fix(scripts): disable npm provenance for private repo - #140
Conversation
npm publish --provenance requires the source repository to be public. clerk/cli is currently private, so sigstore rejects publishes with E422. Remove the flag for now. It will be re-enabled once the repo is public and OIDC trusted publishing replaces NODE_AUTH_TOKEN.
- Move targets to scripts/lib/targets.ts (shared by build, sign-macos, and releaser) - Move run() and publish() helpers into scripts/lib/npm.ts alongside the existing isPublished() - Flatten scripts/releaser/index.ts to scripts/releaser.ts now that the directory only held one file - Update import paths in build.ts, sign-macos.ts, and package.json
|
Stack: npm-publishing-fixes Part of a stacked PR chain. Do not merge manually. |
|
Opened from wrong branch. Recreating from fix/disable-npm-provenance. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThis change refactors the release infrastructure by consolidating npm publishing logic into reusable helper functions in Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Comment |
Summary
--provenancefromnpm publishinscripts/releaser/index.tsWhy
npm publish --provenancerequires the source repository to be public.clerk/cliis currently private, so sigstore rejects publishes withE422 Unprocessable Entity. The flag is removed with a comment pointing to when it should be re-enabled: once the repo is public and OIDC trusted publishing replacesNODE_AUTH_TOKEN(see the follow-up PR in this stack).