feat: add npm publish job to release workflow#145
Conversation
Change-Id: Ibfae2af6bd2aabf09936c96d21964af98b77c127 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughAdded a new GitHub Actions job that runs after Changes
Sequence Diagram(s)sequenceDiagram
participant Workflow as GitHub Actions (workflow)
participant Repo as Repository
participant Node as Node.js Runner
participant Npm as npm Registry
Workflow->>Repo: checkout code
Workflow->>Node: setup Node.js 20
Workflow->>Node: configure npm auth (NODE_AUTH_TOKEN)
Node->>Npm: npm publish --access public
Npm-->>Workflow: publish result (success/failure)
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Greptile SummaryThis PR adds a Key issue found:
Confidence Score: 2/5Not safe to merge — the missing version-bump step will break all npm publishes after the first tag and silently break binary downloads for end users. The PR has a single critical logic error that directly breaks the primary user path: every release after the first will fail to publish, and the published package will always download the wrong (or non-existent) binary. One targeted fix resolves the issue entirely, but it must be in place before merging.
Important Files Changed
Sequence DiagramsequenceDiagram
participant GH as GitHub (tag push)
participant GR as goreleaser job
participant NP as publish-npm job
participant NPM as npmjs.org
participant User as End User (npm install)
participant GHR as GitHub Releases
GH->>GR: trigger on v* tag
GR->>GHR: upload Go binaries (e.g. v1.2.3)
GR-->>NP: job succeeds (needs: goreleaser)
NP->>NP: checkout + setup-node
Note over NP: Missing: npm version $tag, package.json still says 1.0.0
NP->>NPM: npm publish --access public (version=1.0.0)
NPM-->>NP: first publish OK / subsequent publishes FAIL
User->>NPM: npm install @larksuite/cli
NPM-->>User: package with version=1.0.0
User->>User: runs scripts/install.js
Note over User: VERSION = require(package.json).version = 1.0.0
User->>GHR: download binary for v1.0.0 (wrong tag)
GHR-->>User: 404 if v1.0.0 release does not exist for new tag
Reviews (1): Last reviewed commit: "feat: add npm publish job to release wor..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
49-51: Adopt OIDC trusted publishing instead of long-lived NPM_TOKEN for enhanced security.OIDC trusted publishing eliminates long-lived tokens and uses short-lived credentials automatically. To migrate:
- Configure trusted publisher on npmjs.com under your package's access settings (owner, repository, workflow filename, optional environment).
- Update the workflow to set
permissions: id-token: write(required for OIDC token generation) andcontents: read.- Remove the
NODE_AUTH_TOKENenv var andNPM_TOKENsecret; npm CLI will detect OIDC automatically.- Ensure Node 22.14.0+ and npm CLI 11.5.1+.
- Optionally add
--provenanceflag or set"provenance": truein package.json for supply-chain attestation (automatically enabled with OIDC in recent npm versions).Use GitHub-hosted runners (self-hosted not supported). This approach is now the recommended standard for publishing from GitHub Actions.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release.yml around lines 49 - 51, Replace the long-lived NPM_TOKEN pattern used via env: NODE_AUTH_TOKEN and the npm publish step with OIDC trusted publishing: update the workflow to add permissions: id-token: write and contents: read, remove the env: NODE_AUTH_TOKEN and any use of the NPM_TOKEN secret, and leave the run: npm publish --access public step (npm CLI will pick up OIDC automatically); also ensure runner/node/npm compatibility (Node >=22.14.0 and npm >=11.5.1) and optionally add the --provenance flag or set "provenance": true in package.json for attestation.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Around line 48-51: The publish step fails because package.json is not updated
to the release tag and scripts/install.js reads package.json for the binary URL;
add a pre-publish "version sync" step before the npm publish run that extracts
the release tag (github.ref or GITHUB_REF_NAME) and updates package.json's
"version" field to that tag (or tag without leading "v") so the published
package and postinstall binary URL match the release; implement this as a
workflow step that modifies package.json in-place (or via npm version
--no-git-tag-version) and verifies the change before running the existing "npm
publish --access public" step.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 49-51: Replace the long-lived NPM_TOKEN pattern used via env:
NODE_AUTH_TOKEN and the npm publish step with OIDC trusted publishing: update
the workflow to add permissions: id-token: write and contents: read, remove the
env: NODE_AUTH_TOKEN and any use of the NPM_TOKEN secret, and leave the run: npm
publish --access public step (npm CLI will pick up OIDC automatically); also
ensure runner/node/npm compatibility (Node >=22.14.0 and npm >=11.5.1) and
optionally add the --provenance flag or set "provenance": true in package.json
for attestation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0cc6ccea-1e14-447e-be72-1ec8bc679602
📒 Files selected for processing (1)
.github/workflows/release.yml
Change-Id: Ifb58789be5621ab4979b5fe60e0e30042e07fea8 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add npm publish job to release workflow Change-Id: Ibfae2af6bd2aabf09936c96d21964af98b77c127 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: bump package version to 1.0.1 Change-Id: Ifb58789be5621ab4979b5fe60e0e30042e07fea8 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
3 participants
Summary
publish-npmjob to the release workflow that runs aftergoreleasercompletesv*), automatically publishes the package to npm registryactions/setup-node@v4, and authenticates viaNPM_TOKENsecretPrerequisites
NPM_TOKENsecret in repo Settings > Secrets and variables > ActionsTest plan
v*tag and verify thepublish-npmjob runs aftergoreleasersucceeds--access publicSummary by CodeRabbit