diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 81bd944..76d63da 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,6 +18,10 @@ jobs: name: Publish orca (npm) runs-on: ubuntu-latest if: startsWith(github.ref, 'refs/tags/v') + # OIDC trusted publishing — no NPM_TOKEN; npm verifies the GitHub Actions identity + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v4 @@ -28,7 +32,7 @@ jobs: - uses: pnpm/action-setup@v4 with: - version: 9 + version: 10.33.0 # >= 10.18 required for pnpm OIDC trusted publishing (paired with id-token: write above) - name: Install dependencies run: pnpm install --frozen-lockfile @@ -47,14 +51,15 @@ jobs: pnpm publish --access public --no-git-checks fi working-directory: packages/orca-lang - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} # ── npm: @orca-lang/orca-runtime-ts ───────────────────────────────────────── publish-npm-runtime-ts: name: Publish @orca-lang/orca-runtime-ts (npm) runs-on: ubuntu-latest if: startsWith(github.ref, 'refs/tags/v') + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v4 @@ -65,7 +70,7 @@ jobs: - uses: pnpm/action-setup@v4 with: - version: 9 + version: 10.33.0 # >= 10.18 required for pnpm OIDC trusted publishing (paired with id-token: write above) - name: Install dependencies run: pnpm install --frozen-lockfile @@ -84,8 +89,6 @@ jobs: pnpm publish --access public --no-git-checks fi working-directory: packages/runtime-ts - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} # ── npm: @orca-lang/orca-mcp-server ───────────────────────────────────────── publish-npm-mcp-server: @@ -93,6 +96,9 @@ jobs: runs-on: ubuntu-latest if: startsWith(github.ref, 'refs/tags/v') needs: publish-npm-orca + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v4 @@ -103,7 +109,7 @@ jobs: - uses: pnpm/action-setup@v4 with: - version: 9 + version: 10.33.0 # >= 10.18 required for pnpm OIDC trusted publishing (paired with id-token: write above) - name: Install dependencies run: pnpm install --frozen-lockfile @@ -126,8 +132,6 @@ jobs: # Publish from monorepo root so pnpm can rewrite workspace:* to actual versions pnpm publish --filter @orcalang/orca-mcp-server --access public --no-git-checks fi - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} # ── PyPI: orca-runtime-python ──────────────────────────────────────────────── publish-pypi: @@ -207,7 +211,7 @@ jobs: run: ./mcp-publisher login github-oidc - name: Publish to MCP Registry - run: ./mcp-publisher publish --npm-token=${{ secrets.NPM_TOKEN }} + run: ./mcp-publisher publish # ── GitHub Release notes ───────────────────────────────────────────────────── create-release: diff --git a/CHANGELOG.md b/CHANGELOG.md index 1b80775..fb95c5f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,16 @@ This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html). --- +## [v0.1.30] — 2026-06-02 + +### Changed + +- **CI / release**: npm publishing for `@orcalang/orca-lang`, `@orcalang/orca-runtime-ts`, and `@orcalang/orca-mcp-server` migrated from a long-lived `NPM_TOKEN` to **OIDC trusted publishing**. There is no stored npm credential anymore, and publishes now carry provenance attestations. `release.yml` gains `id-token: write` on the three npm jobs, pins `pnpm/action-setup` to `10.33.0` (OIDC publish support requires pnpm ≥ 10.18), and drops `NODE_AUTH_TOKEN`. The MCP-registry publish is token-less as well (npm ownership is verified via the published `mcpName` field). Added a `repository` field to the three npm `package.json` files, required for provenance. + +No functional or library changes — the train is version-bumped to stay in lockstep. + +--- + ## [v0.1.29] — 2026-06-02 ### Fixed diff --git a/CLAUDE.md b/CLAUDE.md index 3f3eeee..d41178f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -111,9 +111,9 @@ Releases are **git-tag driven** + **changesets**, mostly automated via `.github/ - **The CI-pushed tag does NOT trigger `release.yml`.** CI pushes the tag with `GITHUB_TOKEN`, which by design cannot trigger another workflow. After CI tags `vX.Y.Z`, **re-push the tag under a real account** to fire the release: `git push origin :refs/tags/vX.Y.Z && git push origin vX.Y.Z`. -- **What `release.yml` (`on: push: tags: v*`) publishes:** npm × 3 (`NPM_TOKEN`), PyPI `orca-runtime-python` (`PYPI_TOKEN`), the Go module (just force-pushes `packages/runtime-go/vX.Y.Z` — proxy.golang.org serves it from the tag, **no token**), MCP Registry, and a GitHub Release. Jobs are idempotent (skip if the version already exists), so re-running is safe. +- **What `release.yml` (`on: push: tags: v*`) publishes:** npm × 3 (**OIDC trusted publishing** — no token; each npm job has `id-token: write` and publishes via `pnpm publish` on pnpm ≥ 10.18), PyPI `orca-runtime-python` (`PYPI_TOKEN`), the Go module (just force-pushes `packages/runtime-go/vX.Y.Z` — proxy.golang.org serves it from the tag, **no token**), MCP Registry (also token-less — verifies npm ownership via the published `mcpName` field), and a GitHub Release. Jobs are idempotent (skip if the version already exists), so re-running is safe. -- **npm publishing is currently broken** (as of 2026-06): `NPM_TOKEN` is invalid/expired → `Publish` fails with **`E404` on `PUT`** and npm `latest` is stuck at **0.1.27** (0.1.28/0.1.29 published to PyPI + Go but never npm). An E404 on npm publish means the **token**, not the code. Fix is maintainer-only: rotate the `NPM_TOKEN` repo secret, then `gh run rerun --failed` (re-runs npm + mcp-server + MCP-registry + GitHub-Release jobs). +- **npm uses OIDC trusted publishing** (since 2026-06, replacing the long-lived `NPM_TOKEN`). *Why:* npm removed classic/automation tokens (Dec 2025) and caps granular write tokens at ≤ 90 days; an expired token broke the 0.1.29 npm publish with **`E404` on `PUT`** (an E404/E403 on npm publish is always the **token/permissions**, never the code). *Setup, if it ever needs redoing:* each npm package needs a **Trusted Publisher** on npmjs.com (package → Settings → Trusted Publisher → GitHub Actions; org=`jascal`, repo=`orca-lang`, workflow=`release.yml`, allowed action `npm publish`), a `repository` field in its `package.json` (for provenance), and `pnpm/action-setup` ≥ 10.18 in the workflow. *Rollback:* the `NPM_TOKEN` secret is retained — to revert, re-add `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` to the three `Publish` steps. npm `latest` is at **0.1.29**. ## Package Details diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json index 2995f2c..f735c7c 100644 --- a/packages/mcp-server/package.json +++ b/packages/mcp-server/package.json @@ -2,6 +2,11 @@ "name": "@orcalang/orca-mcp-server", "version": "0.1.29", "description": "LLM agents can now build verified state machines. Generate, parse, verify, and compile Orca state machines from natural language specs — topology guarantees before any code runs.", + "repository": { + "type": "git", + "url": "git+https://github.com/jascal/orca-lang.git", + "directory": "packages/mcp-server" + }, "type": "module", "main": "dist/server.js", "bin": { diff --git a/packages/orca-lang/package.json b/packages/orca-lang/package.json index f9a993a..16b622d 100644 --- a/packages/orca-lang/package.json +++ b/packages/orca-lang/package.json @@ -2,6 +2,11 @@ "name": "@orcalang/orca-lang", "version": "0.1.29", "description": "Orca (Orchestrated State Machine Language) - an LLM-native code generation target", + "repository": { + "type": "git", + "url": "git+https://github.com/jascal/orca-lang.git", + "directory": "packages/orca-lang" + }, "type": "module", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/runtime-python/orca_runtime_python/__init__.py b/packages/runtime-python/orca_runtime_python/__init__.py index f283fa3..ee38d9c 100644 --- a/packages/runtime-python/orca_runtime_python/__init__.py +++ b/packages/runtime-python/orca_runtime_python/__init__.py @@ -46,7 +46,7 @@ from .logging import LogSink, FileSink, ConsoleSink, MultiSink -__version__ = "0.1.29" +__version__ = "0.1.30" __all__ = [ # Types diff --git a/packages/runtime-ts/package.json b/packages/runtime-ts/package.json index 48b41d2..54041ff 100644 --- a/packages/runtime-ts/package.json +++ b/packages/runtime-ts/package.json @@ -2,6 +2,11 @@ "name": "@orcalang/orca-runtime-ts", "version": "0.1.29", "description": "TypeScript async runtime for Orca state machines", + "repository": { + "type": "git", + "url": "git+https://github.com/jascal/orca-lang.git", + "directory": "packages/runtime-ts" + }, "type": "module", "main": "./dist/index.js", "types": "./dist/index.d.ts",