Skip to content

fix(ci): publish to npm with provenance instead of bun publish #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
amondnet merged 1 commit into from
Jun 27, 2026
Merged

fix(ci): publish to npm with provenance instead of bun publish #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 25 additions & 4 deletions .github/workflows/release-please.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,11 @@ on:
push:
branches:
- main
workflow_dispatch:
inputs:
ref:
description: Git tag to publish (e.g. v0.3.0) when re-running a release
required: true

permissions:
contents: write
Expand Down Expand Up @@ -31,15 +36,26 @@ jobs:

npm-publish:
needs: release-please
if: ${{ needs.release-please.outputs.release_created }}
# Publish on a fresh release, or manually for a given tag via workflow_dispatch.
if: ${{ needs.release-please.outputs.release_created || github.event_name == 'workflow_dispatch' }}
Comment on lines 37 to +40

@greptile-apps greptile-apps Bot Jun 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Manual re-publish silently skipped when release-please fails

npm-publish uses needs: release-please without if: always(). If the release-please job exits with a failure (transient API error, GitHub App token scope issue, etc.), GitHub Actions skips — not fails — any downstream job, bypassing the if condition entirely. On a workflow_dispatch run this means the whole manual re-publish path silently does nothing, which is exactly the scenario this PR is designed to unblock.

Adding always() to the condition guards against this:

if: ${{ always() && (needs.release-please.outputs.release_created || github.event_name == 'workflow_dispatch') }}

This still correctly prevents a publish when a push run completes without creating a release (release_created is falsy and event_name is push).

Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/release-please.yml
Line: 37-40

Comment:
**Manual re-publish silently skipped when `release-please` fails**

`npm-publish` uses `needs: release-please` without `if: always()`. If the `release-please` job exits with a failure (transient API error, GitHub App token scope issue, etc.), GitHub Actions skips — not fails — any downstream job, bypassing the `if` condition entirely. On a `workflow_dispatch` run this means the whole manual re-publish path silently does nothing, which is exactly the scenario this PR is designed to unblock.

Adding `always()` to the condition guards against this:
```yaml
if: ${{ always() && (needs.release-please.outputs.release_created || github.event_name == 'workflow_dispatch') }}
```
This still correctly prevents a publish when a `push` run completes without creating a release (`release_created` is falsy and `event_name` is `push`).

How can I resolve this? If you propose a fix, please make it concise.

Fix in Claude Code

runs-on: ubuntu-latest
permissions:
contents: read
id-token: write # required for npm provenance (OIDC)
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.inputs.ref || github.ref }}
Comment on lines 46 to +48

@greptile-apps greptile-apps Bot Jun 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Inconsistent action pinning

actions/setup-node is pinned to a full commit SHA (good practice), but actions/checkout@v4, oven-sh/setup-bun@v2, and actions/cache@v4 still use floating mutable tags. A compromised or accidentally force-pushed tag in any of those actions would run untrusted code in the same job that holds the NPM_TOKEN secret and the OIDC token. Pinning all actions to SHAs would make the supply-chain posture consistent.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/release-please.yml
Line: 46-48

Comment:
**Inconsistent action pinning**

`actions/setup-node` is pinned to a full commit SHA (good practice), but `actions/checkout@v4`, `oven-sh/setup-bun@v2`, and `actions/cache@v4` still use floating mutable tags. A compromised or accidentally force-pushed tag in any of those actions would run untrusted code in the same job that holds the `NPM_TOKEN` secret and the OIDC token. Pinning all actions to SHAs would make the supply-chain posture consistent.

How can I resolve this? If you propose a fix, please make it concise.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Fix in Claude Code


- uses: oven-sh/setup-bun@v2
with:
bun-version: latest

- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 22
registry-url: https://registry.npmjs.org

- name: Cache Bun dependencies
uses: actions/cache@v4
with:
Expand All @@ -54,7 +70,12 @@ jobs:
- name: Build
run: bun run build

- name: Publish to npm
run: bun publish
# bun publish does not support npm provenance; build the tarball with bun
# and publish it via npm with --provenance (id-token: write enables OIDC).
- name: Pack tarball
run: bun pm pack

- name: Publish to npm (with provenance)
run: npm publish ./*.tgz --provenance --access public
env:
NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
4 changes: 4 additions & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@
"description": "Shared CLI utilities for LLM-focused command-line tools",
"author": "PleaseAI",
"license": "MIT",
"repository": {
"type": "git",
"url": "git+https://github.com/pleaseai/cli-toolkit.git"
},
"keywords": [
"cli",
"toolkit",
Expand Down
Loading