feat(npm): add token-less publishing with trustedPublishing flag#36
Merged
SavelevMatthew merged 8 commits intomainfrom Mar 17, 2026
Merged
feat(npm): add token-less publishing with trustedPublishing flag#36SavelevMatthew merged 8 commits intomainfrom
SavelevMatthew merged 8 commits intomainfrom
Conversation
WalkthroughBroadened Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant CLI as "mono-pub CLI"
participant FS as "FileSystem"
participant NPM as "npm (registry/cli)"
CLI->>CLI: read config (trustedPublishing?)
CLI->>FS: check for npmrc file
alt trustedPublishing = true
CLI->>NPM: run publish without NPM_TOKEN (env = {}) and omit --userconfig if no npmrc
else trustedPublishing = false
CLI->>FS: read NPM_TOKEN from env
alt npmrc exists
CLI->>NPM: run publish with --userconfig <file> and env {NPM_TOKEN}
else
CLI->>NPM: run publish without --userconfig and env {NPM_TOKEN}
end
end
NPM-->>CLI: publish result
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
packages/npm/src/index.ts (1)
93-99: Consider documenting thetrustedPublishingoption.The JSDoc for
npm()doesn't describe the newtrustedPublishingflag. Users might benefit from documentation explaining when to use this option (e.g., with GitHub Actions OIDC for token-less publishing) and that it should typically be combined withprovenance: true.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/npm/src/index.ts` around lines 93 - 99, Update the JSDoc for the exported npm() factory to document the new trustedPublishing flag on the config object: describe what trustedPublishing does, when to use it (e.g., GitHub Actions OIDC token-less publishing), and note the recommended pairing with provenance: true; reference the npm(config?: Partial<MonoPubNpmConfig>) signature and the MonoPubNpm class so consumers know the flag is passed into that implementation and how it affects publishing behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@packages/npm/src/index.ts`:
- Around line 93-99: Update the JSDoc for the exported npm() factory to document
the new trustedPublishing flag on the config object: describe what
trustedPublishing does, when to use it (e.g., GitHub Actions OIDC token-less
publishing), and note the recommended pairing with provenance: true; reference
the npm(config?: Partial<MonoPubNpmConfig>) signature and the MonoPubNpm class
so consumers know the flag is passed into that implementation and how it affects
publishing behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 146633c6-8a9d-4bbe-9e67-602e1440a8b6
📒 Files selected for processing (5)
packages/commit-analyzer/package.jsonpackages/git/package.jsonpackages/github/package.jsonpackages/npm/package.jsonpackages/npm/src/index.ts
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/github/src/utils.ts (1)
74-80:⚠️ Potential issue | 🔴 CriticalBug: Checking wrong response variable after
getCommitcall.Line 78 checks
response.status(fromlistCommits) instead ofcommitResponse.status(fromgetCommit). Similarly, line 79 referencesresponse.datainstead ofcommitResponse.data. This means errors from thegetCommitcall are never caught, and if the condition were triggered, it would show data from the wrong API call.🐛 Proposed fix
const commitResponse = await octokit.repos.getCommit({ ...repoInfo, ref: sha, }) - if (response.status !== 200) { - throw new Error(`Could not fetch commit info. Details: ${JSON.stringify(response.data)}`) + if (commitResponse.status !== 200) { + throw new Error(`Could not fetch commit info. Details: ${JSON.stringify(commitResponse.data)}`) }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/github/src/utils.ts` around lines 74 - 80, The check after the octokit.repos.getCommit call is using the wrong variable (`response`) from the prior listCommits call; update the status/data checks to use the `commitResponse` returned by `getCommit` (i.e., test `commitResponse.status !== 200` and reference `commitResponse.data` in the error message) so errors from `getCommit` are correctly detected and logged; ensure this change is applied in the block that calls `getCommit` where `commitResponse` is defined.
🧹 Nitpick comments (1)
packages/npm/src/index.ts (1)
76-90: Consider couplingtrustedPublishingwithprovenancevalidation.The publish logic correctly handles the environment and config file conditionally. When
trustedPublishing: true, passing an emptyenvobject to execa allows npm to use the ambient OIDC credentials from GitHub Actions.One consideration: trusted publishing is typically used alongside
--provenancesince both leverage the same OIDC infrastructure. If a user enablestrustedPublishing: truebut forgetsprovenance: true, publishing will work but miss the attestation benefit.Consider either:
- Logging a warning if
trustedPublishingis enabled withoutprovenance- Documenting that these options are complementary
💡 Optional: Add a warning for missing provenance
In the constructor or setup method:
constructor(config?: Partial<MonoPubNpmConfig>) { setGracefulCleanup() const tmpDir = dirSync() this.npmConfigFile = path.join(tmpDir.name, '.npmrc') this.config = { ...DEFAULT_NPM_CONFIG, ...config } + if (this.config.trustedPublishing && !this.config.provenance) { + console.warn('trustedPublishing is enabled without provenance. Consider enabling provenance for build attestations.') + } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/npm/src/index.ts` around lines 76 - 90, When trustedPublishing is enabled but provenance is not, emit a clear warning so users know they are missing attestation; before calling execa in the publish flow (the block that builds args/env and invokes execa('npm', args, { cwd: runDir, env })), detect this.config.trustedPublishing === true && !this.config.provenance and call the logger (e.g., this.logger.warn or processLogger.warn) with a concise message explaining that trustedPublishing works best with --provenance and recommending enabling provenance; alternatively place the same check in the constructor/initialization path to surface the warning earlier.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/github/src/utils.ts`:
- Around line 74-80: The check after the octokit.repos.getCommit call is using
the wrong variable (`response`) from the prior listCommits call; update the
status/data checks to use the `commitResponse` returned by `getCommit` (i.e.,
test `commitResponse.status !== 200` and reference `commitResponse.data` in the
error message) so errors from `getCommit` are correctly detected and logged;
ensure this change is applied in the block that calls `getCommit` where
`commitResponse` is defined.
---
Nitpick comments:
In `@packages/npm/src/index.ts`:
- Around line 76-90: When trustedPublishing is enabled but provenance is not,
emit a clear warning so users know they are missing attestation; before calling
execa in the publish flow (the block that builds args/env and invokes
execa('npm', args, { cwd: runDir, env })), detect this.config.trustedPublishing
=== true && !this.config.provenance and call the logger (e.g., this.logger.warn
or processLogger.warn) with a concise message explaining that trustedPublishing
works best with --provenance and recommending enabling provenance; alternatively
place the same check in the constructor/initialization path to surface the
warning earlier.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 698b9507-82dd-47a4-ab3a-2a99e2b72c42
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (8)
bin/publish.jspackages/git/package.jsonpackages/git/src/index.tspackages/github/package.jsonpackages/github/src/utils.tspackages/mono-pub/package.jsonpackages/npm/package.jsonpackages/npm/src/index.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- packages/npm/package.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
trustedPublishingoption for npm publishing, allowing setup to continue without an npm token when enabled.Chores
Bug Fixes