ci: force the OIDC-capable @semantic-release/npm so trusted publishing works - #8
Merged
Merged
Conversation
…g works After the Node/npm fix, the release run reached semantic-release and then failed with: ✘ EINVALIDNPMTOKEN Invalid npm token. Not a missing trusted publisher — the wrong plugin was running. The stack trace pointed at: node_modules/.pnpm/@semantic-release+npm@12.0.2_semantic-release@24.2.9/ semantic-release resolves plugins from its own directory first, so under pnpm's isolated layout it loaded the copy it depends on (12.0.2) rather than the 13.1.5 in devDependencies. 12.0.2 predates trusted publishing entirely — it has no lib/trusted-publishing/, so verifyConditions demands NPM_TOKEN unconditionally and OIDC can never engage. Mirrors what neurolink actually does, which is three things, not one: semantic-release ^25.0.3 (bundles @semantic-release/npm ^13.1.1) @semantic-release/npm ^13.1.4 pnpm.overrides @semantic-release/npm ^13.1.4 <- forces it inside semantic-release Only the direct devDependency was present here; without the override and on semantic-release 24, the 12.x copy won. Verified after the change: semantic-release@25.0.9 resolves @semantic-release/npm@13.1.5 from its own node_modules, that copy has lib/trusted-publishing/oidc-context.js, and no 12.x copy remains in the store or the lockfile. Config still loads on v25, the dependency advisories stay clear, and build, lint and all 53 tests pass. Typed `ci:` so it does not trigger a release before the trusted publisher is configured.
|
🎉 This PR is included in version 1.0.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
After the Node/npm fix in #7, the release run got all the way through install, lint, build and test, reached semantic-release — and failed with:
That looks like "trusted publisher not configured yet", but it is not. The wrong plugin was running. The stack trace gives it away:
Cause
semantic-release resolves plugins from its own directory first. Under pnpm's isolated layout that means it loads the copy it depends on —
12.0.2— not the13.1.5sitting indevDependencies.@semantic-release/npm@12.0.2predates trusted publishing entirely. It has nolib/trusted-publishing/, soverifyConditionsdemandsNPM_TOKENunconditionally and OIDC can never engage. Confirmed by grepping both copies:lib/trusted-publishing/oidc-context.jsSo configuring the trusted publisher alone would not have fixed the release.
Fix — what neurolink actually does
Three things, not one. I had only the middle one:
semantic-release^25.0.3(bundles plugin 13.x)^24.2.8(bundles 12.x)^25.0.9@semantic-release/npm^13.1.4^13.1.2^13.1.4pnpm.overrides["@semantic-release/npm"]^13.1.4^13.1.4The override is the load-bearing part — it forces 13.x inside semantic-release, where the resolution actually happens.
Verified
semantic-release@25.0.9resolves@semantic-release/npm@13.1.5from its ownnode_modules, and that copy haslib/trusted-publishing/oidc-context.jsreleasecorrectly identified as the only publishing branch)Why
ci:Non-releasing type — the trusted publisher still is not configured, so a releasing commit would fail at publish. This lets the pipeline run green as a no-op.