ci: publish v14.6.2 to npm via OIDC - #1317
Conversation
GitHub released v14.6.2 but npm was skipped because ph-fritsche/action-release only enables the npm plugin when NPM_TOKEN is set, and this repo has none. Switch the release job to semantic-release on the runner with id-token write (same approach as dom-testing-library) and backfill any git tag missing from npm. Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 33f7992. Configure here.
| echo "Publishing missing ${VERSION} to npm" | ||
| npm install -g npm@latest | ||
| npm version "${VERSION}" --no-git-tag-version | ||
| npm publish --access public |
There was a problem hiding this comment.
Backfill publishes wrong artifact
High Severity
The new npm backfill runs after a build at HEAD, then sets package.json to the latest reachable tag and runs npm publish without rebuilding at that tag. If main is ahead of that tag (e.g. CI fixes after v14.6.2), npm can get a tarball for an older version that includes unreleased source.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 33f7992. Configure here.
|
@kentcdodds thanks for your help trying to publish the long-awaited fix for #1265 - but unfortunately it seems v14.6.2 is still not available in npm: https://www.npmjs.com/package/@testing-library/user-event?activeTab=versions |
There was an issue with a patch release, so this manual-releases.md change is to release a new patch version. Reference: #1317
|
🎉 This PR is included in version 14.6.3 🎉 The release is available on: Your semantic-release bot 📦🚀 |
3 participants
What
Fix npm publishing. GitHub already has v14.6.2 (includes #1265), but npm is still on 14.6.1 because the old Docker release action only enables
@semantic-release/npmwhenNPM_TOKENis set — and this repo has noNPM_TOKEN.Why
Same situation as
dom-testing-library: publish with npm trusted publishing (OIDC), not a long-lived token.How
cycjimmy/semantic-release-actionon the runner withid-token: writeproductionenvironment (already created on the repo)Configure the trusted publisher on npm (you’re a maintainer):
testing-libraryuser-eventci.ymlproductionreleasejob after merge)That merge should publish
@testing-library/user-event@14.6.2to npm.Checklist