Conversation
…nance for npm publish
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #31 +/- ##
==========================================
- Coverage 86.66% 86.57% -0.09%
==========================================
Files 20 20
Lines 1177 1177
Branches 188 199 +11
==========================================
- Hits 1020 1019 -1
- Misses 157 158 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
This PR updates the release pipeline to use Node.js 24.x (upgraded from 22.x) and enables npm provenance for published packages. Provenance creates cryptographically signed attestations that link the published npm package to its source repository and build, enhancing supply chain security. The workflow already has the necessary id-token: write permission required for provenance generation.
Changes:
- Upgraded Node.js version from 22.x to 24.x in the release workflow
- Added
--provenanceflag to both stable and pre-release npm publish commands
| - name: Publish to NPM | ||
| run: | | ||
| if [ "${{ github.event.inputs.pre_release }}" == "true" ]; then | ||
| echo "Publishing pre-release with beta tag" | ||
| npm publish --tag beta | ||
| npm publish --provenance --tag beta | ||
| else | ||
| echo "Publishing stable release" | ||
| npm publish | ||
| npm publish --provenance | ||
| fi |
There was a problem hiding this comment.
The npm publish command requires authentication via NODE_AUTH_TOKEN environment variable. The workflow sets registry-url at line 41 but does not provide NODE_AUTH_TOKEN in the "Publish to NPM" step's environment. Without this, npm publish will fail with an authentication error.
Add the NODE_AUTH_TOKEN environment variable to the publish step using secrets.NPM_TOKEN, similar to how other workflows typically configure npm authentication with actions/setup-node@v4.
No description provided.