Repository navigation
chore(release): 0.0.1-beta.35 — npm trusted publishing - #16
Merged
Merged
Conversation
…ublished beta.34 NPM_TOKEN (granular, set 2026-05-22) expired, so the v0.0.1-beta.34 publish was rejected with E404 PUT and beta.34 never reached npm. Publish via OIDC trusted publishing instead (npm >= 11.5.1, already has id-token: write), and publish straight to `latest` since OIDC cannot run `npm dist-tag`. Includes PR #15 (local stop kills the npx Playground process group). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (5 files)
Reviewed by nemotron-3-ultra-550b-a55b:free · Input: 173.6K · Output: 5K · Cached: 185.8K |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The v0.0.1-beta.34 publish failed:
npm error 404 PUT https://registry.npmjs.org/@instawp%2fcli(run 38204319727). Build, tests and pack all passed. When a token is supplied, a 404 on PUT is npm rejecting the credential.NPM_TOKENwas last set on 2026-05-22, and npm granular write tokens last at most 90 days, so it had expired. beta.33 (07-28) was the last good publish, and beta.34 never reached npm.Change
publish.yml: authenticate with npm trusted publishing (OIDC) instead ofNPM_TOKEN. The job already hadid-token: write. This addsnpm install -g npm@^11.5.1before publishing, because Node 22 ships npm 10.latest, and drop the step that movedlatestwithnpm dist-tag add: OIDC only coversnpm publish, andlatestis whatnpm i -g,instawp upgradeand the update notifier read. Thebetadist-tag stays at beta.33; nothing in the repo reads it.Prerequisite (human, npmjs.com)
@instawp/cli→ Settings → Trusted Publisher → GitHub Actions: orgInstaWP, repocli, workflowpublish.yml, environment blank. Without this, the tag's publish step fails again. The fix is then to re-run the failed job on the same tag; no new tag is needed.Agentric session: https://aos.agents.instawp.net/#/sessions/aos-ses_38c321a35dad3faa
🤖 Generated with Claude Code