fix: validate JSR token before publishing snapshots - #642
Conversation
|
|
View your CI Pipeline Execution ↗ for commit 4d0d87a
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗ ☁️ Nx Cloud last updated this comment at |
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
| if ( cd pkgs/edge-worker && $JSR_PUBLISH_CMD ) \ | ||
| > >(sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g') \ | ||
| 2> >(sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g' >&2) ; then |
There was a problem hiding this comment.
Process substitution race condition causing incomplete output
The process substitutions > >(sed...) and 2> >(sed...) spawn background processes. The if statement evaluates the exit code of the subshell immediately, but bash does not automatically wait for these background sed processes to complete. This creates a race condition where:
- The script continues execution before output is fully redacted/written
- Output may be truncated or appear out of order
- The script could exit before redaction completes, losing output entirely
Fix: Store output to variables first, then redact:
OUTPUT=$(cd pkgs/edge-worker && $JSR_PUBLISH_CMD 2>&1)
EXIT_CODE=$?
echo "$OUTPUT" | sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g'
if [[ $EXIT_CODE -eq 0 ]]; thenOr use a temporary file to capture output, then cat it through sed synchronously.
| if ( cd pkgs/edge-worker && $JSR_PUBLISH_CMD ) \ | |
| > >(sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g') \ | |
| 2> >(sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g' >&2) ; then | |
| OUTPUT=$(cd pkgs/edge-worker && $JSR_PUBLISH_CMD 2>&1) | |
| EXIT_CODE=$? | |
| echo "$OUTPUT" | sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g' | |
| if [[ $EXIT_CODE -eq 0 ]]; then | |
Spotted by Graphite
Is this helpful? React 👍 or 👎 to let us know.
febc643 to
4d0d87a
Compare
🔍 Preview Deployment: Website✅ Deployment successful! 🔗 Preview URL: https://pr-642.pgflow.pages.dev 📝 Details:
_Last updated: _ |
1 participant
Why
A snapshot run with a stale
JSR_TOKENgets past the script's auth pre-check("✓ jsr: authenticated (via token)"), publishes the npm half successfully, and
then dies on the JSR half:
Root cause of the false positive: the pre-check ran
deno publish --dry-run, which never contacts the registry. Verifiedlocally — with a garbage token:
The result is a half-published snapshot (npm version exists, JSR version
doesn't) and a worktree stuck on the versioned files.
Bonus leak: on publish failure the
jsrnpm wrapperconsole.logs the fulldeno command line (
dist/utils.js:272), including--token jsrp_…, so thetoken ends up in terminal output, CI logs, and bug reports.
Second dead path: the no-token fallback ran
deno login, a subcommand thatdoes not exist in deno 2.1.4 (nor in the
jsrwrapper's bundled 2.3.7) — itcrashes with
error: Module not found "…/login". And since dry-run neverreports auth problems, the fallback triggered "✓ authenticated (existing
session)" even with no session cached at all.
What
JSR_TOKENis set: validate it up front with a real API call(
GET https://api.jsr.io/user, expects 200) and exit 1 with a clear"rotate the token" message before any versioning/build/publishing happens
(
$DENO_DIR/auth.json, default~/.cache/deno/auth.json) to exist. Ifmissing, exit 1 with the one-time warm-up command
(
cd pkgs/edge-worker && pnpm jsr publish …— fails with "alreadypublished", but persists the login) instead of calling the nonexistent
deno loginjsrp_…tokens from the JSR publish output (stdout and stderr)Verification
bash -n scripts/snapshot-release.shJSR_TOKEN=jsrp_fake…→Error: JSR_TOKEN is invalid or expired (api.jsr.io: 401)+ exit 1~/.cache/deno/auth.json→ guided error + exit 1auth.jsonpresent →✓ jsr: using cached browser session+ exit 0--token jsrp_dI7…→--token jsrp_[REDACTED]