Skip to content

Migrate npm OIDC #230

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
subtleGradient merged 4 commits into from
Nov 12, 2025
Merged

Migrate npm OIDC #230

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
60cadeb
refactor: migrate to OIDC for npm package publishing
subtleGradient Nov 12, 2025
c1cfbe4
refactor: restructure publish workflow to support OIDC properly
subtleGradient Nov 12, 2025
f54999f
fix: harden OIDC workflow with publish gate and comprehensive preflight
subtleGradient Nov 12, 2025
295c844
refine: use extended regex patterns for comprehensive .npmrc token sc…
subtleGradient Nov 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
104 changes: 67 additions & 37 deletions .github/workflows/publish.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,47 +29,77 @@ jobs:
cache: pnpm
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Diagnose npm authentication
- name: Create Release Pull Request or Publish
id: changesets
uses: changesets/action@v1
with:
version: pnpm changeset-version
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: OIDC preflight - scrub .npmrc and verify registry
run: |
echo "=== NPM Authentication Diagnostics ==="
echo "Node version: $(node --version)"
echo "npm version: $(npm --version)"
echo "pnpm version: $(pnpm --version)"
echo ""
echo "=== Environment Variables ==="
echo "NPM_TOKEN set: ${NPM_TOKEN:+yes (length ${#NPM_TOKEN})}"
echo "NODE_AUTH_TOKEN set: ${NODE_AUTH_TOKEN:+yes (length ${#NODE_AUTH_TOKEN})}"
echo "NPM_CONFIG_USERCONFIG: $NPM_CONFIG_USERCONFIG"
echo ""
echo "=== npm config ==="
npm config list --json | jq '.registry, .["@openrouter:registry"], .["@openrouter/registry"]' || npm config list
echo ""
echo "=== .npmrc files ==="
for rc in ~/.npmrc "$NPM_CONFIG_USERCONFIG" .npmrc; do
if [ -f "$rc" ]; then
echo "Found: $rc"
wc -l "$rc"
echo "=== OIDC Preflight ==="

# Remove auth tokens from all potential .npmrc locations to ensure OIDC is used
for npmrc in "$NPM_CONFIG_USERCONFIG" ~/.npmrc .npmrc; do
if [ -n "$npmrc" ] && [ -f "$npmrc" ]; then
echo "Cleaning $npmrc of any existing auth tokens..."
# Remove registry-scoped tokens (allow optional whitespace around =)
sed -i -E '/\/\/registry\.npmjs\.org\/:(_authToken|_auth)\s*=/d' "$npmrc"
# Remove global tokens in any form
sed -i -E '/^\s*(_authToken|_auth)\s*=/d' "$npmrc"
# Remove global always-auth (case-insensitive, allow spacing)
sed -i -E '/^\s*[Aa]lways-[Aa]uth\s*=/d' "$npmrc"
fi
done

# Verify npm connectivity
echo "Testing npm registry connectivity..."
npm ping || exit 1

# Verify no token is active (should fail for OIDC to work)
echo "Verifying no auth token is configured..."
if npm whoami >/dev/null 2>&1; then
echo "⚠ Warning: npm whoami succeeded without OIDC token"
else
echo "✓ Confirmed: npm whoami failed (OIDC will be used)"
fi

echo ""
echo "=== Auth token in registry ==="
npm config get //registry.npmjs.org/:_authToken | head -c 10 && echo "***[rest redacted]"
echo "Registry configuration:"
npm config get registry
npm config get @openrouter:registry || echo " (no @openrouter scope override)"

- name: Publish with OIDC
if: steps.changesets.outputs.hasChangesets == 'false'
run: pnpm changeset-publish
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Post-mortem diagnostics
if: failure()
run: |
echo "=== Post-mortem Diagnostics ==="
echo "Versions:"
echo " Node: $(node --version)"
echo " npm: $(npm --version)"
echo " pnpm: $(pnpm --version)"
echo ""
echo "=== npm whoami ==="
npm whoami 2>&1 || echo "FAILED"
echo "Registry configuration:"
echo " registry: $(npm config get registry)"
echo " @openrouter scope: $(npm config get @openrouter:registry || echo '(inherited from global)')"
echo ""
echo "=== npm ping ==="
npm ping 2>&1 || echo "FAILED"
echo ".npmrc files status:"
for npmrc in "$NPM_CONFIG_USERCONFIG" ~/.npmrc .npmrc; do
if [ -n "$npmrc" ] && [ -f "$npmrc" ]; then
echo " $npmrc:"
echo " Lines: $(wc -l < "$npmrc")"
echo " Auth lines: $(grep -c "_auth\|_token" "$npmrc" || echo "0")"
Copy link

Copilot AI Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The grep -c command will exit with status 1 when no matches are found, but the pattern "_auth\|_token" uses BRE (Basic Regular Expression) syntax. When using grep without -E, the pipe character | needs to be escaped as \| which is correct here. However, for better portability and clarity, consider using grep -E (or egrep) with unescaped |:

echo "    Auth lines: $(grep -cE "_auth|_token" "$npmrc" || echo "0")"

Alternatively, to match the pattern more precisely (matching the actual config key names), consider:

echo "    Auth lines: $(grep -cE "(_authToken|_auth|_token)\s*=" "$npmrc" || echo "0")"
Suggested change
echo " Auth lines: $(grep -c "_auth\|_token" "$npmrc" || echo "0")"
echo " Auth lines: $(grep -cE '(_authToken|_auth|_token)\s*=' "$npmrc" || echo "0")"

Copilot uses AI. Check for mistakes.
echo " Content (redacted):"
sed 's/\(_auth[^=]*=\).*/\1***REDACTED***/g; s/\(_token[^=]*=\).*/\1***REDACTED***/g' "$npmrc" | sed 's/^/ /'
Copy link

Copilot AI Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The sed pattern matching on line 100 is inconsistent with the cleanup patterns used earlier (lines 49-53). The cleanup patterns match _authToken and _auth as distinct keys, but this redaction pattern uses a more generic approach with _auth[^=]* which would match both.

For consistency and accuracy, consider aligning the redaction pattern with the cleanup patterns:

sed 's/\(_authToken\s*=\).*/\1***REDACTED***/g; s/\(_auth\s*=\).*/\1***REDACTED***/g' "$npmrc" | sed 's/^/      /'

This ensures you're redacting the same patterns you're cleaning up.

Suggested change
sed 's/\(_auth[^=]*=\).*/\1***REDACTED***/g; s/\(_token[^=]*=\).*/\1***REDACTED***/g' "$npmrc" | sed 's/^/ /'
sed 's/\(_authToken\s*=\).*/\1***REDACTED***/g; s/\(_auth\s*=\).*/\1***REDACTED***/g' "$npmrc" | sed 's/^/ /'

Copilot uses AI. Check for mistakes.
fi
done
echo ""
echo "=== Verify package exists on npm ==="
npm view @openrouter/ai-sdk-provider@latest version 2>&1 || echo "FAILED"
env:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
- name: Create Release Pull Request or Publish
uses: changesets/action@v1
with:
version: pnpm changeset-version
publish: pnpm changeset-publish
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
echo "Package availability:"
npm view @openrouter/ai-sdk-provider@latest version 2>&1 || echo " (could not fetch)"