Repository navigation
Fix CI setup and remove the expiring GitHub Packages token - #366
Merged
Merged
Conversation
The build job has failed at "Get pnpm store directory" since actions/setup-node was bumped to v7: `pnpm store path --silent` now resolves under PNPM_HOME and emits output that `>> $GITHUB_ENV` rejects with "Invalid format". The step sets STORE_PATH, which nothing in any workflow reads — it is left over from a cache step that no longer exists, since `cache: "pnpm"` on setup-node handles the store itself. Removing it rather than repairing it. CI also only triggered on `packages/**`, so it never ran on the action bumps that broke it. Adding its own path so changes to the workflow are validated by it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 39 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (8)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Member
Author
|
Verified on this PR's own CI run (36928282099):
So the workflow bug is fixed and the remaining red is solely the expired |
CI's install failed with ERR_PNPM_FETCH_401 on @casekit/unindent because secrets.GH_PACKAGES_TOKEN had expired. GitHub Packages npm requires a token for every download, public or private, so that one dependency put an expiring PAT in the path of every install — in CI and locally. unindent was the only non-workspace @casekit dependency, pinned to a GitHub Packages preview build. It is also published to public npm, and 1.0.5 is byte-identical to the pinned preview, so this repoints the registry rather than changing the version. Dropping the @casekit scope registry from .npmrc lets the scope resolve from npmjs, and the PAT comes out of all three workflows' install steps. Publishing is unaffected: each package carries its own publishConfig.registry, and publish-preview authenticates its publish step with GITHUB_TOKEN, which is minted per run and never expires. GH_PACKAGES_TOKEN is now referenced nowhere and can be deleted rather than rotated. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Coverage Report
|
rsslldnphy
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI has been red since 3 May, for two independent reasons. This fixes both, and removes the need to ever rotate
GH_PACKAGES_TOKENagain.CI is green on this branch — run 36929994407, the first passing build since May.
Publish Preview Packagespasses too.1. The build died during setup
pnpm store path --silentnow resolves underPNPM_HOMEand emits output>> $GITHUB_ENVwon't accept. This started with theactions/setup-nodev6 → v7 bump in 6334e95.The step set
STORE_PATH, which nothing in any workflow reads — leftover from a cache step that no longer exists, sincecache: "pnpm"onsetup-nodehandles the store itself. Removed rather than repaired.Why it wasn't caught: CI only triggered on
packages/**, and both action bumps touched only.github/**, so CI never ran on the change that broke it..github/workflows/ci.ymlis now in the trigger paths, so the workflow validates its own changes.2. Install failed on an expired PAT
@casekit/unindentwas the only non-workspace@casekitdependency, pinned to a GitHub Packages preview build (0.0.0-gh-packages.634dab0). GitHub Packages' npm registry requires a token for every download, public or private — unlike the container registry, there is no anonymous access. So that single dependency put an expiring PAT in the path of every install, in CI and locally.It is also published to public npm, and
1.0.5is byte-identical to the pinned preview (index.js,unindent.jsand both.d.tsfiles diff clean). So this repoints the registry rather than changing the version:^1.0.5@casekitscope registry comes out of.npmrc, so the scope resolves from npmjsNODE_AUTH_TOKENcomes out of the install step in all three workflowspackages: readcomes off the CI job, which no longer reads packagesVerified locally by installing with
NODE_AUTH_TOKENandNPM_TOKENstripped from the environment:--frozen-lockfilesucceeds, nonpm.pkg.github.comtarballs remain in the lockfile, and tests, typecheck and lint all pass.Publishing is unaffected. Each package carries its own
publishConfig.registry, andpublish-previewauthenticates its publish step withGITHUB_TOKEN, which is minted per run and never expires. Only the install steps ever used the PAT.Action for the maintainer
GH_PACKAGES_TOKENis now referenced nowhere and can be deleted rather than rotated.One thing worth checking before merge
This moves the monorepo from a build of
casekit/unindent@634dab0to npm1.0.5. The outputs are identical today, so nothing changes — but if that commit carries unreleased work, cut a real release first and bump to it here.Unblocks #365, which was red only because of these two failures.
🤖 Generated with Claude Code