chore: enable npm trusted publishing#271
Conversation
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughCI/CD configuration updates to support npm registry configuration, switch release workflow from self-hosted to ubuntu-latest runner, upgrade npm to version 11.5.1, and modify the publishing mechanism from pnpm recursive to npm publish with explicit workspace flags. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
package.json (1)
15-15: Explicit workspace allowlist will silently skip newly-added packages.The switch from
pnpm -rto an explicit--workspacelist is intentional per the PR description, but any new workspace package added to the monorepo must also be manually added here or it will be skipped during releases without any error or warning.Consider adding a comment to make the maintenance requirement explicit, or add a CI lint step that diffs
workspacesglob expansion against the allowlist:♻️ Proposed comment addition
-"ci:publish": "npm publish --workspace=@gigadrive/sdk --workspace=@gigadrive/commons --workspace=@gigadrive/network-config --workspace=@gigadrive/build-utils --workspace=@gigadrive/harmony --workspace=gigadrive && node scripts/update-canary-tags.mjs && changeset tag", +// NOTE: When adding a new publishable package, add it as --workspace=<name> here. +"ci:publish": "npm publish --workspace=@gigadrive/sdk --workspace=@gigadrive/commons --workspace=@gigadrive/network-config --workspace=@gigadrive/build-utils --workspace=@gigadrive/harmony --workspace=gigadrive && node scripts/update-canary-tags.mjs && changeset tag",(JSON doesn't support comments natively — a separate
scripts/ci-publish.shwould be a cleaner home for this documentation.)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 15, The ci:publish npm script now uses an explicit --workspace allowlist (the "ci:publish" script and referenced packages like `@gigadrive/sdk`, `@gigadrive/commons`, etc.), which will silently omit newly added packages; update this by either (A) moving the publish logic into a dedicated script (e.g., scripts/ci-publish.sh or scripts/ci-publish.mjs) that documents the maintenance requirement and uses a workspaces glob or clearly lists packages, or (B) add a CI lint step that compares the allowlist in the "ci:publish" script against package.json workspaces (automate detection of missing packages and fail the CI), and include a short inline README or comment in that new script explaining that new packages must be added to the allowlist when intentional..github/actions/setup/action.yaml (1)
21-24: No issue withregistry-urlsupport—migrate to upstreamactions/setup-node@v20+instead.The
useblacksmith/setup-node@v5action fully supports theregistry-urlinput and will correctly write the.npmrcfile and configureNODE_AUTH_TOKENauthentication. However, the Blacksmith team archived this action on October 14, 2025, and recommends migrating back to the upstreamactions/setup-node(which includes all the same functionality and is actively maintained). Consider updating toactions/setup-node@v4or later.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/actions/setup/action.yaml around lines 21 - 24, Replace the archived third-party action usage "uses: useblacksmith/setup-node@v5" with the upstream maintained action "uses: actions/setup-node@v4" (or a later supported release), keeping the same inputs (node-version and registry-url) so .npmrc and NODE_AUTH_TOKEN behavior remains; update the workflow step that references useblacksmith/setup-node@v5 to actions/setup-node@v4 and verify that the existing inputs node-version and registry-url are passed through unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/actions/setup/action.yaml:
- Around line 21-24: Replace the archived third-party action usage "uses:
useblacksmith/setup-node@v5" with the upstream maintained action "uses:
actions/setup-node@v4" (or a later supported release), keeping the same inputs
(node-version and registry-url) so .npmrc and NODE_AUTH_TOKEN behavior remains;
update the workflow step that references useblacksmith/setup-node@v5 to
actions/setup-node@v4 and verify that the existing inputs node-version and
registry-url are passed through unchanged.
In `@package.json`:
- Line 15: The ci:publish npm script now uses an explicit --workspace allowlist
(the "ci:publish" script and referenced packages like `@gigadrive/sdk`,
`@gigadrive/commons`, etc.), which will silently omit newly added packages; update
this by either (A) moving the publish logic into a dedicated script (e.g.,
scripts/ci-publish.sh or scripts/ci-publish.mjs) that documents the maintenance
requirement and uses a workspaces glob or clearly lists packages, or (B) add a
CI lint step that compares the allowlist in the "ci:publish" script against
package.json workspaces (automate detection of missing packages and fail the
CI), and include a short inline README or comment in that new script explaining
that new packages must be added to the allowlist when intentional.
1 participant
Summary\n- use GitHub-hosted runner for OIDC\n- set npm registry in setup action\n- upgrade npm for trusted publishing\n- publish via npm workspaces allowlist\n\n## Testing\n- pnpm format
Summary by CodeRabbit