Update npm release workflow with OIDC authentication and OOM fixes - #2419
Merged
Conversation
The WASM test step has been failing since November 2025 with: error: linking with `rust-lld` failed: signal: 7 (SIGBUS) This is caused by the linker running out of memory on the ubuntu-latest runner (~7GB RAM). This commit: - Adds jlumbroso/free-disk-space to free ~30GB (Android, .NET, etc.) - Adds 8GB swap space for the WASM linking phase Also adds workflow_dispatch trigger for manual testing. All publish steps are skipped during workflow_dispatch runs.
- Replace nixbuild/nix-quick-install-action with DeterminateSystems nix-installer - Upgrade Node.js to 24.x with registry-url for OIDC - Add npm upgrade, OIDC verification, and repository verification steps - Replace JS-DevTools/npm-publish action with native npm publish - Move commit/tag steps after npm publish (safer on failure) - Add --tag latest to ensure alpha versions get latest dist-tag - Add free disk space and swap space steps - Add error handling to Get Old Hash step
Contributor
WalkthroughRefactors the npm package release GitHub Actions workflow: replaces installers/caches, upgrades Node.js, adds OIDC and repository checks, reworks WASM/UI build/test/artifact steps, changes version/hash-based gating, replaces external publish action with inline npm publish, and consolidates tarball/tag/release logic. Changes
Sequence Diagram(s)sequenceDiagram
participant GH as GitHub Actions
participant OIDC as OIDC Provider
participant NPM as npm Registry
participant Git as Git Remote
participant GHRelease as GitHub Releases
GH->>OIDC: request id-token (id-token: write)
OIDC-->>GH: id-token
GH->>NPM: configure registry + authenticate (using id-token / npm token)
GH->>GH: run build/test (WASM, UI components) with swap & cleanup
GH->>GH: compute OLD_HASH / NEW_HASH, set NEW_VERSION
alt hashes differ
GH->>GH: create tarballs (orderbook, ui-components)
GH->>NPM: npm publish tarballs (inline npm publish)
GH->>Git: commit, tag, push (using GITHUB_TOKEN)
GH->>GHRelease: create release and upload tarballs
else no changes
GH-->>GH: skip publish/commit/tag
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
0xgleb
approved these changes
Jan 27, 2026
Restore removed comments and add new ones to document: - Job condition preventing infinite loops - Nix/Node setup for OIDC publishing - Disk space and swap management for WASM builds - Hash comparison logic for publish skipping - Package tarball creation and publishing steps
hardyjosh
approved these changes
Jan 28, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In @.github/workflows/npm-package-release.yml:
- Around line 206-213: The publish step named "Publish ui-components To NPM" is
missing authentication and provenance flags; update the npm publish invocation
to export/use NODE_AUTH_TOKEN in the step environment (add NODE_AUTH_TOKEN: ${{
secrets.NPM_TOKEN }} to the job/step env) and append the --provenance flag to
the npm publish command (the line invoking npm publish
ui_components_npm_package_${{ env.NEW_VERSION }}.tgz should include
--provenance), leaving the existing --access, --tag and --verbose flags intact;
ensure the step still runs under the same if condition (if: ${{ env.OLD_HASH !=
env.NEW_HASH }}).
- Around line 225-232: Remove the unnecessary GITHUB_TOKEN env from the "Push
Changes To Remote" step and rely on the SSH key configured during checkout;
update the git push commands to be explicit about what to push (e.g., git push
origin <branch-name> and git push -u origin npm-v${{ env.NEW_VERSION }} or push
the tag/branch explicitly) so the step "Push Changes To Remote" uses SSH auth
and clearly specifies the target branch/tag instead of depending on the token.
Comment on lines
206
to
+213
| # publish ui-components to npm | ||
| - name: Publish ui-components To NPM | ||
| if: ${{ env.OLD_HASH != env.NEW_HASH }} | ||
| uses: JS-DevTools/npm-publish@v3 | ||
| with: | ||
| token: ${{ secrets.NPM_TOKEN }} | ||
| access: public | ||
| package: ui_components_npm_package_${{ env.NEW_VERSION }}.tgz | ||
| run: | | ||
| npm publish ui_components_npm_package_${{ env.NEW_VERSION }}.tgz \ | ||
| --access public \ | ||
| --tag latest \ | ||
| --verbose |
Contributor
There was a problem hiding this comment.
Same authentication issue as orderbook publish.
Apply the same fix here: add NODE_AUTH_TOKEN environment variable and --provenance flag.
🐛 Proposed fix
- name: Publish ui-components To NPM
if: ${{ env.OLD_HASH != env.NEW_HASH }}
run: |
npm publish ui_components_npm_package_${{ env.NEW_VERSION }}.tgz \
--access public \
--tag latest \
+ --provenance \
--verbose
+ env:
+ NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| # publish ui-components to npm | |
| - name: Publish ui-components To NPM | |
| if: ${{ env.OLD_HASH != env.NEW_HASH }} | |
| uses: JS-DevTools/npm-publish@v3 | |
| with: | |
| token: ${{ secrets.NPM_TOKEN }} | |
| access: public | |
| package: ui_components_npm_package_${{ env.NEW_VERSION }}.tgz | |
| run: | | |
| npm publish ui_components_npm_package_${{ env.NEW_VERSION }}.tgz \ | |
| --access public \ | |
| --tag latest \ | |
| --verbose | |
| # publish ui-components to npm | |
| - name: Publish ui-components To NPM | |
| if: ${{ env.OLD_HASH != env.NEW_HASH }} | |
| run: | | |
| npm publish ui_components_npm_package_${{ env.NEW_VERSION }}.tgz \ | |
| --access public \ | |
| --tag latest \ | |
| --provenance \ | |
| --verbose | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |
🤖 Prompt for AI Agents
In @.github/workflows/npm-package-release.yml around lines 206 - 213, The
publish step named "Publish ui-components To NPM" is missing authentication and
provenance flags; update the npm publish invocation to export/use
NODE_AUTH_TOKEN in the step environment (add NODE_AUTH_TOKEN: ${{
secrets.NPM_TOKEN }} to the job/step env) and append the --provenance flag to
the npm publish command (the line invoking npm publish
ui_components_npm_package_${{ env.NEW_VERSION }}.tgz should include
--provenance), leaving the existing --access, --tag and --verbose flags intact;
ensure the step still runs under the same if condition (if: ${{ env.OLD_HASH !=
env.NEW_HASH }}).
Comment on lines
+225
to
+232
| # Push the commit to remote | ||
| - name: Push Changes To Remote | ||
| if: ${{ env.OLD_HASH != env.NEW_HASH }} | ||
| run: | | ||
| git push origin | ||
| git push -u origin npm-v${{ env.NEW_VERSION }} | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
Contributor
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
Potentially redundant GITHUB_TOKEN for push.
The checkout step (line 30-32) uses ssh-key for authentication. Git push should automatically use the SSH key configured during checkout, making the GITHUB_TOKEN environment variable unnecessary here.
Additionally, consider being explicit about the branch to push:
♻️ Suggested simplification
- name: Push Changes To Remote
if: ${{ env.OLD_HASH != env.NEW_HASH }}
run: |
- git push origin
+ git push origin HEAD:main
git push -u origin npm-v${{ env.NEW_VERSION }}
- env:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}🤖 Prompt for AI Agents
In @.github/workflows/npm-package-release.yml around lines 225 - 232, Remove the
unnecessary GITHUB_TOKEN env from the "Push Changes To Remote" step and rely on
the SSH key configured during checkout; update the git push commands to be
explicit about what to push (e.g., git push origin <branch-name> and git push -u
origin npm-v${{ env.NEW_VERSION }} or push the tag/branch explicitly) so the
step "Push Changes To Remote" uses SSH auth and clearly specifies the target
branch/tag instead of depending on the token.
Contributor
|
@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment: S/M/L PR Classification Guidelines:This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed. Small (S)Characteristics:
Review Effort: Would have taken 5-10 minutes Examples:
Medium (M)Characteristics:
Review Effort: Would have taken 15-30 minutes Examples:
Large (L)Characteristics:
Review Effort: Would have taken 45+ minutes Examples:
Additional Factors to ConsiderWhen deciding between sizes, also consider:
Notes:
|
Contributor
|
The author of this PR is on the CodeRabbit Free Plan. In order to use the Chat feature, please upgrade the PR author to CodeRabbit Pro by visiting https://app.coderabbit.ai/login. |
This was referenced Jan 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The npm release workflow was failing due to WASM linker OOM errors and using an older token-based npm authentication approach. This update modernizes the workflow to use OIDC-based npm authentication (more secure, no token needed) and adds resource management to prevent OOM failures.
Solution
nixbuild/nix-quick-install-actionwithDeterminateSystems/nix-installer-action+flakehub-cache-actionregistry-urlconfigured for OIDCJS-DevTools/npm-publishaction with nativenpm publishusing OIDC (no NPM_TOKEN needed)--tag latestto ensure alpha-versioned packages get the latest tagChecks
By submitting this for review, I'm confirming I've done the following:
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.