Skip to content

modify release.yml to include new npm granular access token #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
islameldesoky95 merged 2 commits into from
Dec 5, 2025
Merged

modify release.yml to include new npm granular access token #175

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
70e3539
modify release.yml to include new npm granular access token
islameldesoky95 Dec 4, 2025
284cb0c
modify release.yml to include new npm granular access token
islameldesoky95 Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 11 additions & 13 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,25 +1,23 @@
name: release

env:
NODE_JS_VERSION: 20.19.5

on:
release:
types: [ created ]

types: [created]
env:
NODE_JS_VERSION: 20.19.5
jobs:
release:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write # Required for OIDC
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_JS_VERSION }}
Copy link

@pantoaibot pantoaibot bot Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[CRITICAL_BUG] The step uses node-version: ${{ env.NODE_JS_VERSION }} but the global env: NODE_JS_VERSION was removed in this change. This will make actions/setup-node receive an empty/undefined value and likely fail. Restore the env block (env: NODE_JS_VERSION: 20.19.5) at the top of the workflow or replace the reference with a concrete value (e.g. node-version: '20.19.5') so the runner has a deterministic Node version.

name: release

env:
  NODE_JS_VERSION: 20.19.5

on:
  release:
    types: [created]

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # Required for OIDC
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_JS_VERSION }}
          registry-url: 'https://registry.npmjs.org'

      - run: npm ci
      - run: yarn prepare
      - run: npm publish --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}  # Granular token

registry-url: 'https://registry.npmjs.org'

- run: yarn install --frozen-lockfile
- run: npm ci
- run: yarn prepare
Comment on lines +19 to 20
Copy link

@pantoaibot pantoaibot bot Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[REFACTORING] This workflow mixes package managers: it runs npm ci (line 17) then yarn prepare (line 18). Mixing npm and yarn can cause inconsistent dependency resolution (different lockfiles, caches). Choose one install strategy and keep steps consistent: either run npm ci && npm run prepare (if prepare script exists) or use yarn install --frozen-lockfile && yarn prepare. Also align with other workflows (ci.yml uses yarn install) to avoid environment drift.

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_JS_VERSION }}
          registry-url: 'https://registry.npmjs.org'

      - run: yarn install --frozen-lockfile
      - run: yarn prepare
      - run: npm publish --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}  # Granular token

- run: npm ci --legacy-peer-deps
- run: npm publish --access public
- run: npm publish --access public --provenance
Comment on lines +19 to +21
Copy link

@coderabbitai coderabbitai bot Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Inconsistent package manager: yarn used alongside npm in workflow.

Line 17 switches to npm ci, but line 18 still uses yarn prepare. If yarn is not available in the CI environment, this step will fail. Either:

  1. Switch line 18 to npm run prepare (if prepare is defined in package.json scripts)
  2. Or keep yarn installed and update line 17 to use yarn install --frozen-lockfile

This is likely an incomplete migration from yarn to npm.

Apply one of the following fixes:

Option 1: Replace yarn with npm equivalent (recommended)

  - run: npm ci
- - run: yarn prepare
+ - run: npm run prepare
  - run: npm publish --access public --provenance

Option 2: Revert to yarn-based approach

- - run: npm ci
+ - run: yarn install --frozen-lockfile
  - run: yarn prepare
  - run: npm publish --access public --provenance
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- run: npm ci
- run: yarn prepare
- run: npm ci --legacy-peer-deps
- run: npm publish --access public
- run: npm publish --access public --provenance
- run: npm ci
- run: npm run prepare
- run: npm publish --access public --provenance
Suggested change
- run: npm ci
- run: yarn prepare
- run: npm ci --legacy-peer-deps
- run: npm publish --access public
- run: npm publish --access public --provenance
- run: yarn install --frozen-lockfile
- run: yarn prepare
- run: npm publish --access public --provenance
🤖 Prompt for AI Agents 
.github/workflows/release.yml lines 17-19: the workflow mixes npm and yarn (uses
`npm ci` then `yarn prepare`), which can fail if yarn is not available; fix by
either (preferred) replacing the yarn call with the npm equivalent: change `yarn
prepare` to `npm run prepare` (ensure a prepare script exists in package.json),
or if you intend to use yarn across the job, replace `npm ci` with `yarn install
--frozen-lockfile` and ensure subsequent steps use yarn consistently.

env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} # Granular token
Loading