fix(ci): use changesets-action v1.6.8 with explicit OIDC env passing #688

GarthDB · 2026-01-23T23:25:43Z

Summary

This PR integrates the new v1.6.8 release of the forked changesets-action which fixes OIDC authentication with proto/moonrepo toolchains by explicitly passing environment variables to the publish command.

Root Cause (Identified in PR #687)

Testing confirmed that:

✅ OIDC environment variables ARE present in GitHub Actions shell
✅ npm 11.6.2 is installed correctly
✅ Trusted publishers are configured for all packages
❌ Variables were being lost through the proto shim process chain

What v1.6.8 Fixes

The new version explicitly passes OIDC environment variables to the publish command's exec() call:

execOptions.env = {
  ...process.env,
  ACTIONS_ID_TOKEN_REQUEST_URL: process.env.ACTIONS_ID_TOKEN_REQUEST_URL,
  ACTIONS_ID_TOKEN_REQUEST_TOKEN: process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN,
  CI: "true"
};

await getExecOutput(publishCommand, publishArgs, execOptions);

This forces the variables through the proto shim chain: action → pnpm → changeset → npm

Changes in This PR

✅ Use GarthDB/changesets-action@v1.6.8 (up from v1.6.7)
✅ Restore single-step workflow (no need for manual publish step)
✅ Keep oidcAuth: true to activate explicit env passing
✅ Remove verification step (v1.6.8 handles validation)

Why Previous Versions Failed

Version	Approach	Issue
v1.6.4/v1.6.5	Passed env to exec	Wrong exec call (validation, not publish)
v1.6.6	`core.exportVariable()`	Only affects future steps
v1.6.7	Set `process.env`	Proto shims don't inherit Node.js env
v1.6.8	Pass env to publish exec	Should work! ✅

Expected Outcome

When this PR is merged to main, the workflow should:

✅ Validate OIDC environment
✅ Pass OIDC vars explicitly to publish command
✅ npm detects OIDC and authenticates successfully
✅ Packages publish with provenance
✅ GitHub releases are created

Testing

The workflow will only run when merged to main branch. Look for these log messages:

"Using npm OIDC trusted publishing"
"OIDC environment validated successfully"
"Passing OIDC environment variables to publish command"
Successful package publishes without ENEEDAUTH errors

References

v1.6.8 Release Notes
PR test(ci): verify OIDC environment variables are available in shell #687 (confirmed OIDC vars present)
PR fix(toolchain): upgrade Node.js to 20.17.0 for npm 11.6.2 compatibility #680 (npm 11.6.2 setup)
PR feat(ci): migrate to npm trusted publishing with OIDC #671 (initial OIDC migration)
npm Trusted Publishing docs

Related Issues

Completes the OIDC migration and resolves the proto/moonrepo compatibility issue that has been causing ENEEDAUTH errors since PR #671.

This version explicitly passes OIDC environment variables to the publish command execution, which should fix the proto shim compatibility issue. Changes: - Use GarthDB/changesets-action@v1.6.8 instead of changesets/action@v1 - Enable oidcAuth: true to activate explicit env var passing - Restore single-step publish (no need for separate manual publish step) - Remove verification step (v1.6.8 handles validation internally) How v1.6.8 fixes the proto shim issue: - PR #687 confirmed OIDC vars ARE present in GitHub Actions shell - Previous versions failed because vars were lost through proto shim chain - v1.6.8 explicitly passes env vars to exec() call using env option - This forces OIDC variables through: action → pnpm → changeset → npm Expected outcome: ✅ npm should detect OIDC from explicitly passed environment variables ✅ Packages should publish successfully with provenance ✅ Works with proto/moonrepo toolchains and standard environments Related: - v1.6.8 release: https://github.com/GarthDB/changesets-action/releases/tag/v1.6.8 - Root cause identified in PR #687 - Builds on npm 11.6.2 setup from PR #680

changeset-bot · 2026-01-23T23:25:47Z

⚠️ No Changeset found

Latest commit: 49dd54b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

GarthDB · 2026-01-23T23:26:08Z

Run report for 49dd54bc

Total time: 7.1ms | Comparison time: 0s | Estimated loss: 7.1ms (100.0% slower)

	Action	Time	Status	Info
🟩	`SyncWorkspace`	7ms	Passed

Touched files

.github/workflows/release.yml

This PR tests if npm OIDC works when we bypass proto/moonrepo shims entirely. Changes: - Replace moonrepo/setup-toolchain with actions/setup-node - Install npm 11.6.2 directly (no proto shim) - Install pnpm 10.17.1 directly (no proto shim) - Install moon 1.39.1 directly (no proto shim) - Keep GarthDB/changesets-action@v1.6.8 with oidcAuth: true Purpose: After exhaustive testing (v1.6.4-v1.6.8, PR #687), we've confirmed: ✅ OIDC environment variables ARE present in GitHub Actions ✅ npm 11.6.2 is the correct version ✅ Trusted publishers are configured correctly ❌ npm can't authenticate through proto shim chain This test will definitively show if proto shims are the blocker. Expected outcomes: If this WORKS (✅ npm publishes successfully): → Proto shims are confirmed as the issue → We have two options: 1. Use this direct install approach (no proto in release workflow) 2. File bug with proto/moonrepo about OIDC support If this FAILS (❌ still ENEEDAUTH): → Something else is wrong with OIDC setup → Fall back to NPM_TOKEN Related: - All v1.6.x attempts: ENEEDAUTH with proto - PR #687: Confirmed OIDC vars present in shell - PR #688: v1.6.8 still failed with proto

Previous PR #689 failed because moon requires proto even when installed directly. This PR bypasses both proto AND moon to test OIDC compatibility. Changes: - Remove moon entirely from release workflow - Install Node.js, npm, and pnpm directly (no proto) - Run pnpm install to get dependencies - Build tokens package directly with node commands - Keep GarthDB/changesets-action@v1.6.8 with oidcAuth: true Why this should work: - moon is tightly coupled to proto (requires proto shims) - Only tokens package has build tasks (buildTokens + buildManifest) - Other packages (component-schemas, design-system-registry) have no build - Running build commands directly bypasses moon dependency on proto Process flow without proto/moon: 1. Install Node.js 20.17.0 directly 2. Install npm 11.6.2 directly (OIDC compatible) 3. Install pnpm 10.17.1 directly 4. Run pnpm install (no shims involved) 5. Build tokens with direct node commands 6. changesets-action passes OIDC env vars to npm 7. npm publishes with OIDC (no shim interference) Expected outcome: ✅ npm should detect OIDC and publish successfully Related: - PR #689: Failed because moon requires proto - PR #688: v1.6.8 failed with proto shims - PR #687: Confirmed OIDC vars present in shell

GarthDB merged commit 00c4198 into main Jan 23, 2026
4 checks passed

GarthDB deleted the fix/use-changesets-action-v168 branch January 23, 2026 23:26

GarthDB mentioned this pull request Jan 23, 2026

test(ci): bypass proto shims to test OIDC compatibility #689

Merged

GarthDB mentioned this pull request Jan 23, 2026

fix(ci): bypass both proto and moon for OIDC testing #690

Merged

GarthDB mentioned this pull request Jan 23, 2026

Proto shims seem to prevent npm OIDC environment variables from reaching npm publish moonrepo/proto#930

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(ci): use changesets-action v1.6.8 with explicit OIDC env passing #688

fix(ci): use changesets-action v1.6.8 with explicit OIDC env passing #688

Uh oh!

GarthDB commented Jan 23, 2026

Uh oh!

changeset-bot bot commented Jan 23, 2026

Uh oh!

GarthDB commented Jan 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fix(ci): use changesets-action v1.6.8 with explicit OIDC env passing #688

fix(ci): use changesets-action v1.6.8 with explicit OIDC env passing #688

Uh oh!

Conversation

GarthDB commented Jan 23, 2026

Summary

Root Cause (Identified in PR #687)

What v1.6.8 Fixes

Changes in This PR

Why Previous Versions Failed

Expected Outcome

Testing

References

Related Issues

Uh oh!

changeset-bot bot commented Jan 23, 2026

⚠️ No Changeset found

Uh oh!

GarthDB commented Jan 23, 2026

Run report for 49dd54bc

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants