🔧 [PB-1278] Fix OIDC authentication - remove NODE_AUTH_TOKEN#22
🔧 [PB-1278] Fix OIDC authentication - remove NODE_AUTH_TOKEN#22
Conversation
- Remove NODE_AUTH_TOKEN env block to enable pure OIDC authentication - Bump version to 0.2.10 for deployment test - Empty NODE_AUTH_TOKEN was preventing OIDC from working Key insight from research: NODE_AUTH_TOKEN must be completely absent (not even empty string) for npm trusted publishing to work via OIDC.
|
Warning Rate limit exceeded@crisap94 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 9 minutes and 2 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 PR Quality Check Summary
📋 Checks Performed:
🎉 All checks passed! This PR is ready for review. |
After 4 failed attempts with OIDC trusted publishing (#20, #21, #22, #23), we're switching to the more reliable traditional npm token authentication. Changes: - Add registry-url back to setup-node - Add NODE_AUTH_TOKEN env using NPM_TOKEN secret - Bump version to 0.2.12 - Keep --provenance flag for supply chain security Required setup: 1. Create npm automation token at https://www.npmjs.com/settings/[username]/tokens/create 2. Add as GitHub secret: NPM_TOKEN Benefits: ✅ Battle-tested and reliable ✅ Still supports provenance attestation ✅ No OIDC configuration issues Trade-offs:⚠️ Requires manual token management⚠️ Token needs rotation
1 participant
Summary
This PR fixes npm OIDC trusted publishing authentication by removing the
NODE_AUTH_TOKENenvironment variable from the publish step.Changes
NODE_AUTH_TOKENenv block from deploy.ymlRoot Cause
Research revealed that setting
NODE_AUTH_TOKENto any value (even an empty string'') prevents OIDC authentication from working. The variable must be completely absent for npm to use OIDC trusted publishing.Why This Should Work Now
NODE_AUTH_TOKEN: ''which actively blocked OIDCConfiguration Verified
id-token: writepermission setenvironment: npm-productionmatches npm configregistry-urlconfigured in setup-nodeTesting
Once merged, the workflow will automatically:
References
Note: If this fails again, we'll fall back to traditional npm token authentication.