Repository navigation
ci(npm): stage releases for 2FA approval instead of publishing - #138
Merged
Merged
Conversation
The trusted publisher allows npm stage publish only, which refused the first release's direct publish with a 403. A staged version stays hidden until a maintainer approves it on npmjs.com with 2FA.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The first release run, 43067043208 for tag
npm-v0.1.0, failed atnpm publishwith403 OIDC permission denied for this action. The OIDC exchange worked, and npm signed and logged the provenance statement. The refusal came from the trusted publisher's allowed actions.npm stage publishis always allowed. A directnpm publishneeds its own permission, and npm's docs say records created after Sep 3, 2026 default to stage-only.What
The publish job now runs
npm stage publish . --access publicinstead ofnpm publish. A staged version stays hidden until a maintainer approves it on npmjs.com with 2FA. A release therefore needs two approvals: thenpmGitHub environment, and the npm maintainer's 2FA review. A compromised workflow run cannot release on its own.Staged publishing needs npm 11.15.0 or later, and the job already pins 11.21.1.
Checked
npm@11.21.1 stage publish . --access public --dry-runfromcontracts/evm/npmstages@crossecute/protocol@0.1.0with the same shasum,0f731243b055a550043bffe0f28deb02eb008744, as the failed run.After merging
Move
npm-v0.1.0to the merge commit. A rerun of the failed job would use the workflow at the tag's old commit. Then approve the job, then approve the staged version on npmjs.com. npm requires a trusted publisher's first successful publish within 2 days of its creation.