fix(ci): delete the superseded publish workflow that could put a prerelease on latest - #52
Open
yakimoto wants to merge 1 commit into
Open
fix(ci): delete the superseded publish workflow that could put a prerelease on latest#52yakimoto wants to merge 1 commit into
yakimoto wants to merge 1 commit into
Conversation
…elease on latest This repo has two npm publish workflows on different tag patterns. `release.yml` is the guarded one — OIDC trusted publishing with no long-lived token, `--provenance` enforced, a version gate that refuses when the tag does not match `package.json`, and dist-tag routing that sends `*-next.*` to the `next` channel. `publish.yml` is the legacy path and has none of that. `release.yml` already said so in its own header; the ungated one was simply never removed. The gap is live rather than theoretical. `package.json` on main is 2.1.0-next.0, and `npm publish` with no `--tag` writes to `latest` regardless of whether the version is a semver prerelease, so a `v*` tag pushed here would put a prerelease on `latest`. A legacy `v2.0.1` tag already exists in this repo, so `v*` is a shape someone could plausibly reach for again. The registry shows the guarded path working exactly as intended, and also shows why the overwrite would be worse than a version regression: latest 2.0.14 gitHead f77067d — NOT a commit in this repo next 2.1.0-next.0 gitHead 6140879 — IS a commit in this repo So `release.yml` correctly published the prerelease to `next` and correctly left `latest` alone, while what currently sits on `latest` was built from a different codebase entirely. An ungated `v*` tag here would not merely move `latest` forward — it would replace a package built elsewhere with one built here. Two smaller defects die with the file: `--no-provenance` cancels this package own declared `publishConfig.provenance: true` on a public repo where provenance actually works, and `actions/checkout@v4` / `actions/setup-node@v4` are unpinned mutable tags in a job holding publish rights, while `release.yml` pins its actions. Worth stating precisely: `NPM_TOKEN` does not currently exist — absent from this repo, from wave-av/{mcp-server,adk,sdks}, and from the org-level secret list — so `secrets.NPM_TOKEN` resolves empty and this workflow would fail at auth rather than publish. This is the removal of a latent path, not a live incident. A latent path that re-arms silently the moment someone adds an NPM_TOKEN for an unrelated reason is worth deleting while it is quiet. If a `v*` trigger is wanted for ergonomics, add `v*` to release.yml tag list rather than keeping a second workflow: one publisher, one gate. Closes #51. Part of the publishing audit in wave-av/sdks#42.
|
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_bb498e0f-ae14-4e63-8d9b-f17bdb831716) |
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. 💤 Files selected but had no reviewable changes (1)
⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #51.
Deletes
.github/workflows/publish.yml. One file, 27 lines, nothing added.Two publishers, one gate
release.yml— guardedpublish.yml— deleted heretags: ['sdk-v*']tags: ['v*']NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}--provenance, enforced--no-provenance, explicitly strippedpackage.jsonor it refuses*-next.*→nextlatestrelease.ymlalready knew: its own header says "publish.yml(tags: v*) publishes with NO gate; this workflow is the guarded one." The guarded one landed in #44. The ungated one was never removed.The registry shows both halves of this
Two things follow. First,
release.ymlworks exactly as designed — it published the prerelease tonextand correctly leftlatestalone. Second, and worse than a plain version regression: what currently sits onlatestwas built from a different codebase.package.jsonhere is2.1.0-next.0, andnpm publishwith no--tagwrites tolatestregardless of semver — so an ungatedv*tag would not merely movelatestforward, it would replace a package built elsewhere with one built here.That path is reachable: a legacy
v2.0.1tag already exists in this repo, sov*is a shape someone could plausibly reach for again.Two smaller defects die with the file
--no-provenancecancels the package's own stated intent.package.jsondeclarespublishConfig: { "provenance": true }, and this is a public repo where sigstore provenance actually works. A release down this path would be unattested even though the package asked to be attested.actions/checkout@v4andactions/setup-node@v4are mutable tags.release.ymlpins its actions; this one didn't.One correction to the issue, and it changes what this PR is
#51 says
NPM_TOKEN"is currently set on the repo, so it is armed." It isn't set — anywhere. Re-measured:secrets.NPM_TOKENresolves empty, so this workflow would fail at auth rather than publish. This is the removal of a latent path, not a live incident — and the "revoke the token" half of the suggested fix is already a no-op, so this PR carries no blast radius. A latent path that re-arms silently the moment someone adds anNPM_TOKENfor an unrelated reason is worth deleting while it's quiet.If you want the
v*ergonomics backAdd
v*torelease.yml's tag list rather than keeping a second workflow. One publisher, one gate.CI
Cannot run. Actions are refusing every job org-wide on an account-level billing lock (
plan=free,locked=yes). An absent check here is not a passing one. This is a pure deletion;release.yml,_checks.yml,foundation-gate.yml,issue-ops-triage.yml,lint.ymlandpublic-repo-guard.ymlall remain.Part of the publishing audit in wave-av/sdks#42.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Note
Low Risk
Pure workflow file removal with no runtime or package code changes; npm publishing continues via the existing guarded
release.ymlworkflow.Overview
Removes
.github/workflows/publish.yml, the legacy GitHub Actions job that published to npm onv*tags withnpm publish --access public --no-provenanceandNPM_TOKEN, with no version or dist-tag checks.release.ymlremains the sole publisher:sdk-v*tags, OIDC trusted publishing, provenance, secret-scan/verify gates, and dist-tag routing so prereleases do not land onlatest. The deleted workflow was already documented there as the unguarded path; this PR closes that latent duplicate.Reviewed by Cursor Bugbot for commit eac15dc. Configure here.
Summary by cubic
Remove the superseded
publish.ymlworkflow so only the guardedrelease.ymlcan publish. This prevents accidental publishes fromv*tags tolatestand keeps provenance/tag routing intact..github/workflows/publish.yml(ungatedv*trigger,NPM_TOKEN,--no-provenance, unpinned actions).latestand avoids publishing from the wrong codebase.NPM_TOKENset), but removing prevents silent re-arming if a token gets added.Written for commit eac15dc. Summary will update on new commits.