From 5a501f51cfc4800e00c1d493ce507857ccc44976 Mon Sep 17 00:00:00 2001 From: SDS <209957663+dkitchell@users.noreply.github.com> Date: Mon, 14 Sep 2026 19:05:18 -0600 Subject: [PATCH] fix(ci): publish workflow authenticated as nobody, and asked for provenance it cannot have MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two reasons a release-triggered publish would have failed. 1. Wrong secret name. The workflow read `secrets.NPM_TOKEN`. The secret that actually exists on this repo is `NPM_ACCESS_TOKEN` (set 2026-08-21), so NODE_AUTH_TOKEN resolved to an empty string and npm would have published as an anonymous client. I introduced this name in #8 without checking what was configured. 2. `--provenance` cannot work on a first publish. Trusted publishing is configured per package on npmjs.com, which requires the package to already exist — and @certifieddata/verify has never been published, so there is nothing to configure it against. On top of that, a classic automation token combined with --provenance is exactly the combination npm is restricting (https://gh.io/npm-gat-bypass2fa-deprecation); the local CLI now warns about it on every command. Dropped --provenance for 0.1.0 and pointed the token at the right secret. Once 0.1.0 is on the registry, trusted publishing can be enabled for the package and --provenance added back — at which point the token should be deleted rather than kept alongside it. The version-vs-tag guard and the lint/typecheck/test gates are unchanged, so a release still cannot publish a version nobody asked for. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/publish.yml | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index eb3116b..42d95d9 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -18,10 +18,10 @@ jobs: node-version: 22 registry-url: https://registry.npmjs.org cache: npm - # Node 22 bundles npm 10.x. Trusted publishing (OIDC provenance with no - # long-lived token) requires npm >= 11.5.1, so upgrade the CLI before - # publishing. Without this, `npm publish --provenance` fails on auth. - - name: Upgrade npm for trusted publishing + # Node 22 bundles npm 10.x. Keep the CLI current so the registry does not + # reject a stale client, and so trusted publishing is available once it + # can be configured (see the publish step). + - name: Upgrade npm run: npm install -g npm@latest - run: npm ci @@ -40,9 +40,16 @@ jobs: exit 1 fi - - run: npm publish --provenance --access public + # No --provenance on the first publish. Trusted publishing (OIDC) has to + # be configured against a package that already exists on npmjs.com, so it + # is unavailable until 0.1.0 is up — and a classic token combined with + # --provenance is precisely the combination npm is now restricting + # (https://gh.io/npm-gat-bypass2fa-deprecation). Add --provenance back in + # a follow-up once trusted publishing is enabled for the package, and + # drop the token at the same time. + - run: npm publish --access public env: - # Belt and braces: if the package is not yet configured for trusted - # publishing on npmjs.com, this token is what authenticates. Remove - # once trusted publishing is configured. - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + # The repo secret is NPM_ACCESS_TOKEN. This previously read + # NPM_TOKEN, which is not set — so a release-triggered publish would + # have authenticated as nobody and failed. + NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}