From 7a60f0264af0cd6219c9a8f34e657a909e492730 Mon Sep 17 00:00:00 2001 From: pmckinney-codat Date: Tue, 4 Aug 2026 15:01:32 +0100 Subject: [PATCH] EXP-2124 Use org secret ADO_NPM_FEED_TOKEN for codat-npm feed auth The repo-level NPM_TOKEN secret was backed by a short-lived ADO PAT that expired on 3 Aug, breaking every workflow that runs npm ci. The NPM_TOKEN name is also overloaded across the org (client-sdk-typescript uses it for an npmjs.com publish token), so the ADO feed credential moves to an explicitly named org-level secret shared with the repos that consume the codat-npm feed. Merge after the ADO_NPM_FEED_TOKEN org secret exists; the repo-level NPM_TOKEN secret can then be deleted. Co-Authored-By: Claude Fable 5 --- .github/workflows/check-formatting.yml | 4 ++-- .github/workflows/check-markdown-lint.yml | 4 ++-- .github/workflows/check-spelling.yml | 4 ++-- .github/workflows/pr.yml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/check-formatting.yml b/.github/workflows/check-formatting.yml index 4681b3a1a2..2a83772bcb 100644 --- a/.github/workflows/check-formatting.yml +++ b/.github/workflows/check-formatting.yml @@ -23,11 +23,11 @@ jobs: run: | { echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:username=codat" - echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:_password=${NPM_TOKEN}" + echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:_password=${ADO_NPM_FEED_TOKEN}" echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:email=npm-requires-email@example.com" } >> ~/.npmrc env: - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + ADO_NPM_FEED_TOKEN: ${{ secrets.ADO_NPM_FEED_TOKEN }} - name: Install dependencies run: npm ci diff --git a/.github/workflows/check-markdown-lint.yml b/.github/workflows/check-markdown-lint.yml index ab2aa7404b..3ed11e0a79 100644 --- a/.github/workflows/check-markdown-lint.yml +++ b/.github/workflows/check-markdown-lint.yml @@ -34,11 +34,11 @@ jobs: run: | { echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:username=codat" - echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:_password=${NPM_TOKEN}" + echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:_password=${ADO_NPM_FEED_TOKEN}" echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:email=npm-requires-email@example.com" } >> ~/.npmrc env: - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + ADO_NPM_FEED_TOKEN: ${{ secrets.ADO_NPM_FEED_TOKEN }} - name: Install dependencies run: npm ci diff --git a/.github/workflows/check-spelling.yml b/.github/workflows/check-spelling.yml index 894fb895be..22f1d56e18 100644 --- a/.github/workflows/check-spelling.yml +++ b/.github/workflows/check-spelling.yml @@ -23,11 +23,11 @@ jobs: run: | { echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:username=codat" - echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:_password=${NPM_TOKEN}" + echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:_password=${ADO_NPM_FEED_TOKEN}" echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:email=npm-requires-email@example.com" } >> ~/.npmrc env: - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + ADO_NPM_FEED_TOKEN: ${{ secrets.ADO_NPM_FEED_TOKEN }} - name: Install dependencies run: npm install -g cspell diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 6415c237a2..f302efd0b4 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -32,11 +32,11 @@ jobs: run: | { echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:username=codat" - echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:_password=${NPM_TOKEN}" + echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:_password=${ADO_NPM_FEED_TOKEN}" echo "//pkgs.dev.azure.com/codat/Codat/_packaging/codat-npm/npm/registry/:email=npm-requires-email@example.com" } >> ~/.npmrc env: - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + ADO_NPM_FEED_TOKEN: ${{ secrets.ADO_NPM_FEED_TOKEN }} - name: Install dependencies run: npm ci