fix(ci): npm OIDC trusted publishing in release.yml (unblocks 0.0.4)#50
Conversation
The auto-release failed with npm E404-on-PUT (npm's unauthorized symptom): the repo switched to OIDC trusted publishing (#26) but release.yml was never converted — it still passed the retired NPM_TOKEN and lacked id-token: write. Align the Publish step with the proven force-release.yml config: - job permissions: id-token: write (+ contents/PRs for the changesets PR) - setup-node@v4 / Node 22, NPM_CONFIG_PROVENANCE: true - drop NPM_TOKEN / NODE_AUTH_TOKEN
|
There was a problem hiding this comment.
Pull request overview
Updates the release.yml GitHub Actions workflow to publish to npm using OIDC trusted publishing (matching the already-working force-release.yml), unblocking automated publishing for @taskade/mcp-server@0.0.4.
Changes:
- Adds explicit job
permissionsneeded for OIDC (id-token: write) and Changesets PR creation (contents: write,pull-requests: write). - Updates
actions/setup-nodetov4and Node.js to22. - Removes legacy npm token env vars and enables provenance via
NPM_CONFIG_PROVENANCE: true.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| id-token: write | ||
| contents: write | ||
| pull-requests: write |
What broke
Release run 27230473355 failed publishing
0.0.4:npm error 404 Not Found - PUT …on both packages — npm's unauthorized symptom for scoped packages.Root cause
#26 switched npm to OIDC trusted publishing ("no more tokens"), and
0.0.3actually shipped viaforce-release.yml(manual dispatch), which hasid-token: write+NPM_CONFIG_PROVENANCE: trueand no token env. The automaticrelease.ymlwas never converted — it still passed the retiredNPM_TOKENand had nopermissionsblock, so OIDC could not mint a token → 404 on PUT.Fix (mirror the proven force-release.yml config)
permissionsid-token: write,contents: write,pull-requests: writeNPM_TOKEN+NODE_AUTH_TOKENNPM_CONFIG_PROVENANCE: true(OIDC, no tokens)Zero-regression
hasChangesets == 'false'→ Publish runs → 0.0.4 ships. If anything fails,force-release.ymlremains the manual fallback.