From 1d8f621d4c748b6a9a72ff71942d11c5559b58f3 Mon Sep 17 00:00:00 2001 From: octalpixel Date: Thu, 25 Jun 2026 18:08:50 +0530 Subject: [PATCH] fix(ci): write release .npmrc to $HOME, not the repo tree MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first release run had the changesets "version packages" commit pick up the repo-root .npmrc (`?? .npmrc` → committed) — a token-leak risk once NPM_TOKEN is set. Write it to $HOME/.npmrc so it's never in the working tree the changesets action commits. (The run also failed because the repo's "Allow GitHub Actions to create and approve pull requests" setting is off — that's a repo setting to enable; the version step itself worked and bumped server/cli correctly.) Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01UeVCwYURGVrm2TFtQmWB3s --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 56b35d8..e2c2762 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,7 +24,8 @@ jobs: with: bun-version: latest - name: Configure npm auth - run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc + # Write to $HOME, never the repo tree — otherwise the changesets commit would add it. + run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > "$HOME/.npmrc" - run: bun install - name: Version or publish uses: changesets/action@v1