Align npm trusted publishing workflow - #6
Conversation
📝 WalkthroughWalkthroughGitHub Actions workflows are upgraded: pnpm/action-setup moves from v5 to v6 in both CI and publish pipelines. The publish workflow additionally upgrades actions/setup-node to v6, adds an explicit npm registry URL, and removes the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 47-51: The Publish step that runs "npm publish --access public"
may use an older bundled npm because node-version: 24 is unpinned; to ensure
trusted publishing, update the workflow to either (A) install a sufficiently new
npm immediately before publishing by adding an installation step that runs "npm
install -g npm@latest" (or npm@11.5.1+) prior to the Publish step, or (B) pin
the runner Node to a specific 24.x that bundles npm ≥ 11.5.1 (e.g., change the
node-version to 24.5.0) so that the "Publish" step always has npm ≥ 11.5.1 when
executing "npm publish --access public".
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 772ef2bd-6bb9-467d-a124-f491871baad8
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/publish.yml
| - name: Publish | ||
| if: inputs.dry_run == false | ||
| run: npm publish --provenance --access public | ||
| # Trusted publishing uses OIDC; npm adds provenance automatically for | ||
| # public packages published from public GitHub repositories. | ||
| run: npm publish --access public |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/publish.ymlRepository: oleg-kuibar/knarr
Length of output: 1603
🏁 Script executed:
# Find and examine package.json to check repository configuration
fd -t f package.json | head -5 | xargs cat -nRepository: oleg-kuibar/knarr
Length of output: 2936
🏁 Script executed:
# Check if there's an existing npm upgrade step in the workflow
rg "npm.*install.*-g" .github/workflows/Repository: oleg-kuibar/knarr
Length of output: 43
🌐 Web query:
npm CLI trusted publishing OIDC requirements minimum version
💡 Result:
The minimum npm CLI version required for trusted publishing with OIDC is 11.5.1. It also requires Node.js version 22.14.0 or higher.
Citations:
- 1: https://docs.npmjs.com/trusted-publishers/
- 2: https://docs.npmjs.org/trusted-publishers
- 3: https://philna.sh/blog/2026/01/28/trusted-publishing-npm/
- 4: https://socket.dev/blog/npm-trusted-publishing
- 5: https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/
🌐 Web query:
Node.js 24.0.0 bundled npm version
💡 Result:
Node.js 24.0.0 bundles npm version 11.0.0.
Citations:
- 1: https://nodejs.org/en/blog/release/v24.0.0
- 2: https://github.com/nodejs/node/releases/tag/v24.0.0
- 3: https://nodejs.org/en/blog/release/v24.0.0/
- 4: deps: upgrade npm to 11.0.0 nodejs/node#56274
🏁 Script executed:
# Find root package.json
rg "\"repository\"" . -A 2 -B 2 --type json | head -30Repository: oleg-kuibar/knarr
Length of output: 256
🏁 Script executed:
# Look for root package.json specifically in root directory
cat -n package.json 2>/dev/null | head -100Repository: oleg-kuibar/knarr
Length of output: 2892
🌐 Web query:
Node.js 24.3.0 24.5.0 bundled npm version
💡 Result:
Node.js 24.3.0 bundles npm 11.4.2. Node.js 24.5.0 bundles npm 11.5.1. These versions are specified in the official Node.js release announcements. For Node.js 24.3.0 (released 2025-06-24), the commit [68671f4314] upgrades npm to 11.4.2 (#58696). For Node.js 24.5.0 (released 2025-07-31), the commit [55a90eed8d] upgrades npm to 11.5.1 (#59199). Node.js 24 entered the series with npm 11.0.0, and subsequent releases include npm upgrades as listed in their respective release notes.
Citations:
- 1: https://nodejs.org/en/blog/release/v24.3.0
- 2: https://nodejs.org/en/blog/release/v24.5.0
- 3: https://stackoverflow.com/questions/51238643/which-versions-of-npm-came-with-which-versions-of-node
🌐 Web query:
Node.js 24 latest version bundled npm version
💡 Result:
The latest version of Node.js 24 is v24.15.0 (LTS 'Krypton'), released on 2026-04-15. It bundles npm version 11.12.1.
Citations:
- 1: https://nodejs.org/en/download
- 2: https://nodejs.org/en/blog/release/v24.15.0
- 3: https://github.com/nodejs/node/releases/tag/v24.15.0
- 4: https://github.com/nodejs/nodejs.org/blob/main/apps/site/pages/en/blog/release/v24.15.0.md
- 5: https://nodejs.dev/en/download/archive/v24.0.0
- 6: https://raw.githubusercontent.com/nodejs/node/main/doc/changelogs/CHANGELOG_V24.md
Ensure npm ≥ 11.5.1 for trusted publishing — node-version: 24 alone does not guarantee it.
Trusted publishing requires npm ≥ 11.5.1 (and Node ≥ 22.14.0). The workflow uses node-version: 24 without a minor version, which resolves to any cached Node 24.x on the runner. Node 24.0.0 through 24.4.x bundle npm < 11.5.1 (e.g., 24.0.0 → npm 11.0.0; 24.3.0 → npm 11.4.2). If the runner resolves to one of these versions, the OIDC token exchange will fail, causing the publish to error with 401/403, or worse—silently fall back to a saved token, defeating provenance altogether.
The auto-provenance comment is correct: npm skips --provenance and auto-attests provenance for public packages from public GitHub repos under trusted publishing.
Mitigate by either:
- Adding
npm install -g npm@latestbefore the publish step, or - Pinning to a specific Node 24.x known to bundle npm ≥ 11.5.1 (e.g.,
node-version: 24.5.0or newer).
Suggested fix: upgrade npm before publishing
- run: pnpm test
- run: npm pack --dry-run
+ - name: Ensure npm >= 11.5.1 for trusted publishing
+ if: inputs.dry_run == false
+ run: |
+ npm install -g npm@latest
+ npm --version
+
- name: Publish
if: inputs.dry_run == false
# Trusted publishing uses OIDC; npm adds provenance automatically for
# public packages published from public GitHub repositories.
run: npm publish --access public🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/publish.yml around lines 47 - 51, The Publish step that
runs "npm publish --access public" may use an older bundled npm because
node-version: 24 is unpinned; to ensure trusted publishing, update the workflow
to either (A) install a sufficiently new npm immediately before publishing by
adding an installation step that runs "npm install -g npm@latest" (or
npm@11.5.1+) prior to the Publish step, or (B) pin the runner Node to a specific
24.x that bundles npm ≥ 11.5.1 (e.g., change the node-version to 24.5.0) so that
the "Publish" step always has npm ≥ 11.5.1 when executing "npm publish --access
public".
c3c17c1 to
76a8249
Compare
76a8249 to
5546e5d
Compare
1 participant
Summary
--provenanceflag because npm generates provenance automatically for trusted publishing from public GitHub Actionsfetchtypes to the API client fixture, and remove the stale unpublishedknarr@0.2.0dependency from the Bun standalone exampleVerification
.github/workflows/publish.ymlwithjs-yaml.github/workflows/ci.ymlwithjs-yamlexamples/packages/api-clientwithnpm ci && npx tsupexamples/packages/ui-kitwithnpm ci && npx tsuppnpm install --frozen-lockfilepnpm lintpnpm buildpnpm test