Repository navigation
ci: publish with NPM_TOKEN and run OSV on Mac minis - #182
Merged
Merged
Conversation
npm trusted publishing does not support self-hosted runners, so the publish job now authenticates with the org-level NPM_TOKEN secret. The OSV scan no longer calls Google's ubuntu-latest reusable workflow; it runs the same v2.3.8 scanner binary on the Mac minis. Co-authored-by: Joe Blau <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This loses npm trusted publishing and provenance. Official npm docs say trusted publishing supports GitHub-hosted runners only; self-hosted runners are not supported (Trusted publishing for npm packages). Per Joe's decision (same tradeoff as bloxwap/font#14), publish stays on the Mac minis and authenticates with the org-level
NPM_TOKENsecret (NODE_AUTH_TOKEN) instead of OIDC.What changed
publishalready usedruns-on: [self-hosted, macOS, ARM64](runner group JWS).id-token: writeis removed because OIDC trusted publishing cannot work here.NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}. Joe's org-level granular token (publish rights for@bloxwappackages) is already shared with this repo.actions/setup-nodenow setsregistry-url: https://registry.npmjs.orgso npm uses that token. Build, tag selection, andnpm publish --access publicare unchanged.NPM_TOKENis missing and never prints the token.OSV scan also moved off GitHub-hosted Ubuntu
security.ymlno longer callsgoogle/osv-scanner-action's reusable workflow (that callee pinsruns-on: ubuntu-latestand a Linux container). The job now runs on the Mac minis with the same OSV-Scanner v2.3.8darwin_arm64binary (SHA256-verified), the same two lockfiles, and the same fail-on-vuln behavior. Results still upload as an artifact. SARIF upload stays disabled.Docs
docs/ci-runners.mdnow says every job is on the minis, and that publish usesNPM_TOKENwithout provenance.Do not merge until CI is green. This PR does not merge itself.