From f2774cbb8936c8e7e4a308ffd2df27ca5438745b Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Sun, 13 Sep 2026 06:37:30 +0100 Subject: [PATCH] fix(ci): run windows sea steps under bash and disable provenance on the mirror The "Resolve the release tag" step in the sea job used bash-only command substitution with no shell: bash pin, so it ran under PowerShell (the Windows runner default) and failed immediately with "term not recognized" on both windows-latest and windows-11-arm - the same class of mistake already caught and fixed for the smoke step, just missed on this earlier one. The GitHub Packages mirror job failed on every run for a different reason: it rewrites the package name and registry for the mirror publish but left publishConfig.provenance at the real package's own true, inherited from package.json. Generating provenance needs id-token: write, which this job deliberately does not hold (holding it makes pnpm attempt and fail an OIDC exchange GitHub Packages has no counterpart for), so every publish attempt failed before it could even reach npm.pkg.github.com. Disabling provenance in the same rewrite step that already retargets the registry closes the gap. --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index df4b045..00eb062 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -123,6 +123,7 @@ jobs: # The release tag, not the triggering SHA: semantic-release computed the version at release time and the tag names it, while the triggering commit's own package.json still carries the pre-bump version. - name: Resolve the release tag id: tag + shell: bash env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | @@ -228,11 +229,12 @@ jobs: if: steps.mirrored.outputs.already != 'true' run: pnpm build - name: Rewrite package name and registry for the GitHub Packages scope - # GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means the mirror cannot drift from the real package's metadata. publishConfig.registry must be overridden too: it takes precedence over any registry .npmrc sets, so without this the publish silently targets registry.npmjs.org instead — GITHUB_TOKEN is not a credential that registry recognises. + # GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means the mirror cannot drift from the real package's metadata. publishConfig.registry must be overridden too: it takes precedence over any registry .npmrc sets, so without this the publish silently targets registry.npmjs.org instead — GITHUB_TOKEN is not a credential that registry recognises. provenance must be disabled here specifically: it is inherited from the real package's publishConfig (true, for the npmjs.com OIDC flow), but generating it requires id-token: write, which this job deliberately does not hold, and GitHub Packages has no provenance/OIDC story of its own to generate it against regardless. if: steps.mirrored.outputs.already != 'true' run: | npm pkg set name="${MIRROR_NAME}" npm pkg set publishConfig.registry="https://npm.pkg.github.com" + npm pkg set publishConfig.provenance=false --json - name: Publish the mirror if: steps.mirrored.outputs.already != 'true' run: |