chore(ci): trusted publisher #13768
chore(ci): trusted publisher #13768
Conversation
WalkthroughThe release workflow was updated to include an "Update npm" step after dependency installation and to remove the NODE_AUTH_TOKEN environment variable from the "Build and publish" step, which now runs pnpm release --publishOnly without that token. Other steps remain unchanged. Changes
Sequence Diagram(s)sequenceDiagram
participant GH as GitHub Actions
participant Job as Release Job
participant NPM as npm Registry
GH->>Job: Checkout
GH->>Job: Install Node.js
GH->>Job: Install deps
GH->>Job: Update npm (npm i -g npm@latest)
GH->>Job: Build and publish (pnpm release --publishOnly)
Note over Job: No NODE_AUTH_TOKEN provided
GH->>Job: Create GitHub release
Estimated code review effort🎯 2 (Simple) | ⏱️ ~6 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
Size ReportBundles
Usages
|
@vue/compiler-core
@vue/compiler-dom
@vue/compiler-sfc
@vue/compiler-ssr
@vue/reactivity
@vue/runtime-core
@vue/runtime-dom
@vue/server-renderer
@vue/shared
vue
@vue/compat
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/release.yml (2)
29-35: Nit:registry-urlnot strictly required for Trusted PublishingWith npm Trusted Publishing (OIDC), the
registry-urlinput is optional. Keeping it is harmless, but you can simplify by removing it if you prefer a minimal config.Apply if you want to simplify:
- name: Install Node.js uses: actions/setup-node@v4 with: node-version-file: '.node-version' - registry-url: 'https://registry.npmjs.org' cache: 'pnpm'
39-41: Pin npm version instead of floatinglatestUsing
npm@latestmakes the workflow non-reproducible and can break unexpectedly. For Trusted Publishing you just need a recent npm (v10+). Pin a major (or a specific version your team standardizes on).Apply this change:
- - name: Update npm - run: npm i -g npm@latest + - name: Update npm + run: npm i -g npm@10Optionally log versions for easier debugging:
- name: Install deps run: pnpm install - name: Update npm - run: npm i -g npm@latest + run: | + npm i -g npm@10 + node -v + npm -v + pnpm -v
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/release.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Redirect rules
- GitHub Check: Header rules
- GitHub Check: Pages changed
🔇 Additional comments (1)
.github/workflows/release.yml (1)
17-21: Good: required OIDC permissions are set for Trusted Publishing
id-token: writeis present, which is necessary for npm Trusted Publishing via GitHub Actions OIDC. No action needed here.
Related to e18e/ecosystem-issues#201
Summary by CodeRabbit