Skip to content

fix(ci): run windows sea steps under bash and disable provenance on the mirror #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mearman merged 1 commit into from
Sep 13, 2026
Merged

fix(ci): run windows sea steps under bash and disable provenance on the mirror #18

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,7 @@ jobs:
# The release tag, not the triggering SHA: semantic-release computed the version at release time and the tag names it, while the triggering commit's own package.json still carries the pre-bump version.
- name: Resolve the release tag
id: tag
shell: bash
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
Expand Down Expand Up @@ -228,11 +229,12 @@ jobs:
if: steps.mirrored.outputs.already != 'true'
run: pnpm build
- name: Rewrite package name and registry for the GitHub Packages scope
# GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means the mirror cannot drift from the real package's metadata. publishConfig.registry must be overridden too: it takes precedence over any registry .npmrc sets, so without this the publish silently targets registry.npmjs.org instead — GITHUB_TOKEN is not a credential that registry recognises.
# GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means the mirror cannot drift from the real package's metadata. publishConfig.registry must be overridden too: it takes precedence over any registry .npmrc sets, so without this the publish silently targets registry.npmjs.org instead — GITHUB_TOKEN is not a credential that registry recognises. provenance must be disabled here specifically: it is inherited from the real package's publishConfig (true, for the npmjs.com OIDC flow), but generating it requires id-token: write, which this job deliberately does not hold, and GitHub Packages has no provenance/OIDC story of its own to generate it against regardless.
if: steps.mirrored.outputs.already != 'true'
run: |
npm pkg set name="${MIRROR_NAME}"
npm pkg set publishConfig.registry="https://npm.pkg.github.com"
npm pkg set publishConfig.provenance=false --json
- name: Publish the mirror
if: steps.mirrored.outputs.already != 'true'
run: |
Expand Down
Loading