chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled - #135

Merged
wyattjoh merged 2 commits into
mainfrom
chore/remove-npm-token-auth
Apr 11, 2026
Merged

chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled#135
wyattjoh merged 2 commits into
mainfrom
chore/remove-npm-token-auth

Conversation

@wyattjoh

@wyattjohwyattjoh commented Apr 9, 2026

Copy link
Copy Markdown
Contributor

Removes NODE_AUTH_TOKEN from all three npm publish jobs now that OIDC trusted publishing is configured for the package on npmjs.com.

Do not merge until OIDC trusted publishing is enabled on npmjs.com for this package.

Affects:

  • publish-npm (stable release)
  • canary-publish-npm (canary release)
  • publish (snapshot release)

@wyattjohwyattjoh mentioned this pull request Apr 9, 2026
Merged
@wyattjoh

wyattjoh commented Apr 9, 2026•
edited
Loading

Copy link
Copy Markdown
ContributorAuthor

Stack: npm-publishing-fixes

Part of a stacked PR chain. Do not merge manually.

This was referenced Apr 9, 2026
Merged
Merged
@wyattjoh
wyattjohforce-pushed the chore/remove-npm-token-auth branch from bad8910 to 49ee738CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed the refactor/scripts-releaser branch from 709cdd8 to eb7ba96CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed the chore/remove-npm-token-auth branch from 49ee738 to 62b2b43CompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed the refactor/scripts-releaser branch from eb7ba96 to 26e0afdCompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed the chore/remove-npm-token-auth branch from 62b2b43 to 111830bCompareApril 9, 2026 20:56
@wyattjoh
wyattjohforce-pushed the refactor/scripts-releaser branch 2 times, most recently from 5ea4dbb to 7d8511fCompareApril 9, 2026 21:02
@wyattjoh
wyattjohforce-pushed the chore/remove-npm-token-auth branch from 111830b to 9502bf6CompareApril 9, 2026 21:03
@wyattjoh
wyattjohforce-pushed the refactor/scripts-releaser branch from 7d8511f to f031159CompareApril 9, 2026 21:10
@wyattjoh
wyattjohforce-pushed the chore/remove-npm-token-auth branch from 9502bf6 to c6df875CompareApril 9, 2026 21:10
@wyattjohwyattjoh mentioned this pull request Apr 9, 2026
Merged
@wyattjoh
wyattjohforce-pushed the chore/remove-npm-token-auth branch from c6df875 to 830c98aCompareApril 9, 2026 21:38
@wyattjoh
wyattjohforce-pushed the refactor/scripts-releaser branch from f031159 to 31f96b0CompareApril 9, 2026 21:38
Base automatically changed from refactor/scripts-releaser to mainApril 9, 2026 21:56
@wyattjoh
wyattjohforce-pushed the chore/remove-npm-token-auth branch from 830c98a to 4ae3d0eCompareApril 9, 2026 21:58
@wyattjoh
wyattjoh marked this pull request as ready for review April 9, 2026 21:59
@wyattjoh
wyattjoh marked this pull request as draft April 9, 2026 22:00
@coderabbitai

coderabbitaiBot commented Apr 9, 2026•
edited
Loading

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e76ba2fc-4f0d-4691-8718-30a51d8e2985

📥 Commits

Reviewing files that changed from the base of the PR and between 4ae3d0e and f9175f6.

📒 Files selected for processing (4)
  • .github/workflows/release.yml
  • .github/workflows/snapshot.yml
  • docs/releasing.md
  • scripts/lib/npm.ts
💤 Files with no reviewable changes (1)
  • .github/workflows/snapshot.yml
✅ Files skipped from review due to trivial changes (1)
  • scripts/lib/npm.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/release.yml
📝 Walkthrough

Walkthrough

Consolidates CI workflows by deleting .github/workflows/snapshot.yml and folding snapshot behavior into .github/workflows/release.yml: release.yml now also triggers on issue_comment (snapshot comments starting with !snapshot), uses dynamic job-level concurrency for comment events, gates the versioning job to push events, propagates release_created outputs with simplified references, and implements a snapshot pipeline that validates commenter association, captures PR head SHA and fork status, computes optional snapshot names, builds/signs/smoke-tests artifacts, publishes snapshots via OIDC on ubuntu-latest, and comments/reacts on PRs. Additionally, NODE_AUTH_TOKEN was removed from NPM publish steps in release.yml, scripts/lib/npm.ts adds the --provenance flag to npm publish, and docs/releasing.md was updated to reflect the consolidated workflows.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Title check✅ PassedThe title accurately describes the main change: removing NODE_AUTH_TOKEN from npm publish jobs in favor of OIDC, which aligns with the primary objective of the pull request.
Description check✅ PassedThe description clearly explains the motivation (OIDC trusted publishing now enabled), lists the affected npm publish jobs, and includes an important blocker warning about merge prerequisites.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Comment @coderabbitai help to get the list of available commands and usage tips.

@dominic-clerk

dominic-clerk commented Apr 10, 2026

Copy link
Copy Markdown
Contributor

I have added a commit combining both release workflows (snapshot.yml and release.yml) as npm allows the configuration of only one trusted workflow.

Here's the claude summary of the changes

What changed:

  • Added issue_comment trigger alongside push — snapshot jobs gate on github.event_name == 'issue_comment', release/canary jobs gate on push
  • Snapshot jobs prefixed with snapshot- to avoid name collisions
  • Concurrency group is now dynamic: release-main for pushes, release-snapshot-{PR#} for snapshot comments
  • Removed NODE_AUTH_TOKEN (OIDC replaces it)
  • Deleted snapshot.yml

No behavioral changes to any of the three release channels (stable, canary, snapshot).

@wyattjoh
wyattjoh marked this pull request as ready for review April 11, 2026 03:48
@wyattjoh
wyattjohforce-pushed the chore/remove-npm-token-auth branch from 49b74e1 to f9175f6CompareApril 11, 2026 03:49
@wyattjoh
wyattjoh merged commit 393873b into mainApr 11, 2026
6 checks passed
@wyattjoh
wyattjoh deleted the chore/remove-npm-token-auth branch April 11, 2026 18:32
@dominic-clerkdominic-clerk mentioned this pull request Aug 24, 2026
Merged
3 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dominic-clerkdominic-clerkdominic-clerk approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@dominic-clerk
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled - #135
Merged
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Apr 11, 2026
Merged
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled#135
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
Removes NODE_AUTH_TOKEN from all three npm publish jobs now that OIDC trusted publishing is configured for the package on npmjs.com.
Do not merge until OIDC trusted publishing is enabled on npmjs.com for this package.
Affects:
  • publish-npm (stable release)
  • canary-publish-npm (canary release)
  • publish (snapshot release)
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjoh
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
Stack: npm-publishing-fixes
Part of a stacked PR chain. Do not merge manually.

This was referenced Apr 9, 2026
 Merged

 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
bad8910 to
49ee738CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
709cdd8 to
eb7ba96CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49ee738 to
62b2b43CompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
eb7ba96 to
26e0afdCompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
62b2b43 to
111830bCompareApril 9, 2026 20:56
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
2 times, most recently
from
5ea4dbb to
7d8511fCompareApril 9, 2026 21:02
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
111830b to
9502bf6CompareApril 9, 2026 21:03
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
7d8511f to
f031159CompareApril 9, 2026 21:10
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
9502bf6 to
c6df875CompareApril 9, 2026 21:10
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
c6df875 to
830c98aCompareApril 9, 2026 21:38
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
f031159 to
31f96b0CompareApril 9, 2026 21:38

Base automatically changed from
refactor/scripts-releaser to
mainApril 9, 2026 21:56
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
830c98a to
4ae3d0eCompareApril 9, 2026 21:58
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 9, 2026 21:59
@wyattjoh
wyattjoh
marked this pull request as draft
April 9, 2026 22:00
@coderabbitai
coderabbitaiBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e76ba2fc-4f0d-4691-8718-30a51d8e2985
📥 Commits
Reviewing files that changed from the base of the PR and between 4ae3d0e and f9175f6.
📒 Files selected for processing (4)
  • .github/workflows/release.yml
  • .github/workflows/snapshot.yml
  • docs/releasing.md
  • scripts/lib/npm.ts
💤 Files with no reviewable changes (1)
  • .github/workflows/snapshot.yml
✅ Files skipped from review due to trivial changes (1)
  • scripts/lib/npm.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/release.yml
📝 Walkthrough
Walkthrough
Consolidates CI workflows by deleting .github/workflows/snapshot.yml and folding snapshot behavior into .github/workflows/release.yml: release.yml now also triggers on issue_comment (snapshot comments starting with !snapshot), uses dynamic job-level concurrency for comment events, gates the versioning job to push events, propagates release_created outputs with simplified references, and implements a snapshot pipeline that validates commenter association, captures PR head SHA and fork status, computes optional snapshot names, builds/signs/smoke-tests artifacts, publishes snapshots via OIDC on ubuntu-latest, and comments/reacts on PRs. Additionally, NODE_AUTH_TOKEN was removed from NPM publish steps in release.yml, scripts/lib/npm.ts adds the --provenance flag to npm publish, and docs/releasing.md was updated to reflect the consolidated workflows.
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Title check✅ PassedThe title accurately describes the main change: removing NODE_AUTH_TOKEN from npm publish jobs in favor of OIDC, which aligns with the primary objective of the pull request.
Description check✅ PassedThe description clearly explains the motivation (OIDC trusted publishing now enabled), lists the affected npm publish jobs, and includes an important blocker warning about merge prerequisites.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@dominic-clerk
dominic-clerk
commented
Apr 10, 2026

Copy link


Copy Markdown

Contributor
I have added a commit combining both release workflows (snapshot.yml and release.yml) as npm allows the configuration of only one trusted workflow.
Here's the claude summary of the changes
What changed:
  • Added issue_comment trigger alongside push — snapshot jobs gate on github.event_name == 'issue_comment', release/canary jobs gate on push
  • Snapshot jobs prefixed with snapshot- to avoid name collisions
  • Concurrency group is now dynamic: release-main for pushes, release-snapshot-{PR#} for snapshot comments
  • Removed NODE_AUTH_TOKEN (OIDC replaces it)
  • Deleted snapshot.yml
No behavioral changes to any of the three release channels (stable, canary, snapshot).
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 11, 2026 03:48
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49b74e1 to
f9175f6CompareApril 11, 2026 03:49
@wyattjoh
wyattjoh
merged commit 393873b
into
mainApr 11, 2026

6 checks passed

@wyattjoh
wyattjoh
deleted the

chore/remove-npm-token-auth

branch
April 11, 2026 18:32
@dominic-clerkdominic-clerk
mentioned this pull request
Aug 24, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@dominic-clerkdominic-clerkdominic-clerk approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@dominic-clerk

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled - #135
Merged
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Apr 11, 2026
Merged
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled#135
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
Removes NODE_AUTH_TOKEN from all three npm publish jobs now that OIDC trusted publishing is configured for the package on npmjs.com.
Do not merge until OIDC trusted publishing is enabled on npmjs.com for this package.
Affects:
  • publish-npm (stable release)
  • canary-publish-npm (canary release)
  • publish (snapshot release)
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjoh
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
Stack: npm-publishing-fixes
Part of a stacked PR chain. Do not merge manually.

This was referenced Apr 9, 2026
 Merged

 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
bad8910 to
49ee738CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
709cdd8 to
eb7ba96CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49ee738 to
62b2b43CompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
eb7ba96 to
26e0afdCompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
62b2b43 to
111830bCompareApril 9, 2026 20:56
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
2 times, most recently
from
5ea4dbb to
7d8511fCompareApril 9, 2026 21:02
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
111830b to
9502bf6CompareApril 9, 2026 21:03
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
7d8511f to
f031159CompareApril 9, 2026 21:10
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
9502bf6 to
c6df875CompareApril 9, 2026 21:10
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
c6df875 to
830c98aCompareApril 9, 2026 21:38
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
f031159 to
31f96b0CompareApril 9, 2026 21:38

Base automatically changed from
refactor/scripts-releaser to
mainApril 9, 2026 21:56
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
830c98a to
4ae3d0eCompareApril 9, 2026 21:58
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 9, 2026 21:59
@wyattjoh
wyattjoh
marked this pull request as draft
April 9, 2026 22:00
@coderabbitai
coderabbitaiBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e76ba2fc-4f0d-4691-8718-30a51d8e2985
📥 Commits
Reviewing files that changed from the base of the PR and between 4ae3d0e and f9175f6.
📒 Files selected for processing (4)
  • .github/workflows/release.yml
  • .github/workflows/snapshot.yml
  • docs/releasing.md
  • scripts/lib/npm.ts
💤 Files with no reviewable changes (1)
  • .github/workflows/snapshot.yml
✅ Files skipped from review due to trivial changes (1)
  • scripts/lib/npm.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/release.yml
📝 Walkthrough
Walkthrough
Consolidates CI workflows by deleting .github/workflows/snapshot.yml and folding snapshot behavior into .github/workflows/release.yml: release.yml now also triggers on issue_comment (snapshot comments starting with !snapshot), uses dynamic job-level concurrency for comment events, gates the versioning job to push events, propagates release_created outputs with simplified references, and implements a snapshot pipeline that validates commenter association, captures PR head SHA and fork status, computes optional snapshot names, builds/signs/smoke-tests artifacts, publishes snapshots via OIDC on ubuntu-latest, and comments/reacts on PRs. Additionally, NODE_AUTH_TOKEN was removed from NPM publish steps in release.yml, scripts/lib/npm.ts adds the --provenance flag to npm publish, and docs/releasing.md was updated to reflect the consolidated workflows.
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Title check✅ PassedThe title accurately describes the main change: removing NODE_AUTH_TOKEN from npm publish jobs in favor of OIDC, which aligns with the primary objective of the pull request.
Description check✅ PassedThe description clearly explains the motivation (OIDC trusted publishing now enabled), lists the affected npm publish jobs, and includes an important blocker warning about merge prerequisites.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@dominic-clerk
dominic-clerk
commented
Apr 10, 2026

Copy link


Copy Markdown

Contributor
I have added a commit combining both release workflows (snapshot.yml and release.yml) as npm allows the configuration of only one trusted workflow.
Here's the claude summary of the changes
What changed:
  • Added issue_comment trigger alongside push — snapshot jobs gate on github.event_name == 'issue_comment', release/canary jobs gate on push
  • Snapshot jobs prefixed with snapshot- to avoid name collisions
  • Concurrency group is now dynamic: release-main for pushes, release-snapshot-{PR#} for snapshot comments
  • Removed NODE_AUTH_TOKEN (OIDC replaces it)
  • Deleted snapshot.yml
No behavioral changes to any of the three release channels (stable, canary, snapshot).
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 11, 2026 03:48
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49b74e1 to
f9175f6CompareApril 11, 2026 03:49
@wyattjoh
wyattjoh
merged commit 393873b
into
mainApr 11, 2026

6 checks passed

@wyattjoh
wyattjoh
deleted the

chore/remove-npm-token-auth

branch
April 11, 2026 18:32
@dominic-clerkdominic-clerk
mentioned this pull request
Aug 24, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@dominic-clerkdominic-clerkdominic-clerk approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@dominic-clerk

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled - #135
Merged
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Apr 11, 2026
Merged
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled#135
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
Removes NODE_AUTH_TOKEN from all three npm publish jobs now that OIDC trusted publishing is configured for the package on npmjs.com.
Do not merge until OIDC trusted publishing is enabled on npmjs.com for this package.
Affects:
  • publish-npm (stable release)
  • canary-publish-npm (canary release)
  • publish (snapshot release)
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjoh
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
Stack: npm-publishing-fixes
Part of a stacked PR chain. Do not merge manually.

This was referenced Apr 9, 2026
 Merged

 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
bad8910 to
49ee738CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
709cdd8 to
eb7ba96CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49ee738 to
62b2b43CompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
eb7ba96 to
26e0afdCompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
62b2b43 to
111830bCompareApril 9, 2026 20:56
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
2 times, most recently
from
5ea4dbb to
7d8511fCompareApril 9, 2026 21:02
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
111830b to
9502bf6CompareApril 9, 2026 21:03
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
7d8511f to
f031159CompareApril 9, 2026 21:10
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
9502bf6 to
c6df875CompareApril 9, 2026 21:10
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
c6df875 to
830c98aCompareApril 9, 2026 21:38
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
f031159 to
31f96b0CompareApril 9, 2026 21:38

Base automatically changed from
refactor/scripts-releaser to
mainApril 9, 2026 21:56
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
830c98a to
4ae3d0eCompareApril 9, 2026 21:58
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 9, 2026 21:59
@wyattjoh
wyattjoh
marked this pull request as draft
April 9, 2026 22:00
@coderabbitai
coderabbitaiBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e76ba2fc-4f0d-4691-8718-30a51d8e2985
📥 Commits
Reviewing files that changed from the base of the PR and between 4ae3d0e and f9175f6.
📒 Files selected for processing (4)
  • .github/workflows/release.yml
  • .github/workflows/snapshot.yml
  • docs/releasing.md
  • scripts/lib/npm.ts
💤 Files with no reviewable changes (1)
  • .github/workflows/snapshot.yml
✅ Files skipped from review due to trivial changes (1)
  • scripts/lib/npm.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/release.yml
📝 Walkthrough
Walkthrough
Consolidates CI workflows by deleting .github/workflows/snapshot.yml and folding snapshot behavior into .github/workflows/release.yml: release.yml now also triggers on issue_comment (snapshot comments starting with !snapshot), uses dynamic job-level concurrency for comment events, gates the versioning job to push events, propagates release_created outputs with simplified references, and implements a snapshot pipeline that validates commenter association, captures PR head SHA and fork status, computes optional snapshot names, builds/signs/smoke-tests artifacts, publishes snapshots via OIDC on ubuntu-latest, and comments/reacts on PRs. Additionally, NODE_AUTH_TOKEN was removed from NPM publish steps in release.yml, scripts/lib/npm.ts adds the --provenance flag to npm publish, and docs/releasing.md was updated to reflect the consolidated workflows.
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Title check✅ PassedThe title accurately describes the main change: removing NODE_AUTH_TOKEN from npm publish jobs in favor of OIDC, which aligns with the primary objective of the pull request.
Description check✅ PassedThe description clearly explains the motivation (OIDC trusted publishing now enabled), lists the affected npm publish jobs, and includes an important blocker warning about merge prerequisites.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@dominic-clerk
dominic-clerk
commented
Apr 10, 2026

Copy link


Copy Markdown

Contributor
I have added a commit combining both release workflows (snapshot.yml and release.yml) as npm allows the configuration of only one trusted workflow.
Here's the claude summary of the changes
What changed:
  • Added issue_comment trigger alongside push — snapshot jobs gate on github.event_name == 'issue_comment', release/canary jobs gate on push
  • Snapshot jobs prefixed with snapshot- to avoid name collisions
  • Concurrency group is now dynamic: release-main for pushes, release-snapshot-{PR#} for snapshot comments
  • Removed NODE_AUTH_TOKEN (OIDC replaces it)
  • Deleted snapshot.yml
No behavioral changes to any of the three release channels (stable, canary, snapshot).
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 11, 2026 03:48
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49b74e1 to
f9175f6CompareApril 11, 2026 03:49
@wyattjoh
wyattjoh
merged commit 393873b
into
mainApr 11, 2026

6 checks passed

@wyattjoh
wyattjoh
deleted the

chore/remove-npm-token-auth

branch
April 11, 2026 18:32
@dominic-clerkdominic-clerk
mentioned this pull request
Aug 24, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@dominic-clerkdominic-clerkdominic-clerk approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@dominic-clerk

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled - #135
Merged
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Apr 11, 2026
Merged
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled#135
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
Removes NODE_AUTH_TOKEN from all three npm publish jobs now that OIDC trusted publishing is configured for the package on npmjs.com.
Do not merge until OIDC trusted publishing is enabled on npmjs.com for this package.
Affects:
  • publish-npm (stable release)
  • canary-publish-npm (canary release)
  • publish (snapshot release)
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjoh
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
Stack: npm-publishing-fixes
Part of a stacked PR chain. Do not merge manually.

This was referenced Apr 9, 2026
 Merged

 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
bad8910 to
49ee738CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
709cdd8 to
eb7ba96CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49ee738 to
62b2b43CompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
eb7ba96 to
26e0afdCompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
62b2b43 to
111830bCompareApril 9, 2026 20:56
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
2 times, most recently
from
5ea4dbb to
7d8511fCompareApril 9, 2026 21:02
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
111830b to
9502bf6CompareApril 9, 2026 21:03
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
7d8511f to
f031159CompareApril 9, 2026 21:10
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
9502bf6 to
c6df875CompareApril 9, 2026 21:10
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
c6df875 to
830c98aCompareApril 9, 2026 21:38
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
f031159 to
31f96b0CompareApril 9, 2026 21:38

Base automatically changed from
refactor/scripts-releaser to
mainApril 9, 2026 21:56
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
830c98a to
4ae3d0eCompareApril 9, 2026 21:58
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 9, 2026 21:59
@wyattjoh
wyattjoh
marked this pull request as draft
April 9, 2026 22:00
@coderabbitai
coderabbitaiBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e76ba2fc-4f0d-4691-8718-30a51d8e2985
📥 Commits
Reviewing files that changed from the base of the PR and between 4ae3d0e and f9175f6.
📒 Files selected for processing (4)
  • .github/workflows/release.yml
  • .github/workflows/snapshot.yml
  • docs/releasing.md
  • scripts/lib/npm.ts
💤 Files with no reviewable changes (1)
  • .github/workflows/snapshot.yml
✅ Files skipped from review due to trivial changes (1)
  • scripts/lib/npm.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/release.yml
📝 Walkthrough
Walkthrough
Consolidates CI workflows by deleting .github/workflows/snapshot.yml and folding snapshot behavior into .github/workflows/release.yml: release.yml now also triggers on issue_comment (snapshot comments starting with !snapshot), uses dynamic job-level concurrency for comment events, gates the versioning job to push events, propagates release_created outputs with simplified references, and implements a snapshot pipeline that validates commenter association, captures PR head SHA and fork status, computes optional snapshot names, builds/signs/smoke-tests artifacts, publishes snapshots via OIDC on ubuntu-latest, and comments/reacts on PRs. Additionally, NODE_AUTH_TOKEN was removed from NPM publish steps in release.yml, scripts/lib/npm.ts adds the --provenance flag to npm publish, and docs/releasing.md was updated to reflect the consolidated workflows.
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Title check✅ PassedThe title accurately describes the main change: removing NODE_AUTH_TOKEN from npm publish jobs in favor of OIDC, which aligns with the primary objective of the pull request.
Description check✅ PassedThe description clearly explains the motivation (OIDC trusted publishing now enabled), lists the affected npm publish jobs, and includes an important blocker warning about merge prerequisites.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@dominic-clerk
dominic-clerk
commented
Apr 10, 2026

Copy link


Copy Markdown

Contributor
I have added a commit combining both release workflows (snapshot.yml and release.yml) as npm allows the configuration of only one trusted workflow.
Here's the claude summary of the changes
What changed:
  • Added issue_comment trigger alongside push — snapshot jobs gate on github.event_name == 'issue_comment', release/canary jobs gate on push
  • Snapshot jobs prefixed with snapshot- to avoid name collisions
  • Concurrency group is now dynamic: release-main for pushes, release-snapshot-{PR#} for snapshot comments
  • Removed NODE_AUTH_TOKEN (OIDC replaces it)
  • Deleted snapshot.yml
No behavioral changes to any of the three release channels (stable, canary, snapshot).
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 11, 2026 03:48
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49b74e1 to
f9175f6CompareApril 11, 2026 03:49
@wyattjoh
wyattjoh
merged commit 393873b
into
mainApr 11, 2026

6 checks passed

@wyattjoh
wyattjoh
deleted the

chore/remove-npm-token-auth

branch
April 11, 2026 18:32
@dominic-clerkdominic-clerk
mentioned this pull request
Aug 24, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@dominic-clerkdominic-clerkdominic-clerk approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@dominic-clerk

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled - #135
Merged
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Apr 11, 2026
Merged
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled#135
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
Removes NODE_AUTH_TOKEN from all three npm publish jobs now that OIDC trusted publishing is configured for the package on npmjs.com.
Do not merge until OIDC trusted publishing is enabled on npmjs.com for this package.
Affects:
  • publish-npm (stable release)
  • canary-publish-npm (canary release)
  • publish (snapshot release)
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjoh
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
Stack: npm-publishing-fixes
Part of a stacked PR chain. Do not merge manually.

This was referenced Apr 9, 2026
 Merged

 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
bad8910 to
49ee738CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
709cdd8 to
eb7ba96CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49ee738 to
62b2b43CompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
eb7ba96 to
26e0afdCompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
62b2b43 to
111830bCompareApril 9, 2026 20:56
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
2 times, most recently
from
5ea4dbb to
7d8511fCompareApril 9, 2026 21:02
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
111830b to
9502bf6CompareApril 9, 2026 21:03
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
7d8511f to
f031159CompareApril 9, 2026 21:10
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
9502bf6 to
c6df875CompareApril 9, 2026 21:10
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
c6df875 to
830c98aCompareApril 9, 2026 21:38
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
f031159 to
31f96b0CompareApril 9, 2026 21:38

Base automatically changed from
refactor/scripts-releaser to
mainApril 9, 2026 21:56
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
830c98a to
4ae3d0eCompareApril 9, 2026 21:58
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 9, 2026 21:59
@wyattjoh
wyattjoh
marked this pull request as draft
April 9, 2026 22:00
@coderabbitai
coderabbitaiBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e76ba2fc-4f0d-4691-8718-30a51d8e2985
📥 Commits
Reviewing files that changed from the base of the PR and between 4ae3d0e and f9175f6.
📒 Files selected for processing (4)
  • .github/workflows/release.yml
  • .github/workflows/snapshot.yml
  • docs/releasing.md
  • scripts/lib/npm.ts
💤 Files with no reviewable changes (1)
  • .github/workflows/snapshot.yml
✅ Files skipped from review due to trivial changes (1)
  • scripts/lib/npm.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/release.yml
📝 Walkthrough
Walkthrough
Consolidates CI workflows by deleting .github/workflows/snapshot.yml and folding snapshot behavior into .github/workflows/release.yml: release.yml now also triggers on issue_comment (snapshot comments starting with !snapshot), uses dynamic job-level concurrency for comment events, gates the versioning job to push events, propagates release_created outputs with simplified references, and implements a snapshot pipeline that validates commenter association, captures PR head SHA and fork status, computes optional snapshot names, builds/signs/smoke-tests artifacts, publishes snapshots via OIDC on ubuntu-latest, and comments/reacts on PRs. Additionally, NODE_AUTH_TOKEN was removed from NPM publish steps in release.yml, scripts/lib/npm.ts adds the --provenance flag to npm publish, and docs/releasing.md was updated to reflect the consolidated workflows.
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Title check✅ PassedThe title accurately describes the main change: removing NODE_AUTH_TOKEN from npm publish jobs in favor of OIDC, which aligns with the primary objective of the pull request.
Description check✅ PassedThe description clearly explains the motivation (OIDC trusted publishing now enabled), lists the affected npm publish jobs, and includes an important blocker warning about merge prerequisites.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@dominic-clerk
dominic-clerk
commented
Apr 10, 2026

Copy link


Copy Markdown

Contributor
I have added a commit combining both release workflows (snapshot.yml and release.yml) as npm allows the configuration of only one trusted workflow.
Here's the claude summary of the changes
What changed:
  • Added issue_comment trigger alongside push — snapshot jobs gate on github.event_name == 'issue_comment', release/canary jobs gate on push
  • Snapshot jobs prefixed with snapshot- to avoid name collisions
  • Concurrency group is now dynamic: release-main for pushes, release-snapshot-{PR#} for snapshot comments
  • Removed NODE_AUTH_TOKEN (OIDC replaces it)
  • Deleted snapshot.yml
No behavioral changes to any of the three release channels (stable, canary, snapshot).
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 11, 2026 03:48
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49b74e1 to
f9175f6CompareApril 11, 2026 03:49
@wyattjoh
wyattjoh
merged commit 393873b
into
mainApr 11, 2026

6 checks passed

@wyattjoh
wyattjoh
deleted the

chore/remove-npm-token-auth

branch
April 11, 2026 18:32
@dominic-clerkdominic-clerk
mentioned this pull request
Aug 24, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@dominic-clerkdominic-clerkdominic-clerk approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@dominic-clerk

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled - #135
Merged
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Apr 11, 2026
Merged
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled#135
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
Removes NODE_AUTH_TOKEN from all three npm publish jobs now that OIDC trusted publishing is configured for the package on npmjs.com.
Do not merge until OIDC trusted publishing is enabled on npmjs.com for this package.
Affects:
  • publish-npm (stable release)
  • canary-publish-npm (canary release)
  • publish (snapshot release)
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjoh
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
Stack: npm-publishing-fixes
Part of a stacked PR chain. Do not merge manually.

This was referenced Apr 9, 2026
 Merged

 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
bad8910 to
49ee738CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
709cdd8 to
eb7ba96CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49ee738 to
62b2b43CompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
eb7ba96 to
26e0afdCompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
62b2b43 to
111830bCompareApril 9, 2026 20:56
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
2 times, most recently
from
5ea4dbb to
7d8511fCompareApril 9, 2026 21:02
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
111830b to
9502bf6CompareApril 9, 2026 21:03
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
7d8511f to
f031159CompareApril 9, 2026 21:10
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
9502bf6 to
c6df875CompareApril 9, 2026 21:10
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
c6df875 to
830c98aCompareApril 9, 2026 21:38
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
f031159 to
31f96b0CompareApril 9, 2026 21:38

Base automatically changed from
refactor/scripts-releaser to
mainApril 9, 2026 21:56
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
830c98a to
4ae3d0eCompareApril 9, 2026 21:58
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 9, 2026 21:59
@wyattjoh
wyattjoh
marked this pull request as draft
April 9, 2026 22:00
@coderabbitai
coderabbitaiBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e76ba2fc-4f0d-4691-8718-30a51d8e2985
📥 Commits
Reviewing files that changed from the base of the PR and between 4ae3d0e and f9175f6.
📒 Files selected for processing (4)
  • .github/workflows/release.yml
  • .github/workflows/snapshot.yml
  • docs/releasing.md
  • scripts/lib/npm.ts
💤 Files with no reviewable changes (1)
  • .github/workflows/snapshot.yml
✅ Files skipped from review due to trivial changes (1)
  • scripts/lib/npm.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/release.yml
📝 Walkthrough
Walkthrough
Consolidates CI workflows by deleting .github/workflows/snapshot.yml and folding snapshot behavior into .github/workflows/release.yml: release.yml now also triggers on issue_comment (snapshot comments starting with !snapshot), uses dynamic job-level concurrency for comment events, gates the versioning job to push events, propagates release_created outputs with simplified references, and implements a snapshot pipeline that validates commenter association, captures PR head SHA and fork status, computes optional snapshot names, builds/signs/smoke-tests artifacts, publishes snapshots via OIDC on ubuntu-latest, and comments/reacts on PRs. Additionally, NODE_AUTH_TOKEN was removed from NPM publish steps in release.yml, scripts/lib/npm.ts adds the --provenance flag to npm publish, and docs/releasing.md was updated to reflect the consolidated workflows.
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Title check✅ PassedThe title accurately describes the main change: removing NODE_AUTH_TOKEN from npm publish jobs in favor of OIDC, which aligns with the primary objective of the pull request.
Description check✅ PassedThe description clearly explains the motivation (OIDC trusted publishing now enabled), lists the affected npm publish jobs, and includes an important blocker warning about merge prerequisites.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@dominic-clerk
dominic-clerk
commented
Apr 10, 2026

Copy link


Copy Markdown

Contributor
I have added a commit combining both release workflows (snapshot.yml and release.yml) as npm allows the configuration of only one trusted workflow.
Here's the claude summary of the changes
What changed:
  • Added issue_comment trigger alongside push — snapshot jobs gate on github.event_name == 'issue_comment', release/canary jobs gate on push
  • Snapshot jobs prefixed with snapshot- to avoid name collisions
  • Concurrency group is now dynamic: release-main for pushes, release-snapshot-{PR#} for snapshot comments
  • Removed NODE_AUTH_TOKEN (OIDC replaces it)
  • Deleted snapshot.yml
No behavioral changes to any of the three release channels (stable, canary, snapshot).
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 11, 2026 03:48
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49b74e1 to
f9175f6CompareApril 11, 2026 03:49
@wyattjoh
wyattjoh
merged commit 393873b
into
mainApr 11, 2026

6 checks passed

@wyattjoh
wyattjoh
deleted the

chore/remove-npm-token-auth

branch
April 11, 2026 18:32
@dominic-clerkdominic-clerk
mentioned this pull request
Aug 24, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@dominic-clerkdominic-clerkdominic-clerk approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@dominic-clerk

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled - #135
Merged
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Apr 11, 2026
Merged
chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled#135
wyattjoh merged 2 commits into
mainfrom 
chore/remove-npm-token-auth
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
Removes NODE_AUTH_TOKEN from all three npm publish jobs now that OIDC trusted publishing is configured for the package on npmjs.com.
Do not merge until OIDC trusted publishing is enabled on npmjs.com for this package.
Affects:
  • publish-npm (stable release)
  • canary-publish-npm (canary release)
  • publish (snapshot release)
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjoh
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
Stack: npm-publishing-fixes
Part of a stacked PR chain. Do not merge manually.

This was referenced Apr 9, 2026
 Merged

 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
bad8910 to
49ee738CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
709cdd8 to
eb7ba96CompareApril 9, 2026 20:51
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49ee738 to
62b2b43CompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
eb7ba96 to
26e0afdCompareApril 9, 2026 20:52
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
62b2b43 to
111830bCompareApril 9, 2026 20:56
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
2 times, most recently
from
5ea4dbb to
7d8511fCompareApril 9, 2026 21:02
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
111830b to
9502bf6CompareApril 9, 2026 21:03
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
7d8511f to
f031159CompareApril 9, 2026 21:10
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
9502bf6 to
c6df875CompareApril 9, 2026 21:10
@wyattjohwyattjoh
mentioned this pull request
Apr 9, 2026
 Merged

@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
c6df875 to
830c98aCompareApril 9, 2026 21:38
@wyattjoh
wyattjohforce-pushed
the
refactor/scripts-releaser
branch
from
f031159 to
31f96b0CompareApril 9, 2026 21:38

Base automatically changed from
refactor/scripts-releaser to
mainApril 9, 2026 21:56
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
830c98a to
4ae3d0eCompareApril 9, 2026 21:58
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 9, 2026 21:59
@wyattjoh
wyattjoh
marked this pull request as draft
April 9, 2026 22:00
@coderabbitai
coderabbitaiBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e76ba2fc-4f0d-4691-8718-30a51d8e2985
📥 Commits
Reviewing files that changed from the base of the PR and between 4ae3d0e and f9175f6.
📒 Files selected for processing (4)
  • .github/workflows/release.yml
  • .github/workflows/snapshot.yml
  • docs/releasing.md
  • scripts/lib/npm.ts
💤 Files with no reviewable changes (1)
  • .github/workflows/snapshot.yml
✅ Files skipped from review due to trivial changes (1)
  • scripts/lib/npm.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/release.yml
📝 Walkthrough
Walkthrough
Consolidates CI workflows by deleting .github/workflows/snapshot.yml and folding snapshot behavior into .github/workflows/release.yml: release.yml now also triggers on issue_comment (snapshot comments starting with !snapshot), uses dynamic job-level concurrency for comment events, gates the versioning job to push events, propagates release_created outputs with simplified references, and implements a snapshot pipeline that validates commenter association, captures PR head SHA and fork status, computes optional snapshot names, builds/signs/smoke-tests artifacts, publishes snapshots via OIDC on ubuntu-latest, and comments/reacts on PRs. Additionally, NODE_AUTH_TOKEN was removed from NPM publish steps in release.yml, scripts/lib/npm.ts adds the --provenance flag to npm publish, and docs/releasing.md was updated to reflect the consolidated workflows.
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Title check✅ PassedThe title accurately describes the main change: removing NODE_AUTH_TOKEN from npm publish jobs in favor of OIDC, which aligns with the primary objective of the pull request.
Description check✅ PassedThe description clearly explains the motivation (OIDC trusted publishing now enabled), lists the affected npm publish jobs, and includes an important blocker warning about merge prerequisites.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@dominic-clerk
dominic-clerk
commented
Apr 10, 2026

Copy link


Copy Markdown

Contributor
I have added a commit combining both release workflows (snapshot.yml and release.yml) as npm allows the configuration of only one trusted workflow.
Here's the claude summary of the changes
What changed:
  • Added issue_comment trigger alongside push — snapshot jobs gate on github.event_name == 'issue_comment', release/canary jobs gate on push
  • Snapshot jobs prefixed with snapshot- to avoid name collisions
  • Concurrency group is now dynamic: release-main for pushes, release-snapshot-{PR#} for snapshot comments
  • Removed NODE_AUTH_TOKEN (OIDC replaces it)
  • Deleted snapshot.yml
No behavioral changes to any of the three release channels (stable, canary, snapshot).
@wyattjoh
wyattjoh
marked this pull request as ready for review
April 11, 2026 03:48
@wyattjoh
wyattjohforce-pushed
the
chore/remove-npm-token-auth
branch
from
49b74e1 to
f9175f6CompareApril 11, 2026 03:49
@wyattjoh
wyattjoh
merged commit 393873b
into
mainApr 11, 2026

6 checks passed

@wyattjoh
wyattjoh
deleted the

chore/remove-npm-token-auth

branch
April 11, 2026 18:32
@dominic-clerkdominic-clerk
mentioned this pull request
Aug 24, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@dominic-clerkdominic-clerkdominic-clerk approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@dominic-clerk