fix(ci): add --provenance flag for npm OIDC publish - #249
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
Why
After PR #247 dropped
registry-urlfrom setup-node, the SDK release got further but still failed:npm didn't attempt OIDC despite
id-token: writebeing set. The--provenanceflag is the explicit opt-in for OIDC publishing from npm CLI 9.5+ — without it npm only generates provenance attestations opportunistically, not as the auth path.Change
Applied to both the real publish and the dry-run step.
Expected behavior after merge
--provenanceand the GitHub Actions OIDC env vars@protolabsai/sdk@protolabsai/sdk@0.3.0with verifiable provenanceIf this also fails
The remaining likely cause would be the trusted publisher configuration on the npm side not matching the workflow ref claim. Will surface specific OIDC verification messages in the next run's logs.