fix(ci): fall back to static-token publish for sdk-release - #253
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
Why
OIDC trusted publishing (PRs #245, #247, #249, #251) didn't engage. npm 11.15.0 returned
ENEEDAUTHevery time despite all preconditions:id-token: writepermission on the job ✓--provenanceflag on the publish ✓NODE_AUTH_TOKENor.npmrcauth set ✓No diagnostic messages about OIDC negotiation appeared in the workflow logs. npm just skipped straight from packing to
ENEEDAUTHlike the OIDC code path never activated. Worth a separate debugging session — possibly a trusted-publisher config mismatch (workflow_ref claim vs what's stored in the npm config), or a non-obvious npm CLI behavior gap.The package's publishing-access setting has been updated to allow granular access tokens with bypass-2fa, so the static-token path that worked for v0.2.0 will work again for v0.3.0.
Changes
Revert the workflow to the pre-OIDC shape:
id-token: writefrompermissions:(onlycontents: writeneeded for the GitHub release step)registry-url: https://registry.npmjs.orgonsetup-node(writes.npmrcwith_authTokenplaceholder for the publish step's env to substitute)npm publish --access publicusingNODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}--provenanceflag (not useful without OIDC, just generates an unused attestation)This is functionally identical to the shape from PR #243 (the original token-name fix).
Validation
After merge: re-trigger SDK Release on
dev. Expected to publish@protolabsai/sdk@0.3.0successfully via the granular token.Follow-up
OIDC remains the right long-term path. When you next have ~30 minutes for it, the things to investigate:
$ACTIONS_ID_TOKEN_REQUEST_URL(existence, not value) to confirm the OIDC env vars actually reach the publish stephttps://registry.npmjs.org/-/npm/v1/oidc/exchangeto see the registry's actual responseprotoLabsAI/protoCLIrepo +sdk-release.ymlfilename exactly