ci(publish): NPM_TOKEN fallback for the first publish - #41
Merged
Conversation
OIDC trusted publishing only works once the package exists + a trusted- publisher record is configured on npm — a chicken-and-egg for the first release. The publish job now uses an NPM_TOKEN secret when present (writing .npmrc itself) and falls through to OIDC when it's absent, so the first publish works with just a repo secret and later releases need no secret at all. Documents both modes in a README "Releasing" section. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #40 — makes the publish CI work for the first release.
Problem
OIDC trusted publishing (what #40 set up) only works once the package already exists on npm and a trusted-publisher record is configured — a chicken-and-egg for the very first publish of
github-warden.Fix (entirely in
publish.yml)The
publishjob now:NPM_TOKENrepo/org secret into the job env.~/.npmrcitself and publishes with the token.Either way it stays idempotent (skips if the version is already on npm) and uses
--provenance. So the first publish needs only anNPM_TOKENsecret; once trusted publishing is configured on npm, drop the secret and subsequent releases authenticate via OIDC with nothing stored.README gains a Releasing section documenting
just release+ both auth modes.What still can't live in the workflow
The npm-side trust record / the
NPM_TOKENsecret value are registry/secret config a maintainer sets once (I'm not authenticated to npm here). After that,just release minor→v0.2.0tag → publish.Verification
publish.ymlvalidates as YAML; the publish step passesbash -n.🤖 Generated with Claude Code