Skip to content

Commit bb432fb

Browse files
wcandillonwcandillon
authored
chore(🐙): Add npm OIDC authentication debug workflow
This workflow is designed to debug npm OIDC authentication issues, providing checks for environment setup, token availability, npm authentication, package access, and provenance requirements.
1 parent eb0e94f commit bb432fb

File tree

1 file changed

+158
-0
lines changed

1 file changed

+158
-0
lines changed

‎.github/workflows/npm-debug-workflow.yml‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
name: Debug npm OIDC Authentication
2+
3+
on:
4+
workflow_dispatch: # Manual trigger only
5+
6+
jobs:
7+
debug-npm-auth:
8+
runs-on: ubuntu-latest
9+
permissions:
10+
contents: read
11+
id-token: write # Required for OIDC
12+
13+
steps:
14+
- name: Checkout repository
15+
uses: actions/checkout@v4
16+
17+
- name: Setup Node.js with npm registry
18+
uses: actions/setup-node@v4
19+
with:
20+
node-version: '20'
21+
registry-url: 'https://registry.npmjs.org'
22+
23+
- name: Debug - Check environment
24+
run: |
25+
echo "=== Node and npm versions ==="
26+
node --version
27+
npm --version
28+
29+
echo ""
30+
echo "=== npm config ==="
31+
npm config list
32+
33+
echo ""
34+
echo "=== Registry configuration ==="
35+
npm config get registry
36+
37+
echo ""
38+
echo "=== .npmrc contents (redacted) ==="
39+
if [ -f ~/.npmrc ]; then
40+
# Show structure but redact actual tokens
41+
sed 's/=.*/=<REDACTED>/' ~/.npmrc
42+
else
43+
echo "No ~/.npmrc found"
44+
fi
45+
46+
if [ -f .npmrc ]; then
47+
echo ""
48+
echo "=== Project .npmrc (redacted) ==="
49+
sed 's/=.*/=<REDACTED>/' .npmrc
50+
fi
51+
52+
- name: Debug - Check OIDC token availability
53+
run: |
54+
echo "=== OIDC Token Check ==="
55+
if [ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
56+
echo "✅ OIDC token request URL is set"
57+
echo "URL prefix: ${ACTIONS_ID_TOKEN_REQUEST_URL:0:50}..."
58+
else
59+
echo "❌ OIDC token request URL is NOT set"
60+
echo "Make sure 'id-token: write' permission is configured"
61+
fi
62+
63+
if [ -n "$ACTIONS_ID_TOKEN_REQUEST_TOKEN" ]; then
64+
echo "✅ OIDC token request token is available"
65+
else
66+
echo "❌ OIDC token request token is NOT available"
67+
fi
68+
69+
- name: Debug - Test npm authentication
70+
run: |
71+
echo "=== Testing npm whoami ==="
72+
if npm whoami 2>&1; then
73+
echo "✅ Successfully authenticated with npm"
74+
else
75+
echo "❌ npm whoami failed - not authenticated"
76+
fi
77+
78+
- name: Debug - Check package info
79+
run: |
80+
echo "=== Package.json info ==="
81+
if [ -f package.json ]; then
82+
echo "Package name: $(jq -r '.name' package.json)"
83+
echo "Package version: $(jq -r '.version' package.json)"
84+
echo "Repository: $(jq -r '.repository.url // .repository // "not set"' package.json)"
85+
else
86+
echo "No package.json found in root"
87+
fi
88+
89+
- name: Debug - Check access to @shopify scope
90+
run: |
91+
echo "=== Checking @shopify scope access ==="
92+
93+
echo ""
94+
echo "Packages you can access in @shopify scope:"
95+
npm access list packages @shopify 2>&1 || echo "Could not list packages (may need org membership)"
96+
97+
echo ""
98+
echo "=== Checking specific package access ==="
99+
npm access list collaborators @shopify/react-native-skia 2>&1 || echo "Could not list collaborators"
100+
101+
- name: Debug - Check npm org membership
102+
run: |
103+
echo "=== Organization membership check ==="
104+
npm org ls shopify 2>&1 || echo "Could not list org members (may not have permission)"
105+
106+
- name: Debug - Dry run publish test
107+
run: |
108+
echo "=== Attempting dry-run publish ==="
109+
echo "This will NOT actually publish, just test if it would work"
110+
111+
# Build if necessary (adjust based on your setup)
112+
if [ -f package.json ] && grep -q '"build"' package.json; then
113+
echo "Running build first..."
114+
npm ci
115+
npm run build || echo "Build step failed or not applicable"
116+
fi
117+
118+
# Try dry-run publish
119+
npm publish --dry-run --provenance --access public 2>&1 || true
120+
121+
- name: Debug - Check provenance requirements
122+
run: |
123+
echo "=== Provenance publishing requirements ==="
124+
echo ""
125+
echo "For provenance publishing to work, you need:"
126+
echo "1. ✅ id-token: write permission (set in this workflow)"
127+
echo "2. Package must be linked to this GitHub repo on npmjs.com"
128+
echo "3. Publishing from a GitHub Actions workflow"
129+
echo ""
130+
echo "Current repository: $GITHUB_REPOSITORY"
131+
echo "Current ref: $GITHUB_REF"
132+
echo "Current SHA: $GITHUB_SHA"
133+
echo ""
134+
echo "Check https://www.npmjs.com/package/@shopify/react-native-skia/access"
135+
echo "to verify this repo is configured for publishing"
136+
137+
- name: Summary
138+
run: |
139+
echo ""
140+
echo "========================================"
141+
echo " DEBUG SUMMARY"
142+
echo "========================================"
143+
echo ""
144+
echo "If you see authentication failures above, check:"
145+
echo ""
146+
echo "1. Is this repo configured in npm package settings?"
147+
echo " → Go to npmjs.com → @shopify/react-native-skia → Settings → Publishing access"
148+
echo " → Verify '$GITHUB_REPOSITORY' is listed"
149+
echo ""
150+
echo "2. Do you have the right npm org permissions?"
151+
echo " → You need publish access to the @shopify scope"
152+
echo ""
153+
echo "3. Is the workflow running from the right branch/context?"
154+
echo " → Some orgs restrict publishing to specific branches"
155+
echo ""
156+
echo "4. Check npm's provenance documentation:"
157+
echo " → https://docs.npmjs.com/generating-provenance-statements"
158+
echo ""

0 commit comments

Comments
 (0)