Repository navigation
fix(ci): revert to sed approach — OIDC Trusted Publishers now configured - #1094
Merged
Merged
Conversation
npm config delete targets the wrong file; setup-node writes to $NPM_CONFIG_USERCONFIG. Use sed directly on that file to remove the _authToken line so npm's OIDC exchange can authenticate. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Without registry-url, NPM_CONFIG_USERCONFIG is unset and the sed step fails. Add registry-url back (needed for OIDC exchange to work via npm), guard the sed+cat with a file-existence check to handle both cases. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
npm CLI does not automatically exchange OIDC tokens — it must be explicitly
fetched and set as NODE_AUTH_TOKEN. setup-node already writes
_authToken=${NODE_AUTH_TOKEN} to the npmrc; populating the env var with the
OIDC JWT lets the registry validate it against the Trusted Publisher config.
Replaces the sed-based _authToken removal with an explicit OIDC token fetch.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…configured Previously ENEEDAUTH because no Trusted Publisher was configured on the packages. Now that both @sonicjs-cms/core and create-sonicjs have Trusted Publishers set up on npmjs.com, removing _authToken from the npmrc lets npm auto-detect and exchange the OIDC token automatically. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
_authTokenfrom npmrc via sed, which lets npm auto-detect and perform the OIDC exchange with the registryENEEDAUTHbecause no Trusted Publisher was configured on the packages; now that both@sonicjs-cms/coreandcreate-sonicjshave Trusted Publishers set up on npmjs.com, npm's automatic OIDC detection should workTest plan
🤖 Generated with Claude Code