ci: enable trusted publishing #757
Conversation
|
|
Caution Review failedThe pull request is closed. WalkthroughAdds an npm upgrade step to the release workflow after Node.js setup and before dependency installation. Modifies the publish step’s environment by removing provenance configuration and replacing the secret-based NPM_TOKEN with an empty string. Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant GH as GitHub Actions (release.yml)
participant npm as npm Registry
Dev->>GH: Trigger release workflow
GH->>GH: Setup Node.js
GH->>GH: Upgrade npm to latest
GH->>GH: Install dependencies / build
GH->>npm: Publish package (NPM_TOKEN: '')
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. 📜 Recent review detailsConfiguration used: CodeRabbit UI 💡 Knowledge Base configuration:
You can enable these sources in your CodeRabbit configuration. 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
commit: |
![ellipsis-dev[bot]](https://avatars.githubusercontent.com/in/64358?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
Looks good to me! 👍
Reviewed everything up to 8e10ea7 in 2 minutes and 0 seconds. Click for details.
- Reviewed
21lines of code in1files - Skipped
0files when reviewing. - Skipped posting
2draft comments. View those below. - Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.
1. .github/workflows/release.yml:34
- Draft comment:
Consider pinning the npm version instead of using 'npm@latest' to avoid unexpected breaking changes. Verify that the new npm version’s default behavior (e.g. provenance) aligns with our trusted publishing setup. - Reason this comment was not posted:
Comment did not seem useful. Confidence is useful =50%<= threshold50%The comment suggests pinning the npm version instead of using 'npm@latest', which is a specific code suggestion. However, the second part of the comment asks the author to verify the new npm version's behavior, which violates the rule against asking for verification. I will approve the first part of the comment but not the second.
2. .github/workflows/release.yml:48
- Draft comment:
Setting NPM_TOKEN to an empty string and removing NPM_CONFIG_PROVENANCE may disable npm authentication and provenance info. If this is intentional for trusted publishing, please add clarifying comments to explain this configuration. - Reason this comment was not posted:
Decided after close inspection that this draft comment was likely wrong and/or not actionable: usefulness confidence = 20% vs. threshold = 50% The comment raises valid security concerns about npm authentication being disabled. However, it's asking for clarification ("If this is intentional...") rather than pointing out a clear issue. It's speculative and asking the author to explain their intention, which violates our rules. The author likely has a reason for this change that we don't understand without more context. The changes could potentially introduce security risks in the npm publishing process. Maybe we should keep the comment to ensure security isn't compromised. While security is important, the comment violates our rules by being speculative and asking for clarification rather than pointing out a clear issue. We don't have enough context to know if this is actually problematic. Delete the comment because it's speculative and asks for clarification rather than pointing out a definitive issue that needs fixing.
Workflow ID: wflow_lB7GLh1nFVzW6b4M
You can customize 
https://docs.npmjs.com/trusted-publishers
related e18e/ecosystem-issues#201
Important
Enable trusted publishing in GitHub Actions by updating npm and modifying environment variables in
release.yml..github/workflows/release.ymlto enable trusted publishing with npm.NPM_CONFIG_PROVENANCEand setsNPM_TOKENto an empty string in the environment variables.This description was created by
for 8e10ea7. You can customize this summary. It will automatically update as commits are pushed.
Summary by CodeRabbit
Chores
Notes