ci(release): publish to npm via trusted publishing (OIDC)

[amondnet]

Summary

The publish job failed with npm E404 because it published unauthenticated — the step never set NODE_AUTH_TOKEN, so actions/setup-node left its placeholder token (XXXXX-XXXXX-XXXXX-XXXXX) in .npmrc and the registry rejected the PUT to the existing @pleaseai/code* packages. (Provenance signing succeeded via OIDC; only the registry auth was missing.)

Rather than wire a long-lived NPM_TOKEN, switch to npm Trusted Publishing (OIDC) — no stored npm token, automatic provenance.

Changes (.github/workflows/release-please.yml, publish job)

• Upgrade npm to ≥ 11.5.1 after setup-node (npm install -g npm@latest) — required for OIDC trusted publishing.
• Drop NODE_AUTH_TOKEN — with id-token: write (already set) npm detects the GitHub Actions OIDC environment and authenticates via the per-package Trusted Publisher on npmjs.com.
• Drop --provenance — provenance is generated automatically under trusted publishing.

⚠️ Required manual setup on npmjs.com (before this can publish)

Trusted Publishing is configured per package. For each of these 8 packages → Settings → Trusted Publisher → GitHub Actions:

• Organization/user: pleaseai
• Repository: code-intelligence
• Workflow filename: release-please.yml (filename only — not the full path)
• Environment: (leave empty)
• Allowed action: npm publish

Packages:
@pleaseai/code, @pleaseai/code-darwin-arm64, @pleaseai/code-darwin-x64, @pleaseai/code-linux-x64-glibc, @pleaseai/code-linux-arm64-glibc, @pleaseai/code-linux-x64-musl, @pleaseai/code-linux-arm64-musl, @pleaseai/code-win32-x64

After merge + npm setup

@pleaseai/code-v0.1.14 is already tagged, so release_created won't fire again. Re-run publishing:

gh workflow run "Release Please" -f publish_only=true

Requirements confirmed against npm docs: npm ≥ 11.5.1, Node ≥ 22.14.0, id-token: write, no NODE_AUTH_TOKEN, automatic provenance.

Summary by CodeRabbit

• Chores
  • Updated the npm publishing workflow to upgrade to a compatible npm version before publishing.
  • Adjusted the publish commands for trusted publishing using workflow OIDC, improving release reliability.
  • Made publishing idempotent by skipping packages when the exact version is already present.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 57a89e89-d0cb-4f5d-af57-6d62572bec66

📥 Commits

Reviewing files that changed from the base of the PR and between 0a9cf4c and 6de7e53.

📒 Files selected for processing (1)

• .github/workflows/release-please.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/release-please.yml

---

📝 Walkthrough

Walkthrough

The release-please workflow now upgrades npm before publishing, updates the publish comments for trusted publishing, and makes the package publish step skip versions that are already published.

Changes

Workflow Publish Update

Layer / File(s)	Summary
Upgrade npm and publish without provenance .github/workflows/release-please.yml	Adds an npm upgrade step, updates provenance/authentication comments, and replaces the publish loop with an idempotent check before running npm publish --access public for npm/code-* and npm/code.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: switching npm publishing to Trusted Publishing via OIDC.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/npm-publish-auth-token

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR switches npm publishing from a stored NPM_TOKEN to OIDC trusted publishing, upgrading npm to @latest before publishing, removing --provenance (automatic under OIDC), and adding an idempotent publish_if_new helper that skips already-published versions to survive partial re-runs.

• OIDC publishing setup: Adds npm install -g npm@latest to satisfy the npm ≥ 11.5.1 requirement, then relies on the id-token: write permission (already present) for the OIDC token exchange — no stored npm secret is needed.
• Idempotent publish loop: Replaces the bare npm publish loop with publish_if_new, which calls npm view to check if a version is already on the registry before publishing, enabling safe partial re-runs (e.g., after a mid-flight failure).
• Required prerequisite: Each of the 8 packages must have a Trusted Publisher configured on npmjs.com before this workflow will authenticate successfully (documented in the PR description).

Confidence Score: 5/5

Safe to merge once the npm Trusted Publisher is configured on npmjs.com for each of the 8 packages — the workflow change itself is correct.

The OIDC trusted publishing approach is implemented correctly: id-token: write is already present, npm is upgraded before publishing, --provenance is appropriately dropped (auto-generated under trusted publishing), and the idempotent publish_if_new helper handles partial re-runs gracefully.

No files require special attention beyond the workflow file, which is the only change.

Important Files Changed

Filename	Overview
.github/workflows/release-please.yml	Publish job migrated to npm OIDC trusted publishing: adds npm upgrade step, drops NODE_AUTH_TOKEN and --provenance, adds idempotent publish_if_new helper. Logic is sound; minor concern about floating npm@latest tag and potential setup-node .npmrc interference.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant GHA as GitHub Actions Runner
    participant GHOIDC as GitHub OIDC Provider
    participant NPM as npmjs.com Registry

    GHA->>GHA: "npm install -g npm@latest"
    GHA->>GHA: publish_if_new(dir)
    GHA->>NPM: "npm view name@ver (check if exists)"
    alt version already published
        NPM-->>GHA: exit 0 (version found)
        GHA->>GHA: skip (idempotent)
    else version not yet published
        NPM-->>GHA: exit 1 (not found)
        GHA->>GHOIDC: Request OIDC token (id-token: write)
        GHOIDC-->>GHA: OIDC JWT
        GHA->>NPM: Exchange OIDC JWT for granular npm token
        NPM-->>GHA: Temporary npm token
        GHA->>NPM: npm publish --access public (with token)
        NPM-->>GHA: 200 OK (published + provenance auto-generated)
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant GHA as GitHub Actions Runner
    participant GHOIDC as GitHub OIDC Provider
    participant NPM as npmjs.com Registry

    GHA->>GHA: "npm install -g npm@latest"
    GHA->>GHA: publish_if_new(dir)
    GHA->>NPM: "npm view name@ver (check if exists)"
    alt version already published
        NPM-->>GHA: exit 0 (version found)
        GHA->>GHA: skip (idempotent)
    else version not yet published
        NPM-->>GHA: exit 1 (not found)
        GHA->>GHOIDC: Request OIDC token (id-token: write)
        GHOIDC-->>GHA: OIDC JWT
        GHA->>NPM: Exchange OIDC JWT for granular npm token
        NPM-->>GHA: Temporary npm token
        GHA->>NPM: npm publish --access public (with token)
        NPM-->>GHA: 200 OK (published + provenance auto-generated)
    end

Loading

_{Reviews (3): Last reviewed commit: "ci(release): make npm publish idempotent..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/release-please.yml (1)

82-84: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Pin the npm upgrade version instead of latest.

npm install -g npm@latest floats to whatever is newest at run time, which can introduce unvetted/breaking npm CLI behavior into the release pipeline without warning. Since trusted publishing only requires npm ≥ 11.5.1, pin to a known-good version to keep the publish job reproducible. This aligns with the zizmor warning about ad-hoc package installs outside a lockfile.

Proposed fix

       - name: Upgrade npm for trusted publishing
-        run: npm install -g npm@latest
+        run: npm install -g npm@11.6.0

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release-please.yml around lines 82 - 84, The release
workflow’s npm upgrade step uses a floating `latest` install, which makes the
publish job non-reproducible and can pull in unvetted CLI changes. Update the
`Upgrade npm for trusted publishing` step in the workflow to install a specific
known-good npm version that satisfies the trusted publishing requirement (npm >=
11.5.1), keeping the `setup-node`/publish flow stable and predictable.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/release-please.yml:
- Around line 82-84: The release workflow’s npm upgrade step uses a floating
`latest` install, which makes the publish job non-reproducible and can pull in
unvetted CLI changes. Update the `Upgrade npm for trusted publishing` step in
the workflow to install a specific known-good npm version that satisfies the
trusted publishing requirement (npm >= 11.5.1), keeping the `setup-node`/publish
flow stable and predictable.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b3eeb978-90c6-49be-be1b-b55fc007101b

📥 Commits

Reviewing files that changed from the base of the PR and between dfd1588 and 0a9cf4c.

📒 Files selected for processing (1)

• .github/workflows/release-please.yml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud