fix(ci): run windows sea steps under bash and disable provenance on the mirror - #18
Merged
Merged
Conversation
…he mirror The "Resolve the release tag" step in the sea job used bash-only command substitution with no shell: bash pin, so it ran under PowerShell (the Windows runner default) and failed immediately with "term not recognized" on both windows-latest and windows-11-arm - the same class of mistake already caught and fixed for the smoke step, just missed on this earlier one. The GitHub Packages mirror job failed on every run for a different reason: it rewrites the package name and registry for the mirror publish but left publishConfig.provenance at the real package's own true, inherited from package.json. Generating provenance needs id-token: write, which this job deliberately does not hold (holding it makes pnpm attempt and fail an OIDC exchange GitHub Packages has no counterpart for), so every publish attempt failed before it could even reach npm.pkg.github.com. Disabling provenance in the same rewrite step that already retargets the registry closes the gap.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
🎉 This PR is included in version 1.1.8 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two real failures from the last post-merge run:
shell: bashpin, the same mistake already caught for the smoke step but missed here.publishConfig.provenance: truefrom the real package.json, but generating provenance needsid-token: write, which this job deliberately excludes (holding it breaks the GITHUB_TOKEN fallback GitHub Packages actually needs). Disabling provenance in the same step that retargets the registry fixes it.(macos-13 showed cancelled on that run, not failed — the workflow's own
concurrency: cancel-in-progressgroup superseded it when this fix's own push started a newer run on the same ref.)Test plan