ci: standardize CLI + SDK release on NPM_TOKEN auth (drop OIDC) - #290
Merged
Conversation
OIDC trusted publishing was attempted for both the CLI (#278/#280) and SDK (#283). On the CLI we proved the workflow side was fully correct (id-token present, npm 11.15, no token shadow, registry npmjs.org, trusted publisher configured) yet npm never engaged the exchange — straight to ENEEDAUTH from a feature branch and from main, no OIDC negotiation. Same wall as #255. OIDC is an opaque npm-side non-engagement we can't fix from the repo. Token auth, by contrast, has verifiable/fixable blockers: it only ever 404'd because the package's "Publishing access" was on "disallow tokens". With that flipped to "2FA or granular access token with bypass 2fa enabled" and NPM_TOKEN scoped to the @protoLabsAI org + package write, token publishing works (it's the same mechanism behind the interactive publishes that shipped 0.40–0.45). This pins both workflows to the same clean token shape: - release.yml: revert to NODE_AUTH_TOKEN + registry-url (undo the OIDC conversion that's currently on main but non-functional). - sdk-release.yml: drop id-token + --provenance, keep NODE_AUTH_TOKEN + registry-url. Supersedes #283. Publishing still depends on two one-time npm-side settings (documented for the team): package "Publishing access" saved to allow bypass-2fa tokens, and NPM_TOKEN being a granular token with org + package write + bypass-2fa. Until verified, interactive publish remains the fallback. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
3 tasks
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
WalkthroughTwo GitHub Actions release workflows are updated: Changesnpm publish authentication migration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
mabry1985
commented
May 25, 2026
mabry1985
left a comment
mabry1985
left a comment
Member
Author
There was a problem hiding this comment.
QA Audit — PR #290 | ci: standardize CLI + SDK release on NPM_TOKEN auth (drop OIDC)
VERDICT: WARN
CI Status
- CodeQL: in_progress
- Lint: in_progress
Diff Review
PR rolls back OIDC trusted publishing in favor of token auth across two workflow files. For release.yml (CLI): drops id-token: write, restores registry-url + NODE_AUTH_TOKEN, removes the npm install -g npm@latest upgrade step. For sdk-release.yml (SDK): drops id-token: write and --provenance from both publish and dry-run steps, adds explicit NODE_AUTH_TOKEN env. Changes are surgical and consistent — both workflows now share the same auth shape.
Observations
release.yml:69: Comment references #255 (OIDC silent failure) — good cross-reference, helps future-debuggers.sdk-release.yml:57–70: Comment mirrors the CLI comment — consistent.- No code changes — YAML-only diff. No test files touched. Appropriate for a workflow-only change.
- [INFO]: CI still in progress — no blocking failures expected for YAML-only changes.
- [INFO]: Remaining npm-side work (org admin: flip "Publishing access" to allow tokens, provision granular NPM_TOKEN with bypass-2fa) is correctly documented as out-of-scope.
Bottom line: Diff is clean, correct, and well-documented. WAIT is only CI. Merge is safe once checks clear.
— Quinn, QA Engineer
Member
Author
|
Submitted COMMENT review on #290. |
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
OIDC trusted publishing was attempted for both the CLI (#278/#280) and SDK (#283). For the CLI we proved the workflow side is fully correct — a diagnostic run showed
id-tokenenv present, npm 11.15, no token shadow, registrynpmjs.org, trusted publisher configured — yet npm never engaged the exchange (straight toENEEDAUTH, no OIDC negotiation, from both a feature branch andmain). Same wall as #255. It's an opaque npm-side non-engagement we can't fix from the repo.Token auth, by contrast, has verifiable, fixable blockers: it only ever 404'd because the package's "Publishing access" was on "disallow tokens." With that flipped + an org-scoped token, it's the same mechanism behind the interactive publishes that shipped 0.40–0.45.
So: abandon OIDC, standardize both workflows on token auth.
Changes
release.yml(CLI): revert toNODE_AUTH_TOKEN+registry-url. Undoes the OIDC conversion currently on main (which is non-functional).sdk-release.yml(SDK): dropid-token: write+--provenance, keepNODE_AUTH_TOKEN+registry-url. Supersedes feat(ci): SDK publish via Trusted Publishing (OIDC) #283.Both now share one clean token shape.
Remaining npm-side work (only the org admin can do — not a repo change)
Publishing via CI still depends on two one-time npm settings. Both packages (
@protolabsai/protoand@protolabsai/sdk):NPM_TOKENsecret = a granular token with the@protolabsaiorg + package write and bypass-2fa enabled.Once both are confirmed, dispatch either workflow (
workflow_dispatch) to verify. Until then, interactivenpm publishremains the fallback (and is how 0.45.0 shipped).Test plan
Closes #283.
🤖 Generated with Claude Code
Summary by CodeRabbit