From 43d23e3d67d728d60a8a2875adf31592d8b452b7 Mon Sep 17 00:00:00 2001 From: Kit Langton Date: Mon, 22 Jun 2026 19:05:37 -0400 Subject: [PATCH] fix(http-recorder): reuse npm release authentication --- .github/workflows/http-recorder-release.yml | 12 ++++++------ packages/http-recorder/RELEASE.md | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/http-recorder-release.yml b/.github/workflows/http-recorder-release.yml index 8a5c6e5bec..f840c87de9 100644 --- a/.github/workflows/http-recorder-release.yml +++ b/.github/workflows/http-recorder-release.yml @@ -13,12 +13,16 @@ jobs: release: if: github.repository == 'anomalyco/opencode' && github.ref == 'refs/heads/dev' runs-on: ubuntu-latest - environment: npm steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - uses: ./.github/actions/setup-bun + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + with: + node-version: "24" + registry-url: "https://registry.npmjs.org" + - name: Verify package working-directory: packages/http-recorder run: | @@ -26,10 +30,6 @@ jobs: bun typecheck - name: Publish beta - run: | - if [ -n "$NODE_AUTH_TOKEN" ]; then - npm config set //registry.npmjs.org/:_authToken "$NODE_AUTH_TOKEN" - fi - bun run release:http-recorder + run: bun run release:http-recorder env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/packages/http-recorder/RELEASE.md b/packages/http-recorder/RELEASE.md index ed5eb8e14d..e1e6e67988 100644 --- a/packages/http-recorder/RELEASE.md +++ b/packages/http-recorder/RELEASE.md @@ -24,7 +24,7 @@ bun run verify:package After the release PR reaches `dev`, manually dispatch the `http-recorder release` workflow from the `dev` branch. The workflow repeats the focused tests, builds and verifies the exact tarball in a clean npm consumer, and publishes it with provenance under the `beta` tag. -The bootstrap release requires an npm automation token in the repository's `NPM_TOKEN` secret. After the package exists, configure npm trusted publishing for `.github/workflows/http-recorder-release.yml` and the `npm` GitHub environment, then remove the token so later releases use GitHub OIDC. +The bootstrap release uses the repository's existing `NPM_TOKEN` secret because npm trusted publishing cannot be configured for a package that does not exist yet. After the package exists, configure its npm trusted publisher for repository `anomalyco/opencode` and workflow `http-recorder-release.yml`, then remove `NODE_AUTH_TOKEN` from the workflow so later releases authenticate through GitHub OIDC like the repository's other npm packages. Verify the result: