fix(ci): drop registry-url so OIDC publish isn't shadowed by placeholder token - #247
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
Why
PR #245 set up OIDC trusted publishing for
@protolabsai/sdkbut the publish step still failed with a 404. Trace from the run log:actions/setup-nodewithregistry-url:set writes an.npmrcfile and exportsNODE_AUTH_TOKEN=XXXXX-XXXXX-XXXXX-XXXXX(a literal placeholder string) — expecting the publish step to override it with a real secret via a step-levelenv:block. We removed the env block in #245 to enable OIDC, so npm now authenticates with the literal placeholder and the registry returns 404 before OIDC ever kicks in.Fix
Remove
registry-url:from the setup-node step entirely. npm defaults tohttps://registry.npmjs.orgwithout it, and the OIDC publish doesn't need anything in.npmrc— it discovers the registry's auth via the GitHub OIDC token exchange.Validation
After merge, re-trigger the SDK release. Expected behavior:
npm publishruns withoutNODE_AUTH_TOKENsetACTIONS_ID_TOKEN_REQUEST_*env vars (fromid-token: write)@protolabsai/sdk@0.3.0with provenance attestationOut of scope
The
NPM_PUBLISH_TOKEN/NPM_TOKENorg secrets still exist but are unused by this workflow now. Cleanup is a separate concern — leaving them in place gives us a rollback escape hatch if OIDC has unforeseen issues.