root - chore: defense - stage npm releases with pnpm - #485
Conversation
Switch the release workflow from npm stage publish to pnpm stage publish so Corepack's pinned pnpm 11.20 handles packing and staging. Drop the global npm CLI pin; keep --no-git-checks for detached release tags. Co-authored-by: Jared Wray <me@jaredwray.com>
Point the § 5 pack-and-stage checkbox at PR #485. Co-authored-by: Jared Wray <me@jaredwray.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #485 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 18 18
Lines 2760 2760
Branches 846 837 -9
=========================================
Hits 2760 2760 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 76e38f4002
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # pnpm ≥ 11.3. Prefix with ./ so the tarball is a local path, not GitHub | ||
| # owner/repo shorthand. --no-git-checks: git-checks run even for a tarball | ||
| # and fail on a detached release-tag checkout and on the untracked pack output. | ||
| run: pnpm stage publish ./packed/*.tgz --access public --provenance --no-git-checks |
There was a problem hiding this comment.
On a fresh runner, actions/setup-node with node-version: 24 supplies the Node-bundled npm rather than the previously pinned npm 11.19.0, while pnpm's staging publisher ultimately invokes the npm CLI for the registry operation. I checked the bundled npm 11.4.2 under Node 24.15.0: npm stage --help exits 1 with Unknown command: "stage". Consequently, this release step fails before staging unless the workflow retains an npm version that implements stage publish (or otherwise explicitly provides one).
Useful? React with 👍 / 👎.
2 participants
Summary
Switch the release workflow from
npm stage publishtopnpm stage publishso packing and staging both use Corepack's pinned pnpm 11.20, matching defense-in-depth-nodejs § 5.Status update
DEFENSE_IN_DEPTH.md:.github/workflows/release.yamlpacks then stages withpnpm stage publish ./packed/*.tgz --no-git-checks→ PR #485Changes
npm@11.19.0install used only fornpm stage publishpnpm stage publish ./packed/*.tgz --access public --provenance --no-git-checkssfw npm install --globalfrom the skill template (that job has no checkout or lockfile)Verification
pnpm stage --help(pnpm 11.20.0:pnpm stage publish [<tarball>|<dir>])pnpm pack --pack-destination /tmp/docula-packed→docula-3.0.0.tgzpnpm stage publish ./docula-3.0.0.tgz --access public --provenance --no-git-checks --dry-run→Skip staging docula@3.0.0 (dry run)/+ docula@3.0.0 (would stage)pnpm test(866 tests, 100% coverage)Reference
defense-in-depth-nodejs § 5 (npm publishing — staged
pnpm stage publish)