chore(ci): migrate CUA npm packages to trusted publishing - #9836
Merged
Conversation
Collaborator
|
✅ Qwen Triage finished — CI landed green on ✅ Qwen Triage 已完成 —— |
Collaborator
|
Thanks for the PR! Template looks good ✓ Problem: real and deterministic, verified independently via the API — the repo's 23 Actions secrets no longer include Direction: aligned — this completes the Trusted Publishing migration that shipped with #9552 (CHANGELOG: "chore(ci): Drop NPM_TOKEN in favor of npm Trusted Publishing"). The publish job's remaining shape ( Size: not applicable — 9 deletions in a single workflow file, no core paths touched. Approach: minimal — remove the gate step that can no longer succeed and the dead Risk: no elevated risk signals. One residual external prerequisite, correctly flagged in the PR's own test plan: Moving on to code review. 🔍 中文说明感谢贡献！ 模板完整 ✓ 问题：真实且确定性，已通过 API 独立验证——仓库的 23 个 Actions secrets 中已无 方向：对齐——补全 #9552 已上线的 Trusted Publishing 迁移（CHANGELOG："chore(ci): Drop NPM_TOKEN in favor of npm Trusted Publishing"）。发布任务保留的形态（ 规模：不适用——单个工作流文件删除 9 行，未触及核心路径。 方案：最小改动——删除已不可能通过的门禁步骤和失效的 风险：无高风险信号。剩余一个外部前置条件，PR 自己的测试计划已正确指出： 进入代码审查 🔍 — Qwen Code · qwen3.8-max Reviewed at |
Collaborator
Code reviewIndependent baseline first: given "the What I verified statically at the head commit (no PR code was executed):
No findings — this is the minimal correct diff. Test evidence — the PR's own CIFinal CI results for
One row per check name (latest run); skipped checks omitted; failures sort first. / 每个检查名一行（取最新一次运行），省略 skipped，失败项排在最前。 Fetched once at review time, no polling: the ubuntu suite was still running (this repo's full suite takes ~30 minutes), the macos/windows Test jobs and the CLI integration job were skipped for this workflow-only change, and the always-on checks (secret scan, CVE audit, desktop builds) were green on the head commit. The Sandboxed lanes: neither 中文说明代码审查：先独立给出基线——已知 在 head 提交上静态验证（未运行 PR 代码）： 测试证据：引自 PR 自己的 CI（上方表格）——审查时 ubuntu 套件仍在运行（约 30 分钟，不轮询），macos/windows 测试与 CLI 集成因纯工作流改动而跳过，常驻检查（密钥扫描、CVE 审计、桌面构建）已在 head 提交上通过。CI 落定后由 finalize 任务就地更新表格。 沙箱验证通道： — Qwen Code · qwen3.8-max Reviewed at |
Collaborator
|
Confidence: 5/5 — verified end to end: the secret is gone from the repo (so the old gate can only fail), the remaining job shape is the exact Trusted Publishing pattern the sibling pipelines already publish with, and the diff is the minimum possible. Stepping back: this is the closing bracket on the #9552 migration — the same author who did the migration removing the last dead reference to a deleted secret, with the one genuinely external prerequisite (the npm-side binding for a never-published package) flagged in the PR's own test plan rather than hidden. If I had to maintain this in six months there would be nothing to curse: nine deleted lines, zero added. The only thing CI cannot prove is the publish-time authentication itself, which by design first happens at the first real release — that residual risk is named, not ignored. Verdict: approve. One workflow run (the ubuntu Test suite) was still in flight at review time, so approval is deferred until CI lands green on the reviewed commit — the finalize step performs it automatically once every check completes. 中文说明置信度：5/5 —— 端到端验证完毕：secret 已从仓库删除（旧门禁必然失败），保留的任务形态正是兄弟发布流水线已在使用的 Trusted Publishing 模式，diff 也是最小可能形态。 总体来看：这是 #9552 迁移的收尾——由当初做迁移的同一位作者删除已删 secret 的最后一处死引用，唯一真正的外部前置条件（npm 侧对从未发布过的包的绑定）已在 PR 自己的测试计划中明示而非隐藏。六个月后维护它没有任何负担：删除 9 行，新增 0 行。CI 唯一无法证明的是发布时刻的鉴权本身，按设计它只在首次真实发布时发生——该残留风险已被明确命名，而非忽视。 结论：批准。审查时 ubuntu 测试套件仍在运行，因此批准推迟到该提交的 CI 全绿后，由 finalize 步骤在每个检查完成时自动执行。 — Qwen Code · qwen3.8-max Reviewed at |
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
qwen-code-ci-bot
previously approved these changes
Aug 24, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, looks ready to ship — CI landed green after the review. ✅
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed — no blockers. Suggestions are inline.
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/cd-cua-driver.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
— qwen3.8-max via Qwen Code /review (v0.22.0)
Collaborator
Author
|
Changed: added the CUA SDK publish workflow to the existing Trusted Publishing pin test and updated the PR body to match the current template. Verified: Prettier check and git diff --check passed locally. Focused Vitest could not start in this isolated worktree because local dependencies cannot resolve vitest/config, so GitHub CI should verify the script test. Pending: post-push CI/review on 299847e. |
Collaborator
Author
|
Blocking on the npm-side bootstrap: |
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed. Suggestions are inline.
Not reviewed: reverse audit — stopped before round 4 by the review time budget.
中文说明
仅完成部分审查，审查缺口已披露。 建议见行内评论。
未审查：反向审计——评审时间预算不足，未能开始第 4 轮。
— qwen3.8-max via Qwen Code /review (v0.22.0)
Collaborator
Author
|
Closeout for the CUA SDK Trusted Publishing test gap: Changed:
Verified:
Not fully verified locally:
|
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed.
Unresolved, please confirm:
- [Critical] npm-side bootstrap blocker (issue comment 5390822076 by @yiliang114, referencing cd-cua-driver.yml): the initial publication condition is now confirmed (@qwen-code/cua-sdk@0.20.0 is on the registry), but whether the Trusted Publishing bindi…
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/cd-cua-driver.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
Mechanism health: this round did not close cleanly, so it withholds the incremental anchor — and the round it recovered had none either, so the next review re-reads the whole diff and will keep doing so until a round's marker carries an anchor again. (Stated, not acted on — this changes nothing about what the round posts.)
中文说明
已审查。
未决，请确认：共 1 条（原文未翻译，列表见上方英文部分）。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/cd-cua-driver.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
机制健康：本轮未能干净收尾，因而扣留了增量锚点，而它恢复到的那一轮也没有锚点，因此下一次评审将重读整个 diff——并会一直如此，直到某一轮的标记重新带上锚点。（仅陈述，不据此行动——这不改变本轮发布的任何内容。）
— qwen3.8-max via Qwen Code /review (v0.22.0)
yiliang114
enabled auto-merge
August 26, 2026 04:54
Collaborator
Author
|
The npm-side blocker for this PR is now cleared:
This supersedes my earlier hold comment. The CUA SDK publish path can now remove its token fallback and use OIDC-only publishing. After the latest merge from @qwen-code /review |
Collaborator
|
Qwen Code review timed out. Qwen review timed out after 5400 seconds (of the 90-minute budget). For large PRs, retry with a longer timeout by commenting: |
chiga0
previously approved these changes
Aug 26, 2026
chiga0
left a comment
chiga0
left a comment
Collaborator
There was a problem hiding this comment.
No blocking findings.
Scope: .github/workflows/cd-cua-driver.yml publish-sdk job and scripts/tests/package-scripts.test.js. The node-repl publish job retaining NPM_TOKEN is intentional and out of scope — not reviewed.
Checked:
- Workflow at head:
id-token: 'write'at job level (line 793),name: 'production-release'environment (line 789),npm publish "$TARBALL" --provenancepresent (line 875),NODE_AUTH_TOKEN/NPM_TOKENfully absent frompublish-sdkafter diff — confirmed against head SHA. - Pattern parity:
release-sdk.ymluses the same tokenless auth chain (id-token: write+production-release+npm publish --provenance, noNODE_AUTH_TOKEN) and is the established working baseline. packages/cua-driver/typescript/package.json:repository.url = git+https://github.com/QwenLM/qwen-code.git— matches the second-loop assertion.- Test assertions in
package-scripts.test.js: all four Trusted Publishing requirements now pinned for thepublish-sdkjob —id-token: 'write',--provenance,name: 'production-release', andrepository.urlforpackages/cua-driver/typescript.
CI at review time:
Test (ubuntu-latest, Node 22.x): in_progress — not a reason to withhold approval; no build failures in available logs.Test (macos-latest, Node 22.x),Test (windows-latest, Node 22.x),Integration Tests (CLI, No Sandbox): SKIPPED — this PR changes only workflow YAML and a test file; the skipped jobs cover execution paths not affected here.Secret scan (TruffleHog),Dependency CVE audit: green.
Cross-check vs. prior bot reviews (rounds 1–2):
The CI bot filed four gap findings on earlier commits — missing id-token, --provenance, production-release, and packages/cua-driver/typescript in the repository loop. All four are addressed at current HEAD (1b128188): confirmed by reading the diff and the workflow file at this SHA.
Unreviewed dimensions: Working tree unavailable — execution rungs 1–3 not run. Ubuntu CI job was in_progress at time of review; no failure logs available.
Reviewed with AI assistance.
yiliang114
changed the title
Collaborator
Author
|
Expanded the existing fix to cover the newly added
Verified the focused contract test, Prettier, and @qwen-code /review |
chiga0
approved these changes
Aug 26, 2026
chiga0
left a comment
chiga0
left a comment
Collaborator
There was a problem hiding this comment.
No blocking findings.
Prior round (R1, head 1b128188, dismissed): filed clean on publish-sdk; publish-node-repl was out of scope. At current head both jobs are addressed — prior findings remain fixed.
Checked at head c26120eb:
publish-sdk(lines 780–905):id-token: 'write'present (line 793),name: 'production-release'environment (line 789),npm publish "$TARBALL" --provenancepresent (line 884), noNODE_AUTH_TOKENorNPM_TOKENremaining in either the removed gate step or the publish step. OIDC chain complete.publish-node-repl(lines 907–989): same structure confirmed —id-token: 'write'(line 923),name: 'production-release'(line 918),npm publish "$TARBALL" --provenance(line 968),NODE_AUTH_TOKEN/NPM_TOKENfully absent after diff.- Test additions in
package-scripts.test.js: both CUA jobs now in the trusted-publishing requirements loop; four assertions added (id-token: 'write',--provenance,name: 'production-release', publish-step ordering) apply to all six entries in the loop and match all six workflows.packages/cua-driver/typescriptandpackages/node-repladded to the repository-URL second loop — bothpackage.jsonfiles carrygit+https://github.com/QwenLM/qwen-code.git, satisfying the.replace(/^git\\+/, "")assertion.
Cross-check vs. prior bot suggestions:
- Round-1 bot finding (missing CUA jobs in trusted-publishing test): addressed.
- Round-2 bot findings (
id-token,--provenance,production-release,packages/cua-driver/typescript): all addressed;packages/node-replalso added for parity withpublish-node-repl.
CI at review time:
Test (ubuntu-latest, Node 22.x): pending — this is the job that would runpackage-scripts.test.js; no failures in available logs.authorize: pending.Test (macos-latest, Node 22.x),Test (windows-latest, Node 22.x),Integration Tests (CLI, No Sandbox),precheck-pr,review-config: SKIPPING — expected; this PR changes only workflow YAML and one test file.Secret scan (TruffleHog),Dependency CVE audit,Desktop Shell (ubuntu/windows): green.
Unreviewed dimensions: Working tree unavailable — execution rungs 1–3 not run. Ubuntu test job was pending at time of review.
Reviewed with AI assistance.
Collaborator
|
Released in v0.22.2. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Removes the stale
NPM_TOKENgate and environment variable from both npm publish jobs in the CUA release pipeline. The CUA SDK and Node REPL MCP packages now publish exclusively through npm Trusted Publishing, while the existing contract test pins npm 11,id-token: write, theproduction-releaseenvironment, provenance, and repository metadata for both packages.Why it's needed
The long-lived
NPM_TOKENsecret was deleted during the repository-wide Trusted Publishing migration, but these two jobs still required it. Without this change, each real publish aborts before reaching npm even though the jobs already have the complete OIDC publishing setup.Both npm-side prerequisites are now complete:
@qwen-code/cua-sdk@0.20.0and@qwen-code/node-repl-mcp@0.1.0exist, and each package has a Trusted Publisher binding forQwenLM/qwen-code, the CUA release workflow, and theproduction-releaseenvironment.Reviewer Test Plan
How to verify
NPM_TOKENor setsNODE_AUTH_TOKEN.id-token: write, npm 11.19.0, theproduction-releaseenvironment, andnpm publish --provenance.Evidence (Before & After)
N/A (CI workflow change, not user-visible)
Tested on
Focused Trusted Publishing contract test, Prettier check, and
git diff --checkpass locally. The full test file also passed the changed contract test; one unrelated prepare-script case exceeded its existing 5-second timeout in the shared-dependency worktree.Risk & Scope
Linked Issues
References #9552.