From 0a9cf4c8a72e63b9753f26977728736a407a2c59 Mon Sep 17 00:00:00 2001 From: Minsu Lee Date: Wed, 1 Jul 2026 20:41:13 +0900 Subject: [PATCH 1/2] ci(release): publish to npm via trusted publishing (OIDC) The publish job failed with npm E404 because it published unauthenticated (no NODE_AUTH_TOKEN; setup-node's placeholder token). Switch to npm Trusted Publishing instead of a long-lived token: - upgrade npm to >= 11.5.1 (OIDC support) after setup-node - drop NODE_AUTH_TOKEN and the --provenance flag; with the GitHub Actions OIDC environment (id-token: write) npm authenticates via the per-package Trusted Publisher on npmjs.com and generates provenance automatically Requires a Trusted Publisher configured on npmjs.com for each @pleaseai/code* package (repo pleaseai/code-intelligence, workflow file release-please.yml). --- .github/workflows/release-please.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 8808f52..00d4ff6 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -79,9 +79,16 @@ jobs: - name: Build npm packages run: bun run build:npm + # Trusted publishing (OIDC) needs npm >= 11.5.1; setup-node's bundled npm may be older. + - name: Upgrade npm for trusted publishing + run: npm install -g npm@latest + + # No NODE_AUTH_TOKEN: npm detects the GitHub Actions OIDC environment (id-token: write) + # and authenticates via the per-package Trusted Publisher configured on npmjs.com. + # Provenance is generated automatically for trusted publishing. - name: Publish to npm run: | for dir in npm/code-*; do - (cd "$dir" && npm publish --provenance --access public) + (cd "$dir" && npm publish --access public) done - cd npm/code && npm publish --provenance --access public + cd npm/code && npm publish --access public From 6de7e5378464193bf08b4578575fff159947049a Mon Sep 17 00:00:00 2001 From: Minsu Lee Date: Wed, 1 Jul 2026 20:51:41 +0900 Subject: [PATCH 2/2] ci(release): make npm publish idempotent (skip already-published versions) A partial publish left @pleaseai/code-darwin-arm64@0.1.14 on npm while the other 7 packages stayed at 0.1.13. Re-running aborted on the first package with 'cannot publish over previous version', never reaching the missing ones. Check npm view per package and publish only versions not yet present. --- .github/workflows/release-please.yml | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 00d4ff6..5c8ea9e 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -86,9 +86,22 @@ jobs: # No NODE_AUTH_TOKEN: npm detects the GitHub Actions OIDC environment (id-token: write) # and authenticates via the per-package Trusted Publisher configured on npmjs.com. # Provenance is generated automatically for trusted publishing. + # Idempotent: skip versions already on npm so a re-run (e.g. after a + # partial publish) only pushes the packages still missing, instead of + # aborting on the first "cannot publish over previous version". - name: Publish to npm run: | - for dir in npm/code-*; do - (cd "$dir" && npm publish --access public) - done - cd npm/code && npm publish --access public + set -euo pipefail + publish_if_new() { + local dir="$1" name ver + name=$(cd "$dir" && node -p "require('./package.json').name") + ver=$(cd "$dir" && node -p "require('./package.json').version") + if npm view "$name@$ver" version >/dev/null 2>&1; then + echo "== skip $name@$ver (already published)" + else + echo "== publish $name@$ver" + (cd "$dir" && npm publish --access public) + fi + } + for dir in npm/code-*; do publish_if_new "$dir"; done + publish_if_new npm/code