Skip to content

ci(release): publish through npm trusted publishing only #839

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Aymericr merged 1 commit into from
Sep 11, 2026
+6 −14
Merged

ci(release): publish through npm trusted publishing only #839

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 6 additions & 14 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,12 @@ jobs:
node-version: 22
registry-url: "https://registry.npmjs.org"

# npm refuses direct publishing with 2FA-bypass tokens (EOTP, see
# https://gh.io/npm-gat-bypass2fa-deprecation), so no NODE_AUTH_TOKEN is set
# and npm >= 11.5 exchanges the GitHub Actions OIDC token itself. Every
# @pascal-app package must list this repository, this workflow file and
# the `npm` environment as a trusted publisher on npmjs.com; a package that
# does not exist on npm yet needs one manual first publish before that.

@cursor cursor Bot Sep 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setup-node auth line blocks OIDC

High Severity

Removing NODE_AUTH_TOKEN from publish steps leaves actions/setup-node@v4 with registry-url writing _authToken=${NODE_AUTH_TOKEN} into the runner .npmrc, and v4 may also export a dummy token. npm then skips the OIDC exchange, so publish fails with ENEEDAUTH or E404 even when trusted publishers are configured.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit ca5696b. Configure here.

- name: Enable npm trusted publishing
run: |
npm install --global npm@11.19.1
Expand Down Expand Up @@ -214,8 +220,6 @@ jobs:
- name: Build & publish capture protocol
if: inputs.package == 'capture-protocol' || inputs.package == 'all'
working-directory: packages/capture-protocol
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
bun run build
if [ "${{ inputs.dry-run }}" = "true" ]; then
Expand All @@ -242,8 +246,6 @@ jobs:
- name: Build & publish core
if: inputs.package == 'core' || inputs.package == 'all'
working-directory: packages/core
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
bun run build
if [ "${{ inputs.dry-run }}" = "true" ]; then
Expand All @@ -259,8 +261,6 @@ jobs:
- name: Build & publish viewer
if: inputs.package == 'viewer' || inputs.package == 'all'
working-directory: packages/viewer
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
bun run build
if [ "${{ inputs.dry-run }}" = "true" ]; then
Expand All @@ -276,8 +276,6 @@ jobs:
- name: Build & publish capture viewer
if: inputs.package == 'capture-viewer' || inputs.package == 'all'
working-directory: packages/capture-viewer
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
bun run build
if [ "${{ inputs.dry-run }}" = "true" ]; then
Expand All @@ -293,8 +291,6 @@ jobs:
- name: Publish editor
if: inputs.package == 'editor' || inputs.package == 'all'
working-directory: packages/editor
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
if [ "${{ inputs.dry-run }}" = "true" ]; then
echo "🏜️ Dry run — would publish @pascal-app/editor@$EDITOR_VERSION"
Expand All @@ -309,8 +305,6 @@ jobs:
- name: Build & publish nodes
if: inputs.package == 'nodes' || inputs.package == 'all'
working-directory: packages/nodes
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
bun run build
if [ "${{ inputs.dry-run }}" = "true" ]; then
Expand Down Expand Up @@ -340,8 +334,6 @@ jobs:

- name: Build & publish ifc-converter
if: inputs.package == 'ifc-converter' || inputs.package == 'all'
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
# ifc-converter depends on @pascal-app/core (workspace) — build it first
bun run build --filter @pascal-app/core 2>/dev/null || (cd packages/core && bun run build)
Expand Down
Loading