Repository navigation
ci: publish Sentinel through npm Trusted Publishing - #29
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d8b4383c3c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [[ "${published}" == "${VERSION}" ]]; then | ||
| if [[ "${latest}" != "${VERSION}" ]]; then | ||
| echo "${PACKAGE_NAME}@${VERSION} already exists, but latest points to ${latest:-missing}; refusing to guess at dist-tag repair." >&2 | ||
| exit 1 | ||
| fi | ||
| echo "${PACKAGE_NAME}@${VERSION} is already published and latest. Nothing to synchronize." | ||
| echo "release=false" >> "${GITHUB_OUTPUT}" | ||
| exit 0 | ||
| echo "npm already contains ${PACKAGE_NAME}@${VERSION}; GitHub release synchronization will still be verified/repaired." | ||
| echo "publish_needed=false" >> "${GITHUB_OUTPUT}" |
There was a problem hiding this comment.
When a version was published and tagged at commit A, any later green main commit B that does not bump package.json now sets release=true. In the Verify existing release tag identity step, the immutable tag still points to A while RELEASE_SHA is B, so the workflow exits with an error. Consequently, every ordinary post-release commit produces a failed release-sync run instead of the documented fast no-op; retain the no-op when npm and the existing GitHub release are already synchronized.
Useful? React with 👍 / 👎.
| if [[ "${published}" == "${VERSION}" ]]; then | ||
| if [[ "${latest}" != "${VERSION}" ]]; then | ||
| echo "${PACKAGE_NAME}@${VERSION} already exists, but latest points to ${latest:-missing}; refusing to guess at dist-tag repair." >&2 | ||
| exit 1 | ||
| fi | ||
| echo "${PACKAGE_NAME}@${VERSION} is already published and latest. Nothing to synchronize." | ||
| echo "release=false" >> "${GITHUB_OUTPUT}" | ||
| exit 0 | ||
| echo "npm already contains ${PACKAGE_NAME}@${VERSION}; GitHub release synchronization will still be verified/repaired." | ||
| echo "publish_needed=false" >> "${GITHUB_OUTPUT}" | ||
| else | ||
| echo "publish_needed=true" >> "${GITHUB_OUTPUT}" | ||
| fi | ||
|
|
||
| echo "release=true" >> "${GITHUB_OUTPUT}" |
There was a problem hiding this comment.
If publication succeeds at commit A but the job stops before creating the GitHub tag, and commit B subsequently reaches main without a version bump, this branch treats the npm version as recoverable while retaining B as RELEASE_SHA. Because no tag exists, the later release step creates v<version> at B even though the immutable npm artifact was built from A, misrepresenting the package's source. Recovery must determine and verify the published artifact's original commit rather than assuming the current main SHA.
Useful? React with 👍 / 👎.
1 participant
Goal
Match Sentinel's npm authentication model to the safer Nipun-style Trusted Publishing/OIDC path and remove the long-lived
NPM_TOKENdependency that blocked automatic synchronization.Current evidence
The first automatic
release-syncrun on main correctly detectedsentinel-protocol@1.2.8was missing, then failed at the npm credential preflight becauseNPM_TOKENis not configured. It stopped before creatingv1.2.8, so GitHub and npm remain consistent.Changes
NPM_TOKENfrom the release workflow.id-token: write) withnpm publish --access public.UPDATING.md.Required one-time npm package setting before merge
Configure the
sentinel-protocolpackage Trusted Publisher on npmjs.com:myProjectsRavisentinel-protocolrelease.ymlnpm publishSafety