Repository navigation
Conversation
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Configure publishing permissions and Node.js .github/workflows/auto-publish.yml, .github/workflows/dispatch-publish.yml |
Both publish jobs add contents: read and id-token: write permissions and set up Node.js >=24.19.0 <25. |
Remove token-based npm authentication .github/workflows/auto-publish.yml, .github/workflows/dispatch-publish.yml |
Both publish steps stop writing an npm auth token to ~/.npmrc and stop passing NPM_TOKEN. Each retains npm publish with its selected tag. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Refactor
Suggested reviewers: kagol
Merge Risk: 
bfa62
-
No merge-blocking issue is identified in the npm trusted-publishing migration. Merge after normal workflow checks.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title "ci: migrate npm publishing to OIDC" matches the main change. The PR moves npm publishing for @opentiny/fluent-editorin both auto-publish.yml and dispatch-publish.yml from npm token secrets…Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title "ci: migrate npm publishing to OIDC" matches the main change. The PR moves npm publishing for
@opentiny/fluent-editorin both auto-publish.yml and dispatch-publish.yml from npm token secrets to OIDC trusted publishing. The summaries show id-token: write and contents: read permissions, Node >=24.19.0 <25 setup, and removal of NPM_TOKEN and NODE_AUTH_TOKEN. The title is short, specific, and uses the conventional ci: prefix. It does not name the workflow files, but it does not need to cover every detail.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
-
Finishing Touches
-
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the publish run,
Node is set, the tokens are gone.
The tags still guide the package flight,
Two workflows publish right.
I nibble greens and hop away.
将
@opentiny/fluent-editor的自动和手动 npm 发布认证切换为 OIDC。保留auto-publish.yml、dispatch-publish.yml原有入口、输入默认值、构建环境、版本策略、产物、dist-tag、发布命令和 Release 行为。仅在实际上传前使用
>=24.19.0 <25的 Node 24 及其自带 npm，给发布 job 添加id-token: write和contents: read，移除NPM_TOKEN/NODE_AUTH_TOKEN注入及手写 npmrc。GitHub Release 使用的独立凭证保留。验证：全部 workflow YAML 可解析；针对基线的结构比较证明认证之外行为相同；
git diff --check通过。Actionlint 1.7.12 全量检查 before/after 诊断集合相同，已有旧 Action runtime 告警未扩展到本次修复。构建环境及命令未变，未重跑产品构建。实际发布验证（2026-11-01）：在独立测试分支
test/npm-oidc-validation-20261101上，手动和 tag 自动发布均通过 GitHub Actions 使用 OIDC 发布 alpha 版本，并由 npm 记录 GitHub Actions Trusted Publisher 和 provenance。旧 npm token secret 清理未验证。配置验证：Node 范围的 SemVer 边界检查通过；删除冗余 npm 步骤后，YAML 语义对照确认其余配置保持不变，目标 workflow 的 actionlint 前后诊断相同、无新增发现；git diff --check 通过。Node 24.19.0 自带 npm 11.17.0，已满足 OIDC 客户端要求；本次发布 runner 实际使用 Node 24.22.1 / npm 11.19.1。
dispatch-publish.yml4.1.3-alpha.1auto-publish.yml4.1.3-alpha.2/v4.1.3-alpha.2最终 npm dist-tags：
alpha=4.1.3-alpha.2、beta=4.0.0-beta.2、legacy=3.25.10、latest=3.25.12。本次只发布 alpha，latest未变化。首次 registry 查询遇到短暂同步延迟，稍后版本、dist-tags 和 attestation 均可查，没有重复发布。npm trust list本机查询因 EOTP 需要一次性密码，未单独枚举服务端 trust；两个版本的 registry metadata 均显示trustedPublisher.id=github，并提供 SLSA provenance。Summary by CodeRabbit