GeezerVison is showing github.com — ci(release): publish npm from release.yml, not publish-npm.yml by mikolalysenko · Pull Request #1483 · SocketDev/socket-patch
Conversation
Why
The 5.0.0 release's npm leg failed with E401 Unable to authenticate (run 38311868646). Every npm package's trusted publisher is registered against release.yml, but the leg ran as publish-npm.yml. npm allows only one publisher per package and matches the top-level workflow filename. Nothing was staged.
What
- The npm publish runs inline again as
release.yml's npm-publish job, with the same steps as publish-npm.yml: asset download + SHA256SUMS check (digest-pinned on a full run), stage platform packages, then the main package, then the approval summary. It has id-token: write and a per-version concurrency group.
publish-npm.yml is deleted.- New
npm-retry-version input on Release. It skips the version gate, build, tag, GitHub release and crates.io jobs and re-stages npm from the existing v<version> release, with an integrity-only SHA256SUMS check. It still runs as release.yml, so no trusted-publisher change is needed.
- crates.io is unchanged: still dispatched through
publish-cargo.yml (its publisher is being added for both crates).
docs/releasing.md, the release.yml header, the dispatch-publish.sh comments and one ci.yml comment are updated to match.
After merge
Retry 5.0.0's npm publish: Actions → Release → Run workflow on main with npm-retry-version: 5.0.0, then approve the staged packages with 2FA, platform packages first.
actionlint on release.yml and shellcheck on dispatch-publish.sh pass.
🤖 Generated with Claude Code
Note Medium Risk
Changes the release pipeline and npm OIDC workflow identity; mistakes could block or mis-stage npm publishes, but behavior mirrors the deleted workflow and includes retry/idempotency guards.
Overview
Moves npm publishing back into release.yml so OIDC trusted publishing matches npm’s single publisher per package (registered on release.yml, not a separate workflow). The standalone publish-npm.yml is removed; its steps now run in the inline npm-publish job (release asset download, SHA256SUMS pinning on full releases, stage platform + main packages, approval summary), with id-token: write and per-version concurrency.
Adds npm-retry-version on Release to skip build/tag/GitHub release/crates.io and re-stage npm from an existing v<version> release (integrity-only checksum on retry). crates.io is unchanged—still dispatched via publish-cargo.yml. Docs (releasing.md), workflow headers, dispatch-publish.sh comments, and a CI comment are updated accordingly.
Reviewed by Cursor Bugbot for commit b8ccf1f. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Every socket-patch npm package's trusted publisher is registered against
release.yml, and npm allows only one publisher per package. The 5.0.0
release dispatched publish-npm.yml, whose OIDC token named that file, so
npm rejected it with E401 before staging anything.
Move the npm leg back inline as release.yml's npm-publish job (same steps
as publish-npm.yml) and delete publish-npm.yml, so the existing
registration keeps working. Add an `npm-retry-version` input that skips
the version gate, build, tag, GitHub release and crates.io jobs and
re-stages npm from an existing release's assets; this retries 5.0.0 now
and replaces the manual Publish npm dispatch. crates.io stays dispatched
through publish-cargo.yml, since crates.io allows several publishers per
crate.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Uh oh!
There was an error while loading. Please reload this page.
|
Final reviewer: re-enqueued once. The merge group's coverage job failed in patch::redirect::upstream::npm::tests::project_registry_decides_a_mirrors_tarball_urls (npm.rs:4072). That test is on main (added in #1466) and isn't touched by this PR. It reads SOCKET_NPM_REGISTRY, which the bun_lockb.rs tests set in the same lib test binary, so the two race when they run in parallel. It passes in isolation on main. The owner has been told; a fix belongs in its own PR.
Generated by Claude Code
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
Superseded by #1485, the combined 5.0.1 release PR, which cherry-picks this commit. 5.0.0 won't be retried on npm; 5.0.1 ships with this fix.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|