10.0.1 '@types/node': specifier: ^24 version: 24.12.2 @@ -33,12 +27,6 @@ importers: .: devDependencies: - '@semantic-release/changelog': - specifier: 'catalog:' - version: 6.0.3(semantic-release@25.0.3(typescript@6.0.2)) - '@semantic-release/git': - specifier: 'catalog:' - version: 10.0.1(semantic-release@25.0.3(typescript@6.0.2)) '@types/node': specifier: 'catalog:' version: 24.12.2 @@ -1051,32 +1039,16 @@ packages: '@sec-ant/readable-stream@0.4.1': resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==} - '@semantic-release/changelog@6.0.3': - resolution: {integrity: sha512-dZuR5qByyfe3Y03TpmCvAxCyTnp7r5XwtHRf/8vD9EAn4ZWbavUX8adMtXYzE86EVh0gyLA7lm5yW4IV30XUag==} - engines: {node: '>=14.17'} - peerDependencies: - semantic-release: '>=18.0.0' - '@semantic-release/commit-analyzer@13.0.1': resolution: {integrity: sha512-wdnBPHKkr9HhNhXOhZD5a2LNl91+hs8CC2vsAVYxtZH3y0dV3wKn+uZSN61rdJQZ8EGxzWB3inWocBHV9+u/CQ==} engines: {node: '>=20.8.1'} peerDependencies: semantic-release: '>=20.1.0' - '@semantic-release/error@3.0.0': - resolution: {integrity: sha512-5hiM4Un+tpl4cKw3lV4UgzJj+SmfNIDCLLw0TepzQxz9ZGV5ixnqkzIVF+3tp0ZHgcMKE+VNGHJjEeyFG2dcSw==} - engines: {node: '>=14.17'} - '@semantic-release/error@4.0.0': resolution: {integrity: sha512-mgdxrHTLOjOddRVYIYDo0fR3/v61GNN1YGkfbrjuIKg/uMgCd+Qzo3UAXJ+woLQQpos4pl5Esuw5A7AoNlzjUQ==} engines: {node: '>=18'} - '@semantic-release/git@10.0.1': - resolution: {integrity: sha512-eWrx5KguUcU2wUPaO6sfvZI0wPafUKAMNC18aXY4EnNcrZL86dEmpNVnC9uMpGZkmZJ9EfCVJBQx4pV4EMGT1w==} - engines: {node: '>=14.17'} - peerDependencies: - semantic-release: '>=18.0.0' - '@semantic-release/github@12.0.6': resolution: {integrity: sha512-aYYFkwHW3c6YtHwQF0t0+lAjlU+87NFOZuH2CvWFD0Ylivc7MwhZMiHOJ0FMpIgPpCVib/VUAcOwvrW0KnxQtA==} engines: {node: ^22.14.0 || >= 24.10.0} @@ -1439,10 +1411,6 @@ packages: resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==} engines: {node: '>= 14'} - aggregate-error@3.1.0: - resolution: {integrity: sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==} - engines: {node: '>=8'} - aggregate-error@5.0.0: resolution: {integrity: sha512-gOsf2YwSlleG6IjRYG2A7k0HmBMEo6qVNk9Bp/EaLgAJT5ngH6PXbqa4ItvnEwCm/velL5jAnQgsHsWnjhGmvw==} engines: {node: '>=18'} @@ -1594,10 +1562,6 @@ packages: resolution: {integrity: sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==} engines: {node: '>=8'} - clean-stack@2.2.0: - resolution: {integrity: sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==} - engines: {node: '>=6'} - clean-stack@5.3.0: resolution: {integrity: sha512-9ngPTOhYGQqNVSfeJkYXHmF7AGWp4/nN5D/QqNQs3Dvxd1Kk/WpjHfNujKHYUQ/5CoGyOyFNoWSPk5afzP0QVg==} engines: {node: '>=14.16'} @@ -1884,10 +1848,6 @@ packages: eventemitter3@5.0.4: resolution: {integrity: sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==} - execa@5.1.1: - resolution: {integrity: sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==} - engines: {node: '>=10'} - execa@8.0.1: resolution: {integrity: sha512-VyhnebXciFV2DESc+p6B+y0LjSm0krU4OgJN44qFAhBY0TJ+1V61tYD2+wHusZ6F9n5K+vl8k0sTy7PEfV4qpg==} engines: {node: '>=16.17'} @@ -2097,10 +2057,6 @@ packages: resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==} engines: {node: '>= 14'} - human-signals@2.1.0: - resolution: {integrity: sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==} - engines: {node: '>=10.17.0'} - human-signals@5.0.0: resolution: {integrity: sha512-AXcZb6vzzrFAUE61HnN4mpLqd/cSIwNQjtNWR0euPm6y0iqx3G4gOXaIDdtdDwZmhwe82LA6+zinmW4UBWVePQ==} engines: {node: '>=16.17.0'} @@ -2120,10 +2076,6 @@ packages: import-meta-resolve@4.2.0: resolution: {integrity: sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==} - indent-string@4.0.0: - resolution: {integrity: sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==} - engines: {node: '>=8'} - indent-string@5.0.0: resolution: {integrity: sha512-m6FAo/spmsW2Ab2fU35JTYwtOKa2yAwXSwgjSv1TJzh4Mh7mC3lzAOVLBprb72XsTrgkEIsl7YrFNAiDiRhIGg==} engines: {node: '>=12'} @@ -2174,10 +2126,6 @@ packages: resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==} engines: {node: '>=12'} - is-stream@2.0.1: - resolution: {integrity: sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==} - engines: {node: '>=8'} - is-stream@3.0.0: resolution: {integrity: sha512-LnQR4bZ9IADDRSkvpqMGvt/tEJWclzklNgSw48V5EAaAeDd6qGvN8ei6k5p0tvxSR171VmGyHuTiAOfxAbr8kA==} engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0} @@ -2351,9 +2299,6 @@ packages: lodash.uniqby@4.7.0: resolution: {integrity: sha512-e/zcLx6CSbmaEgFHCA7BnoQKyCtKMxnuWrJygbwPs/AIn+IMKl66L8/s+wBUn5LRw2pZx3bUHibiV1b6aTWIww==} - lodash@4.18.1: - resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==} - longest-streak@3.1.0: resolution: {integrity: sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==} @@ -2536,10 +2481,6 @@ packages: engines: {node: '>=16'} hasBin: true - mimic-fn@2.1.0: - resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==} - engines: {node: '>=6'} - mimic-fn@4.0.0: resolution: {integrity: sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw==} engines: {node: '>=12'} @@ -2610,10 +2551,6 @@ packages: resolution: {integrity: sha512-z9nC87iaZXXySbWWtTHfCFJyFvKaUAW6lODhikG7ILSbVgmwuFjUqkgnheHvAUcGedO29e2QGBRXMUD64aurqQ==} engines: {node: '>=20'} - npm-run-path@4.0.1: - resolution: {integrity: sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==} - engines: {node: '>=8'} - npm-run-path@5.3.0: resolution: {integrity: sha512-ppwTtiJZq0O/ai0z7yfudtBpWIoxM8yE6nHi1X47eFR2EWORqfbu6CnPlNsjeN683eT0qG6H/Pyf9fCcvjnnnQ==} engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0} @@ -2709,10 +2646,6 @@ packages: ohash@2.0.11: resolution: {integrity: sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==} - onetime@5.1.2: - resolution: {integrity: sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==} - engines: {node: '>=6'} - onetime@6.0.0: resolution: {integrity: sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==} engines: {node: '>=12'} @@ -2778,10 +2711,6 @@ packages: resolution: {integrity: sha512-aNZ+VfjobsWryoiPnEApGGmf5WmNsCo9xu8dfaYamG5qaLP7ClhLN6NgsFe6SwJ2UbLEBK5dv9x8Mn5+RVhMWQ==} engines: {node: '>=18'} - p-reduce@2.1.0: - resolution: {integrity: sha512-2USApvnsutq8uoxZBGbbWM0JIYLiEMJ9RlaN7fAzVNb9OZN0SHjjTTfIcb667XynS5Y1VhwDJVDa72TnPzAYWw==} - engines: {node: '>=8'} - p-reduce@3.0.0: resolution: {integrity: sha512-xsrIUgI0Kn6iyDYm9StOpOeK29XM1aboGji26+QEortiFST1hGZaUQOLhtEbqHErPpGW/aSz6allwK2qcptp0Q==} engines: {node: '>=12'} @@ -3062,9 +2991,6 @@ packages: shiki@3.23.0: resolution: {integrity: sha512-55Dj73uq9ZXL5zyeRPzHQsK7Nbyt6Y10k5s7OjuFZGMhpp4r/rsLBH0o/0fstIzX1Lep9VxefWljK/SKCzygIA==} - signal-exit@3.0.7: - resolution: {integrity: sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==} - signal-exit@4.1.0: resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==} engines: {node: '>=14'} @@ -3149,10 +3075,6 @@ packages: resolution: {integrity: sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==} engines: {node: '>=4'} - strip-final-newline@2.0.0: - resolution: {integrity: sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==} - engines: {node: '>=6'} - strip-final-newline@3.0.0: resolution: {integrity: sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw==} engines: {node: '>=12'} @@ -4346,14 +4268,6 @@ snapshots: '@sec-ant/readable-stream@0.4.1': {} - '@semantic-release/changelog@6.0.3(semantic-release@25.0.3(typescript@6.0.2))': - dependencies: - '@semantic-release/error': 3.0.0 - aggregate-error: 3.1.0 - fs-extra: 11.3.4 - lodash: 4.18.1 - semantic-release: 25.0.3(typescript@6.0.2) - '@semantic-release/commit-analyzer@13.0.1(semantic-release@25.0.3(typescript@6.0.2))': dependencies: conventional-changelog-angular: 8.3.1 @@ -4368,24 +4282,8 @@ snapshots: transitivePeerDependencies: - supports-color - '@semantic-release/error@3.0.0': {} - '@semantic-release/error@4.0.0': {} - '@semantic-release/git@10.0.1(semantic-release@25.0.3(typescript@6.0.2))': - dependencies: - '@semantic-release/error': 3.0.0 - aggregate-error: 3.1.0 - debug: 4.4.3 - dir-glob: 3.0.1 - execa: 5.1.1 - lodash: 4.18.1 - micromatch: 4.0.8 - p-reduce: 2.1.0 - semantic-release: 25.0.3(typescript@6.0.2) - transitivePeerDependencies: - - supports-color - '@semantic-release/github@12.0.6(semantic-release@25.0.3(typescript@6.0.2))': dependencies: '@octokit/core': 7.0.6 @@ -4795,11 +4693,6 @@ snapshots: agent-base@7.1.4: {} - aggregate-error@3.1.0: - dependencies: - clean-stack: 2.2.0 - indent-string: 4.0.0 - aggregate-error@5.0.0: dependencies: clean-stack: 5.3.0 @@ -5027,8 +4920,6 @@ snapshots: ci-info@4.4.0: {} - clean-stack@2.2.0: {} - clean-stack@5.3.0: dependencies: escape-string-regexp: 5.0.0 @@ -5315,18 +5206,6 @@ snapshots: eventemitter3@5.0.4: {} - execa@5.1.1: - dependencies: - cross-spawn: 7.0.6 - get-stream: 6.0.1 - human-signals: 2.1.0 - is-stream: 2.0.1 - merge-stream: 2.0.0 - npm-run-path: 4.0.1 - onetime: 5.1.2 - signal-exit: 3.0.7 - strip-final-newline: 2.0.0 - execa@8.0.1: dependencies: cross-spawn: 7.0.6 @@ -5600,8 +5479,6 @@ snapshots: transitivePeerDependencies: - supports-color - human-signals@2.1.0: {} - human-signals@5.0.0: {} human-signals@8.0.1: {} @@ -5620,8 +5497,6 @@ snapshots: import-meta-resolve@4.2.0: {} - indent-string@4.0.0: {} - indent-string@5.0.0: {} index-to-position@1.2.0: {} @@ -5653,8 +5528,6 @@ snapshots: is-plain-obj@4.1.0: {} - is-stream@2.0.1: {} - is-stream@3.0.0: {} is-stream@4.0.1: {} @@ -5782,8 +5655,6 @@ snapshots: lodash.uniqby@4.7.0: {} - lodash@4.18.1: {} - longest-streak@3.1.0: {} lru-cache@10.4.3: {} @@ -6151,8 +6022,6 @@ snapshots: mime@4.1.0: {} - mimic-fn@2.1.0: {} - mimic-fn@4.0.0: {} minimist@1.2.8: {} @@ -6214,10 +6083,6 @@ snapshots: normalize-url@9.0.0: {} - npm-run-path@4.0.1: - dependencies: - path-key: 3.1.1 - npm-run-path@5.3.0: dependencies: path-key: 4.0.0 @@ -6245,10 +6110,6 @@ snapshots: ohash@2.0.11: {} - onetime@5.1.2: - dependencies: - mimic-fn: 2.1.0 - onetime@6.0.0: dependencies: mimic-fn: 4.0.0 @@ -6348,8 +6209,6 @@ snapshots: eventemitter3: 5.0.4 p-timeout: 6.1.4 - p-reduce@2.1.0: {} - p-reduce@3.0.0: {} p-timeout@6.1.4: {} @@ -6745,8 +6604,6 @@ snapshots: '@shikijs/vscode-textmate': 10.0.2 '@types/hast': 3.0.4 - signal-exit@3.0.7: {} - signal-exit@4.1.0: {} signale@1.4.0: @@ -6833,8 +6690,6 @@ snapshots: strip-bom@3.0.0: {} - strip-final-newline@2.0.0: {} - strip-final-newline@3.0.0: {} strip-final-newline@4.0.0: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index c7bfb37..15adc90 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -3,8 +3,6 @@ packages: - package catalog: - "@semantic-release/changelog": ^6.0.3 - "@semantic-release/git": ^10.0.1 "@types/node": ^24 conventional-changelog-conventionalcommits: ^9.3.1 semantic-release: ^25.0.3 From 278430a6298e5d7824f7de5fa8040667a49cd3cd Mon Sep 17 00:00:00 2001 From: Klink <85062+dogmar@users.noreply.github.com> Date: Wed, 8 Apr 2026 15:24:29 -0700 Subject: [PATCH 3/6] fix: skip npm lifecycle scripts during semantic-release publish prepublishOnly triggers vp run build which spawns a child process that loses the OIDC auth token. The build already runs explicitly in the workflow, so lifecycle scripts are redundant. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 255b821..118ee98 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,3 +30,4 @@ jobs: - run: npx semantic-release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NPM_CONFIG_IGNORE_SCRIPTS: true From e33fcad89a96ba458d2aba924288a5c05f0d6471 Mon Sep 17 00:00:00 2001 From: Klink <85062+dogmar@users.noreply.github.com> Date: Wed, 8 Apr 2026 15:29:52 -0700 Subject: [PATCH 4/6] fix: pass provenance flag to npm via env var for OIDC auth @semantic-release/npm verifies OIDC works but doesn't pass --provenance to npm publish. Setting NPM_CONFIG_PROVENANCE=true tells npm to handle OIDC auth directly during publish. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 118ee98..e9d8631 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,4 +30,4 @@ jobs: - run: npx semantic-release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_CONFIG_IGNORE_SCRIPTS: true + NPM_CONFIG_PROVENANCE: true From 81099538ed626ed91ae1ede0b447bb505035fe44 Mon Sep 17 00:00:00 2001 From: Klink <85062+dogmar@users.noreply.github.com> Date: Wed, 8 Apr 2026 15:32:06 -0700 Subject: [PATCH 5/6] fix: add debug logging for npm OIDC auth investigation Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/release.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e9d8631..503dd4e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -27,7 +27,20 @@ jobs: - run: vp run @klinking/squircle#build + - name: Debug npm auth context + run: | + echo "=== npm config ===" + npm config list + echo "=== OIDC env vars ===" + echo "ACTIONS_ID_TOKEN_REQUEST_URL set: ${{ env.ACTIONS_ID_TOKEN_REQUEST_URL != '' }}" + echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN set: ${{ env.ACTIONS_ID_TOKEN_REQUEST_TOKEN != '' }}" + echo "=== .npmrc files ===" + cat ~/.npmrc 2>/dev/null || echo "no ~/.npmrc" + cat .npmrc 2>/dev/null || echo "no ./.npmrc" + cat package/.npmrc 2>/dev/null || echo "no package/.npmrc" + - run: npx semantic-release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} NPM_CONFIG_PROVENANCE: true + DEBUG: "semantic-release:*,@semantic-release/npm:*" From 8af5ae60503bd3bce8489c3f2bf2c4eade3f9e70 Mon Sep 17 00:00:00 2001 From: Klink <85062+dogmar@users.noreply.github.com> Date: Wed, 8 Apr 2026 15:35:17 -0700 Subject: [PATCH 6/6] fix: add setup-node with registry-url for npm OIDC auth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The npm trusted publishing OIDC flow requires the registry URL to be configured via actions/setup-node. This creates the .npmrc that enables npm to perform OIDC token exchange during publish. Per npm docs, no --provenance flag or NPM_TOKEN is needed when trusted publishing is configured — npm handles auth automatically. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/release.yml | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 503dd4e..c6a61f7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,24 +23,14 @@ jobs: node-version: "22" cache: true + - uses: actions/setup-node@v4 + with: + registry-url: "https://registry.npmjs.org" + - run: vp install - run: vp run @klinking/squircle#build - - name: Debug npm auth context - run: | - echo "=== npm config ===" - npm config list - echo "=== OIDC env vars ===" - echo "ACTIONS_ID_TOKEN_REQUEST_URL set: ${{ env.ACTIONS_ID_TOKEN_REQUEST_URL != '' }}" - echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN set: ${{ env.ACTIONS_ID_TOKEN_REQUEST_TOKEN != '' }}" - echo "=== .npmrc files ===" - cat ~/.npmrc 2>/dev/null || echo "no ~/.npmrc" - cat .npmrc 2>/dev/null || echo "no ./.npmrc" - cat package/.npmrc 2>/dev/null || echo "no package/.npmrc" - - run: npx semantic-release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_CONFIG_PROVENANCE: true - DEBUG: "semantic-release:*,@semantic-release/npm:*"