From 49335e2ab1bee3e813bb4cf08970b9ec7f6b4e4f Mon Sep 17 00:00:00 2001 From: yiliang114 Date: Mon, 24 Aug 2026 10:33:39 +0800 Subject: [PATCH 1/4] chore(ci): remove stale NPM_TOKEN references from cua-sdk publish --- .github/workflows/cd-cua-driver.yml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/.github/workflows/cd-cua-driver.yml b/.github/workflows/cd-cua-driver.yml index f443454ec7b..b37d9be244a 100644 --- a/.github/workflows/cd-cua-driver.yml +++ b/.github/workflows/cd-cua-driver.yml @@ -726,14 +726,6 @@ jobs: with: name: 'cua-sdk-npm-${{ needs.validate-version.outputs.version }}' path: '${{ runner.temp }}/cua-sdk-package' - - name: 'Require npm publishing token' - env: - NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}' - run: | - if [[ -z "$NODE_AUTH_TOKEN" ]]; then - echo '::error::production-release NPM_TOKEN is required for the first @qwen-code/cua-sdk publication' - exit 1 - fi - name: 'Clean-install against the published GitHub Release' env: QWEN_CUA_SDK_CACHE_DIR: '${{ runner.temp }}/public-release-cache' @@ -787,7 +779,6 @@ jobs: ' - name: 'Publish immutable SDK tarball' env: - NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}' VERSION: '${{ needs.validate-version.outputs.version }}' run: | set -euo pipefail From 299847e4d968c646c7ffd1ae80d86154ff3e6da2 Mon Sep 17 00:00:00 2001 From: yiliang114 Date: Mon, 24 Aug 2026 12:01:40 +0800 Subject: [PATCH 2/4] test(scripts): pin cua sdk trusted publishing workflow --- scripts/tests/package-scripts.test.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/tests/package-scripts.test.js b/scripts/tests/package-scripts.test.js index 0d302254005..fdbc3f65929 100644 --- a/scripts/tests/package-scripts.test.js +++ b/scripts/tests/package-scripts.test.js @@ -515,6 +515,11 @@ describe('package scripts', () => { 'release-sdk', 'Publish @qwen-code/sdk', ], + [ + '.github/workflows/cd-cua-driver.yml', + 'publish-sdk', + 'Publish immutable SDK tarball', + ], ['.github/workflows/cd-mobile-mcp.yml', 'build-and-publish', 'Publish'], ]) { const publishJob = getWorkflowJob(readWorkflow(workflowPath), jobName); From 2dd53824765652e8ede2d61f3d3e820c7bde6c1b Mon Sep 17 00:00:00 2001 From: yiliang114 Date: Mon, 24 Aug 2026 14:10:00 +0800 Subject: [PATCH 3/4] test(scripts): pin cua sdk publish auth contract --- scripts/tests/package-scripts.test.js | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/scripts/tests/package-scripts.test.js b/scripts/tests/package-scripts.test.js index fdbc3f65929..d0c80dcdb94 100644 --- a/scripts/tests/package-scripts.test.js +++ b/scripts/tests/package-scripts.test.js @@ -524,9 +524,13 @@ describe('package scripts', () => { ]) { const publishJob = getWorkflowJob(readWorkflow(workflowPath), jobName); const installStep = getWorkflowStep(publishJob, 'Install npm 11'); + const publishStep = getWorkflowStep(publishJob, publishStepName); expect(installStep).toContain('npm install --global npm@11.19.0'); + expect(publishJob).toContain("id-token: 'write'"); + expect(publishStep).toContain('--provenance'); + expect(publishJob).toContain("name: 'production-release'"); expect(publishJob.indexOf(installStep)).toBeLessThan( - publishJob.indexOf(getWorkflowStep(publishJob, publishStepName)), + publishJob.indexOf(publishStep), ); } @@ -541,6 +545,7 @@ describe('package scripts', () => { 'packages/channels/telegram', 'packages/channels/wecom', 'packages/channels/weixin', + 'packages/cua-driver/typescript', 'packages/mobile-mcp', 'packages/sdk-typescript', ]) { From c26120eb3e1b326fe3c2e82f6f7bfe18912a74f1 Mon Sep 17 00:00:00 2001 From: yiliang114 Date: Wed, 26 Aug 2026 17:11:22 +0800 Subject: [PATCH 4/4] chore(ci): migrate node repl publish to trusted publishing --- .github/workflows/cd-cua-driver.yml | 9 --------- scripts/tests/package-scripts.test.js | 6 ++++++ 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/.github/workflows/cd-cua-driver.yml b/.github/workflows/cd-cua-driver.yml index 1e7b08199e4..c8818ea8e9c 100644 --- a/.github/workflows/cd-cua-driver.yml +++ b/.github/workflows/cd-cua-driver.yml @@ -925,17 +925,8 @@ jobs: name: 'node-repl-mcp-npm-${{ needs.validate-version.outputs.node_repl_version }}' path: '${{ runner.temp }}/node-repl-package' - - name: 'Require npm publishing token' - env: - NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}' - run: | - if [[ -z "$NODE_AUTH_TOKEN" ]]; then - echo '::error::production-release NPM_TOKEN is required for the first @qwen-code/node-repl-mcp publication' - exit 1 - fi - name: 'Publish immutable Node REPL tarball' env: - NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}' VERSION: '${{ needs.validate-version.outputs.node_repl_version }}' run: | set -euo pipefail diff --git a/scripts/tests/package-scripts.test.js b/scripts/tests/package-scripts.test.js index 8de58719257..b0e8fd85b22 100644 --- a/scripts/tests/package-scripts.test.js +++ b/scripts/tests/package-scripts.test.js @@ -535,6 +535,11 @@ describe('package scripts', () => { 'publish-sdk', 'Publish immutable SDK tarball', ], + [ + '.github/workflows/cd-cua-driver.yml', + 'publish-node-repl', + 'Publish immutable Node REPL tarball', + ], ['.github/workflows/cd-mobile-mcp.yml', 'build-and-publish', 'Publish'], ]) { const publishJob = getWorkflowJob(readWorkflow(workflowPath), jobName); @@ -563,6 +568,7 @@ describe('package scripts', () => { 'packages/channels/weixin', 'packages/cua-driver/typescript', 'packages/mobile-mcp', + 'packages/node-repl', 'packages/sdk-typescript', ]) { const packageJson = JSON.parse(