elias/oh-my-opencode
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): override env vars to disable token auth, force OIDC

Browse Source
This commit is contained in:
justsisyphus 2026-01-30 12:41:00 +09:00
parent dfed2abd3e
commit db538c7e6b
1 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
.github/workflows/publish-platform.yml vendored
View File

@ -199,14 +199,9 @@ jobs:
run: | run: |
cd packages/${{ matrix.platform }} cd packages/${{ matrix.platform }}
# Remove all .npmrc files created by setup-node to enable pure OIDC auth # Remove .npmrc files created by setup-node
# setup-node sets NPM_CONFIG_USERCONFIG=/home/runner/work/_temp/.npmrc
# with //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
# This breaks OIDC when the token is expired/revoked
rm -f ~/.npmrc rm -f ~/.npmrc
rm -f "$NPM_CONFIG_USERCONFIG" 2>/dev/null || true rm -f /home/runner/work/_temp/.npmrc 2>/dev/null || true
unset NPM_CONFIG_USERCONFIG
unset NODE_AUTH_TOKEN
TAG_ARG="" TAG_ARG=""
if [ -n "${{ inputs.dist_tag }}" ]; then if [ -n "${{ inputs.dist_tag }}" ]; then
@ -214,9 +209,13 @@ jobs:
fi fi
# Publish with provenance (OIDC authentication) # Publish with provenance (OIDC authentication)
# npm 11.5.1+ auto-detects OIDC environment # npm 11.5.1+ auto-detects OIDC environment when no token is present
npm publish --access public --provenance $TAG_ARG npm publish --access public --provenance $TAG_ARG
env: env:
# Override setup-node env vars to disable token-based auth
# This forces npm to use OIDC instead
NPM_CONFIG_USERCONFIG: ""
NODE_AUTH_TOKEN: ""
NPM_CONFIG_PROVENANCE: "true" NPM_CONFIG_PROVENANCE: "true"
npm_config_fetch_timeout: "600000" npm_config_fetch_timeout: "600000"
npm_config_fetch_retry_maxtimeout: "120000" npm_config_fetch_retry_maxtimeout: "120000"