fix(ci): npm trusted publishing + manual release runs - #7
Merged
Merged
Conversation
The v0.1.2 release run failed at the publish step with npm EOTP: the account enforces 2FA for writes and the NPM_TOKEN granular token does not bypass the one-time-password prompt. Switch release.yml to npm trusted publishing (OIDC), which is the post-2025 recommended path and needs no token: - upgrade npm to >= 11.5.1 (required for OIDC publishing) - drop registry-url and NODE_AUTH_TOKEN; `npm publish` uses the id-token OIDC flow (provenance is recorded automatically) Still needed: configure the package's trusted publisher on npmjs.com for this repo + release.yml. The NPM_TOKEN secret can then be removed. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add a workflow_dispatch trigger to release.yml with a bump-type input (patch/minor/major). On a manual run the workflow bumps the version with npm version (which also syncs manifest.json), commits, pushes the tag, then builds + releases — so a release can be cut from the Actions tab without running npm version locally. The tag-push trigger still works; version/tag are now resolved from package.json so both paths share the same release steps. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
hiOpenmart
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes to
release.yml.1. Publish to npm via trusted publishing (OIDC)
The
v0.1.2release run built the.mcpband created the GitHub Release fine, butnpm publishfailed:The npm account enforces 2FA for writes, and the
NPM_TOKENgranular token does not bypass the OTP prompt.Fix — switch to npm trusted publishing (OIDC), the post-2025 recommended path with no long-lived token:
>= 11.5.1(required for OIDC publishing)registry-url/NODE_AUTH_TOKEN;npm publishuses theid-tokenOIDC flow (provenance recorded automatically)2. Manual release runs that auto-tag
Add a
workflow_dispatchtrigger with abumpinput (patch / minor / major). A manual run from the Actions tab bumps the version withnpm version(which also syncsmanifest.json), commits, pushes the tag, then builds + releases — no need to runnpm versionlocally.The
v*tag-push trigger still works; the version/tag are now resolved frompackage.jsonso both paths share the release steps.Action needed before this works
Configure the package's trusted publisher on npmjs.com (
openmart-mcp-server→ Settings → Trusted Publisher → GitHub Actions):OpenmartAIopenmart-mcp-serverrelease.ymlAfter that the
NPM_TOKENrepository secret is unused and can be removed.🤖 Generated with Claude Code