Repository navigation
ci: npmjs 发布命令输出 verbose 日志 - #24
Merged
Merged
Conversation
v0.0.7 两次在工作流里发布 npmjs 都得到 404 Not Found - PUT registry.npmjs.org/qgraphflow， 而 npm trust list 显示可信发布者为 publish-github-npm.yml / supermax92/qgraphflow、无 environment， 与工作流一致。npm 11 的 oidc.js 在令牌交换被拒时只以 verbose 级别记录原因，随后退回 setup-node 的占位令牌上传，所以 CI 日志看不到原因。0.0.7 已由维护者手动发布（无 provenance）。 - npmjs 任务的 npm publish 加 --loglevel verbose，下次发布可直接读到拒绝原因
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
v0.0.7 在发布工作流里两次发布 npmjs 都得到
404 Not Found - PUT https://registry.npmjs.org/qgraphflow（run 37673401192 第 1、2 次）。npm trust list qgraphflow显示可信发布者为publish-github-npm.yml/supermax92/qgraphflow、无 environment、允许 publish，与工作流一致。npm 11（
lib/utils/oidc.js）在可信发布令牌交换被拒时只以 verbose 级别记录 npmjs 返回的原因，随后用 setup-node 的占位令牌上传，于是只剩一个 404。0.0.7 已由维护者从 Release tgz 手动发布（无 provenance），工作流的 npmjs 任务重跑后核对通过（逐字节比对与 npx）。改动
.github/workflows/publish-github-npm.yml：npmjs 任务的npm publish加--loglevel verbose。verbose 只打印请求地址与拒绝原因，不打印令牌。验证
node --test tests/plugin-package.test.mjs5/5 通过（含对该命令的--dry-run实跑）