From bd9dd5d509da36885a6dd0ebb0466ff6fe46c372 Mon Sep 17 00:00:00 2001 From: Ray Walker Date: Sun, 26 Jul 2026 10:17:11 +1000 Subject: [PATCH 1/2] =?UTF-8?q?fix(release):=20core-wasm=20publish=20must?= =?UTF-8?q?=20use=20pnpm/OIDC=20=E2=80=94=20npm=2010=20+=20phantom=20NPM?= =?UTF-8?q?=5FTOKEN=20dies=20ENEEDAUTH=20(LAB-831)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The repo has no NPM_TOKEN secret (auth moved to npm OIDC trusted publishing — that is how publish-cachekit succeeds via pnpm). The core-wasm job added in #85 wrote an empty token to an ~/.npmrc that setup-node's NPM_CONFIG_USERCONFIG shadows anyway, then ran Node 22's bundled npm 10, which has no OIDC support: recovery dispatch run 30180731767 packed fine and died ENEEDAUTH at publish. Align the job with the proven publish-cachekit invocation (pnpm 11 does OIDC). Note: first-ever publish of a NEW package also needs an org-level trusted publisher on npmjs.com — package-level config requires the package to exist (npm/cli#8544). --- .github/workflows/release-please.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 1dd4f31..5ad52cc 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -166,13 +166,13 @@ jobs: - name: Build wasm artifact run: pnpm --filter @cachekit-io/cachekit-core-wasm build:wasm - - name: Configure npm auth - run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc - env: - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - + # Auth is npm OIDC trusted publishing — the repo has NO NPM_TOKEN secret + # (the old token-auth steps resolved an empty token and died ENEEDAUTH, + # LAB-831). Node 22's bundled npm 10 cannot do OIDC; pnpm 11 can, and + # this is the exact invocation the proven publish-cachekit job uses. + # First-time creation of a new package additionally needs an ORG-level + # trusted publisher on npmjs.com (package-level config requires the + # package to already exist — npm/cli#8544). - name: Publish to npm working-directory: packages/cachekit-core-wasm - run: npm publish --access public --provenance - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + run: pnpm publish --access public --provenance --no-git-checks From 62d44ae785a90590f07315afaae6e90c7c576ee4 Mon Sep 17 00:00:00 2001 From: Ray Walker Date: Sun, 26 Jul 2026 11:53:10 +1000 Subject: [PATCH 2/2] Trigger CI re-run Co-authored-by: multica-agent