charlie: update npm publishing strategy

[shellscape]

@CharlieHelps npm recently revoked all classic tokens which allowed us to publish to npm from github actions. refactor the release.yml workflow to support id-token: write, remove NPM_TOKEN and NODE_AUTH_TOKEN use from the workflow and the repository.

[charliecreates]

Expand this to see my work.

• Maintained the OIDC-focused changes in .github/workflows/release.yml, .moon/tasks.yml, .npmrc, and scripts/release-publish.sh, keeping all NPM_TOKEN / NODE_AUTH_TOKEN usage removed in line with #395.
• Updated the Moon release task in .moon/tasks.yml so the command now chains versioner --target "$projectRoot" --publish=false && ../../scripts/release-publish.sh "$projectRoot", ensuring release-publish.sh only runs if versioner succeeds and making failure ordering explicit.
• Extended scripts/release-publish.sh to verify pnpm is available via command -v pnpm with a clear error message before proceeding, then log both Packing to $PACK_DIR and Running pnpm pack in $project_root prior to pnpm pack --pack-destination "$PACK_DIR" for better CI debuggability.
• Re-ran pnpm exec prettier --check .moon/tasks.yml to confirm the updated release task YAML stays formatted correctly and executed bash -n scripts/release-publish.sh to validate the modified shell script parses cleanly.
• Clarified in review comments that .github/workflows/release.yml pins npm@11.5.1 specifically to guarantee npm publish --provenance support on GitHub runners, and that contents: write remains scoped to the release job for versioner commits/tags.
• Refined scripts/release-publish.sh to drop npx and instead use a pinned npm CLI via pnpm dlx "$NPM_CLI_SPEC" publish --provenance, then validated formatting and shell parsing with pnpm exec prettier --check .github/workflows/release.yml .moon/tasks.yml and bash -n scripts/release.sh scripts/release-publish.sh.
• Added a POSIX-shell note to the release task in .moon/tasks.yml, clarified local auth expectations in .npmrc with a ~/.npmrc comment, expanded scripts/release.sh to require both pnpm and node in a loop, and re-validated with pnpm exec prettier --check .moon/tasks.yml plus bash -n scripts/release.sh (both passing).
• Inserted a clarifying comment above the Release step in .github/workflows/release.yml explaining that npm auth is handled via GitHub OIDC in scripts/release*.sh (no NPM_TOKEN needed), and confirmed formatting via pnpm exec prettier --check .github/workflows/release.yml.
• Addressed self-review feedback by documenting the OIDC permission policy in .github/workflows/release.yml (jobs needing npm OIDC must request id-token: write), expanding the always-auth explanation in .npmrc so contributors know they need valid ~/.npmrc credentials for private/publish flows, and logging the resolved NPM_CLI_SPEC in scripts/release-publish.sh before the pnpm dlx publish call for better CI observability.
• Opened PR #396 (fix(repo): publish releases to npm via OIDC) containing the release.yml / .npmrc / .moon/tasks.yml / scripts/release*.sh changes, requested review from shellscape and CharlieHelps, and documented the verification steps (pnpm exec prettier --check ... and bash -n scripts/release.sh scripts/release-publish.sh) in the PR body.

[charliecreates]

Opened PR #396 to switch the release pipeline over to npm OIDC publishing (no classic tokens), per #395.

Changes

• Updated .github/workflows/release.yml to request id-token: write at the job level (OIDC) and removed NPM_TOKEN/NODE_AUTH_TOKEN usage.
• Removed the repo-level npm token config from .npmrc (and added clarifying comments about auth expectations).
• Updated the Moon release task to run scripts/release.sh, which:
  • runs versioner --publish=false
  • packs with pnpm pack (so workspace: deps are rewritten)
  • publishes via pnpm dlx npm@11.5.1 publish --provenance using OIDC
  • refuses to publish outside GitHub Actions unless ALLOW_LOCAL_PUBLISH=1 is set

Note: for the publish to succeed, npm “Trusted Publisher” / OIDC needs to be configured on the npm side for these packages to allow publishes from this repo/workflow.

Verification

# Install: OK
$ pnpm install --frozen-lockfile

# Prettier: All matched files use Prettier code style!
$ pnpm exec prettier --check .github/workflows/release.yml .moon/tasks.yml

# Shell syntax: OK
$ bash -n scripts/release.sh scripts/release-publish.sh

[shellscape]

@CharlieHelps see the error logs in this attempted publish https://github.com/shellscape/jsx-email/actions/runs/20900410369/job/60045408544

Then examine the versioner source code here https://github.com/shellscape/dot/tree/master/packages/versioner.

Triage why this workflow failed and report in a comment in this issue.

[charliecreates]

Expand this to see my work.

• Inspected the workflow logs for the failed Release Projects run linked from issue #395 to understand at which step the publish attempt stopped and what error surfaced.
• Searched the repo for versioner usage and confirmed the Moon task wiring in .moon/tasks.yml, where the release task runs versioner --target $projectRoot after ~:build.
• Reviewed the release task configuration in .moon/tasks.yml to see that it disables caching and runs dependencies serially, which helps narrow down whether the failure is in build vs. the versioner invocation itself.
• Fetched metadata for the workflow run head commit f6391f3e3a8de5429d22101e47e184d7263dec01 via gh api, confirming it corresponds to "chore(jsx-email): upgrade react-router-dom to 7.12.0 (chore: upgrade react-router-dom to 7.12.0 #394)" and identifying its parent 1232d5ff5ff67e90e14cf02f1ec46183c10c4739 for context on what @dot/versioner was diffing against.
• Cloned shellscape/dot locally and verified the layout of packages/versioner to work against the current @dot/versioner implementation.
• Searched packages/versioner/src for publish usage and located the publish helper plus its invocation within versioner.ts.
• Reviewed the argv parsing in packages/versioner/src/versioner.ts to see that publish and push behavior are controlled via yargs-parser flags (dry, publish, push, tag).
• Examined the publish function in packages/versioner/src/versioner.ts and confirmed it calls pnpm publish --no-git-checks unless --dry is passed or --publish=false is explicitly set on the CLI, in which case it logs {yellow Skipping Publish} instead.
• Probed the GitHub REST contents API for .github/workflows at commit f6391f3e3a8de5429d22101e47e184d7263dec01 and then listed the local .github/workflows directory to confirm that release.yml is the workflow referenced by the failing Release Projects run.
• Fetched and decoded .github/workflows/release.yml at commit f6391f3e3a8de5429d22101e47e184d7263dec01, confirming the Release Projects job checks out ref: main, runs moon jsx-email:build plus other builds, performs an OIDC Preflight check, and then triggers moon run :release --affected --concurrency 1 --remote, which is the entry point that ultimately calls @dot/versioner.

[charliecreates]

#395 (comment)

Pulled the failed logs from the Release Projects run (job 60045408544). The failure is coming from versioner trying to publish via pnpm publish, which (unlike the npm CLI) can’t use GitHub’s OIDC “Trusted Publisher” flow—so with classic tokens removed, it just hard-fails with missing auth.

In the job log, jsx-email:release reaches:

• Publishing to NPM
• runs pnpm publish --no-git-checks
• then errors with npm error code ENEEDAUTH / “need auth … npm adduser”, and versioner exits non-zero.

This matches versioner’s implementation in shellscape/dot:

• packages/versioner/src/versioner.ts has publish() calling execa('pnpm', ['publish', '--no-git-checks'], ...) unless --publish=false is passed. (See around here: packages/versioner/src/versioner.ts lines ~148–160 in that repo.)

So, even though the workflow is already requesting id-token: write (OIDC), the actual publish path being executed (pnpm publish) never uses it.

What needs to change (in this repo):

• Ensure releases run versioner with publishing disabled (--publish=false), and then publish with the npm CLI (e.g. npm publish --provenance) in a separate step/script.
• Concretely, the current Moon task is versioner --target $projectRoot (no --publish=false), which is why we’re hitting pnpm publish.

Smaller sidenote: Moon is also warning about a shallow checkout when doing --affected, but that’s not the cause of this publish failure.

[shellscape]

@CharlieHelps please consult the pnpm documentation to double check if it doesnt support oidc. I'm pretty sure it does, so there's another reason why pnpm publish isnt working with oidc

[charliecreates]

Expand this to see my work.

• Checked pnpm’s official documentation and authentication guides to look for any references to OIDC, including how pnpm publish authenticates in CI environments.
• Compared pnpm’s publish/auth behavior against npm’s documented OIDC support to understand any gaps affecting pnpm publish with GitHub Actions OIDC workflows in jsx-email.

[charliecreates]

#395 (comment)

Double-checked pnpm’s docs + upstream threads: pnpm publish does document --provenance, but it doesn’t document npm “Trusted Publisher” / GitHub OIDC auth support (it still reads like it expects normal registry auth via .npmrc).

• pnpm publish docs: https://pnpm.io/cli/publish

On the npm side, OIDC “Trusted Publisher” publishing is currently described as an npm CLI feature (and npm calls out the need for a sufficiently new npm CLI).

• npm Trusted Publishers: https://docs.npmjs.com/trusted-publishers

Also notable: pnpm upstream has an (as of now) draft PR explicitly trying to add OIDC publishing support by letting pnpm download/use a particular npm CLI for publishing (which strongly suggests this isn’t generally supported in released pnpm yet).

• pnpm PR: feat: add npm version management for publish command pnpm/pnpm#10092

So the ENEEDAUTH we saw from versioner running pnpm publish still lines up with “no token auth present, and OIDC isn’t kicking in for pnpm publish”.

This is why the fix in #396 (merged) switched to versioner --publish=false + npm publish (via pnpm dlx npm@…) for the actual publish step.

[shellscape]

@CharlieHelps don't be lazy. pnpm/pnpm#9812

[charliecreates]

Reviewing the new comment on issue #395 to understand the context and what response or action is actually needed.

Updated: Jan 11, 19:36 UTC
I won’t see replies while I’m working on this and I can’t pause or stop until the task is finished.

[charliecreates]

Expand this to see my work.

• Interpreted the comment on #395 as frustration about response speed rather than a new requirement or change in scope for the jsx-email work.
• Attempted to check the status of PR #396 and related publishing workflow details via gh pr view 396, saw the command fail due to requesting an unsupported merged JSON field, and confirmed this doesn’t change the underlying work on the npm publishing strategy.
• Queried the main pnpm settings documentation at https://pnpm.io/settings with a search for npmVersion/npmPath, confirmed npmPath is documented as a configurable setting, and noted there is no first-class npmVersion setting exposed there for pinning.
• Searched the pnpm-workspace.yaml docs at https://pnpm.io/pnpm-workspace_yaml for npmVersion/npmPath and confirmed there is no workspace-level configuration for these, reinforcing that any npm pinning will likely live in scripts or CI tooling rather than workspace config.

[charliecreates]

#395 (comment)

Looked at pnpm/pnpm#9812 — it’s explicitly a feature request to support npm “trusted publishing” (OIDC), and it points at pnpm/pnpm#10092 as the upstream work to make pnpm publish use a specific npm CLI for publishing.

That lines up with the failure we saw: versioner was invoking pnpm publish ... and hitting ENEEDAUTH because the OIDC support lives in the npm CLI (and npm notes it requires npm >= 11.5.1). In other words: pnpm publish won’t “just work” with OIDC unless it’s actually running an OIDC-capable npm under the hood (and is configured to do so).

That’s also why the fix in PR #396 went with versioner --publish=false + pnpm dlx npm@11.5.1 publish --provenance in scripts/release-publish.sh: it guarantees the correct npm CLI is what performs the publish step.

[shellscape]

@CharlieHelps I see. You have been added to the shellscape/dot repository. Please open a PR on that repository for changing the publish command to use npm instead of pnpm within the versioner package. Also update the repo to use OIDC following the changes you made to this (jsx-email) repository as well.