@shopify/test-oidc-runner-2026-06-03 0.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,112 @@
|
|
|
1
|
+
name: cloudsmith-routing-demo
|
|
2
|
+
# Self-contained demo for the cloudsmith_excess_usage_reduction proposal.
|
|
3
|
+
# Proves two things with NO secrets and NO impact on any other team:
|
|
4
|
+
# 1. A PUBLIC @shopify package installs fine straight from npmjs.org (Cloudsmith not needed).
|
|
5
|
+
# 2. PRIVATE @shopify packages 404 on npm — so they MUST migrate to @shopify-internal
|
|
6
|
+
# BEFORE the @shopify scope can be routed direct to npm. (The load-bearing risk.)
|
|
7
|
+
#
|
|
8
|
+
# Runs on ubuntu-latest on purpose: standard GitHub-hosted runners have no Shopify org
|
|
9
|
+
# .npmrc injection, so the ONLY routing in effect is the scoped .npmrc this workflow writes.
|
|
10
|
+
# That isolates the variable to the routing change itself.
|
|
11
|
+
on:
|
|
12
|
+
workflow_dispatch:
|
|
13
|
+
inputs:
|
|
14
|
+
public_package:
|
|
15
|
+
description: 'Public @shopify package (should install from npm)'
|
|
16
|
+
default: '@shopify/polaris'
|
|
17
|
+
private_packages:
|
|
18
|
+
description: 'Space-separated private @shopify packages (should 404 on npm)'
|
|
19
|
+
default: '@shopify/checkout-web-ui @shopify/gravity-web @shopify/event-id-service'
|
|
20
|
+
|
|
21
|
+
jobs:
|
|
22
|
+
routing-demo:
|
|
23
|
+
runs-on: ubuntu-latest
|
|
24
|
+
steps:
|
|
25
|
+
- uses: actions/checkout@v4 # needed so Test 3 can read private-packages.txt
|
|
26
|
+
- uses: actions/setup-node@v4
|
|
27
|
+
with:
|
|
28
|
+
node-version: '20'
|
|
29
|
+
|
|
30
|
+
- name: "Test 1 — PUBLIC @shopify package resolves DIRECT from npmjs.org (no Cloudsmith)"
|
|
31
|
+
run: |
|
|
32
|
+
set -euo pipefail
|
|
33
|
+
PKG='${{ inputs.public_package }}'
|
|
34
|
+
WORK="$(mktemp -d)"; cd "$WORK"
|
|
35
|
+
# Route the @shopify scope straight to public npm:
|
|
36
|
+
echo '@shopify:registry=https://registry.npmjs.org/' > .npmrc
|
|
37
|
+
echo "::group::.npmrc in effect"; cat .npmrc; echo "::endgroup::"
|
|
38
|
+
npm init -y >/dev/null
|
|
39
|
+
echo "Installing $PKG (with @shopify -> registry.npmjs.org)..."
|
|
40
|
+
npm install "$PKG" --no-audit --no-fund --ignore-scripts
|
|
41
|
+
echo ""
|
|
42
|
+
echo "::group::resolved tarball sources (sample)"
|
|
43
|
+
grep -Eo '"resolved": *"[^"]+"' package-lock.json | sort -u | head -10
|
|
44
|
+
echo "::endgroup::"
|
|
45
|
+
if grep -q 'npm.shopify.io' package-lock.json; then
|
|
46
|
+
echo "❌ Resolved via Cloudsmith (npm.shopify.io) — unexpected."; exit 1
|
|
47
|
+
fi
|
|
48
|
+
if grep -q 'registry.npmjs.org' package-lock.json; then
|
|
49
|
+
echo "✅ PASS: $PKG installed directly from registry.npmjs.org — Cloudsmith not involved."
|
|
50
|
+
else
|
|
51
|
+
echo "⚠️ Installed but couldn't confirm npmjs.org in the lockfile — inspect the sample above."; exit 1
|
|
52
|
+
fi
|
|
53
|
+
|
|
54
|
+
- name: "Test 2 — PRIVATE @shopify packages 404 on npm (must migrate before routing @shopify direct)"
|
|
55
|
+
run: |
|
|
56
|
+
set -uo pipefail
|
|
57
|
+
FAIL=0
|
|
58
|
+
for PKG in ${{ inputs.private_packages }}; do
|
|
59
|
+
echo "::group::$PKG"
|
|
60
|
+
WORK="$(mktemp -d)"; cd "$WORK"
|
|
61
|
+
echo '@shopify:registry=https://registry.npmjs.org/' > .npmrc
|
|
62
|
+
npm init -y >/dev/null
|
|
63
|
+
echo "Attempting: npm install $PKG (with @shopify -> npm)"
|
|
64
|
+
if npm install "$PKG" --no-audit --no-fund --ignore-scripts 2> err.log; then
|
|
65
|
+
echo "⚠️ $PKG installed from npm (HTTP 200) — it appears to be PUBLIC now; re-check the exception list."
|
|
66
|
+
FAIL=1
|
|
67
|
+
elif grep -qE '404|E404' err.log; then
|
|
68
|
+
echo "✅ $PKG → 404 on npm. A build would BREAK here if @shopify were routed direct — this is the expected, load-bearing result."
|
|
69
|
+
else
|
|
70
|
+
echo "⚠️ $PKG failed for a non-404 reason:"; cat err.log; FAIL=1
|
|
71
|
+
fi
|
|
72
|
+
cd - >/dev/null
|
|
73
|
+
echo "::endgroup::"
|
|
74
|
+
done
|
|
75
|
+
if [ "$FAIL" = "1" ]; then
|
|
76
|
+
echo "One or more results were unexpected — see warnings above."; exit 1
|
|
77
|
+
fi
|
|
78
|
+
echo "✅ PASS: every listed private @shopify package 404s on npm → migration to @shopify-internal is required before routing @shopify direct to npmjs.org."
|
|
79
|
+
|
|
80
|
+
- name: "Test 3 — re-validate the FULL exception list (private-packages.txt) against npm"
|
|
81
|
+
run: |
|
|
82
|
+
set -uo pipefail
|
|
83
|
+
# Lightweight re-check of the entire 72-package exception list: a GET to the npm
|
|
84
|
+
# registry metadata endpoint. 404 = still private (expected). 200 = it has gone
|
|
85
|
+
# PUBLIC on npm and the exception list needs updating before routing @shopify direct.
|
|
86
|
+
LIST="private-packages.txt"
|
|
87
|
+
STILL_PRIVATE=0; DRIFTED=0; OTHER=0
|
|
88
|
+
DRIFTED_PKGS=""; OTHER_PKGS=""
|
|
89
|
+
while IFS= read -r PKG; do
|
|
90
|
+
case "$PKG" in ''|\#*) continue ;; esac
|
|
91
|
+
PKG="$(echo "$PKG" | tr -d '[:space:]')"
|
|
92
|
+
[ -z "$PKG" ] && continue
|
|
93
|
+
# @shopify/foo -> https://registry.npmjs.org/@shopify%2ffoo
|
|
94
|
+
URL="https://registry.npmjs.org/$(echo "$PKG" | sed 's:/:%2f:')"
|
|
95
|
+
CODE="$(curl -s -o /dev/null -w '%{http_code}' "$URL" || echo 000)"
|
|
96
|
+
case "$CODE" in
|
|
97
|
+
404) STILL_PRIVATE=$((STILL_PRIVATE+1)) ;;
|
|
98
|
+
200) DRIFTED=$((DRIFTED+1)); DRIFTED_PKGS="$DRIFTED_PKGS $PKG"; echo "⚠️ $PKG → HTTP 200 (PUBLIC on npm — drifted off the exception list)" ;;
|
|
99
|
+
*) OTHER=$((OTHER+1)); OTHER_PKGS="$OTHER_PKGS $PKG"; echo "❓ $PKG → HTTP $CODE (couldn't classify)" ;;
|
|
100
|
+
esac
|
|
101
|
+
done < "$LIST"
|
|
102
|
+
echo ""
|
|
103
|
+
echo "── Exception-list re-validation summary ─────────────────────"
|
|
104
|
+
echo " Still private (404, expected): $STILL_PRIVATE"
|
|
105
|
+
echo " Drifted to PUBLIC (200): $DRIFTED${DRIFTED_PKGS:+ →$DRIFTED_PKGS}"
|
|
106
|
+
echo " Unclassified (other codes): $OTHER${OTHER_PKGS:+ →$OTHER_PKGS}"
|
|
107
|
+
echo "─────────────────────────────────────────────────────────────"
|
|
108
|
+
if [ "$DRIFTED" != "0" ]; then
|
|
109
|
+
echo "⚠️ $DRIFTED package(s) are now public on npm — update private-packages.txt + cloudsmith-package-audit.md before relying on this list."
|
|
110
|
+
else
|
|
111
|
+
echo "✅ All $STILL_PRIVATE listed packages still 404 on npm — exception list is consistent with npm today."
|
|
112
|
+
fi
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
name: firstpublish-repro
|
|
2
|
+
on:
|
|
3
|
+
workflow_dispatch: {}
|
|
4
|
+
jobs:
|
|
5
|
+
publish:
|
|
6
|
+
runs-on: shopify-ubuntu-latest # fallback: ubuntu-latest
|
|
7
|
+
steps:
|
|
8
|
+
- uses: actions/checkout@v4
|
|
9
|
+
- uses: actions/setup-node@v4
|
|
10
|
+
with:
|
|
11
|
+
node-version: '20'
|
|
12
|
+
registry-url: 'https://registry.npmjs.org'
|
|
13
|
+
- name: Attempt first publish of a brand-new package
|
|
14
|
+
run: npm publish --access public
|
|
15
|
+
env:
|
|
16
|
+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
name: oidc-runner-test
|
|
2
|
+
# A/B test for Tammy (IAM-1879): does OIDC publishing work on shopify-ubuntu-latest?
|
|
3
|
+
# The ONLY variable between runs is `runner`. Deliberately NO `registry-url` on
|
|
4
|
+
# setup-node — that .npmrc side effect was the real fix in the Feb extensibility
|
|
5
|
+
# thread we'd wrongly credited to the runner switch. Hold everything else constant.
|
|
6
|
+
#
|
|
7
|
+
# Run order:
|
|
8
|
+
# 1. runner=ubuntu-latest -> control, must succeed (proves the setup is sound)
|
|
9
|
+
# 2. runner=shopify-ubuntu-latest -> the test (only the runner changed)
|
|
10
|
+
on:
|
|
11
|
+
workflow_dispatch:
|
|
12
|
+
inputs:
|
|
13
|
+
runner:
|
|
14
|
+
description: 'Runner to publish from'
|
|
15
|
+
type: choice
|
|
16
|
+
options:
|
|
17
|
+
- ubuntu-latest
|
|
18
|
+
- shopify-ubuntu-latest
|
|
19
|
+
default: ubuntu-latest
|
|
20
|
+
|
|
21
|
+
jobs:
|
|
22
|
+
publish:
|
|
23
|
+
runs-on: ${{ inputs.runner }}
|
|
24
|
+
permissions:
|
|
25
|
+
id-token: write # required for OIDC token exchange
|
|
26
|
+
contents: read
|
|
27
|
+
steps:
|
|
28
|
+
- uses: actions/checkout@v4
|
|
29
|
+
|
|
30
|
+
- uses: actions/setup-node@v4
|
|
31
|
+
with:
|
|
32
|
+
node-version: '22.14.0'
|
|
33
|
+
# NO registry-url on purpose — that writes a project .npmrc and is the
|
|
34
|
+
# confounding variable from the Feb thread. publishConfig handles routing.
|
|
35
|
+
|
|
36
|
+
- name: Upgrade npm for OIDC support
|
|
37
|
+
run: npm install -g npm@latest
|
|
38
|
+
|
|
39
|
+
- name: Context
|
|
40
|
+
run: |
|
|
41
|
+
echo "runner input: ${{ inputs.runner }}"
|
|
42
|
+
node -v && npm -v
|
|
43
|
+
|
|
44
|
+
- name: Unique version per run (0.1.x — keeps clear of the 0.0.1 token first-publish)
|
|
45
|
+
run: npm version "0.1.${{ github.run_number }}" --no-git-tag-version --allow-same-version
|
|
46
|
+
|
|
47
|
+
- name: Publish via OIDC (no token)
|
|
48
|
+
run: npm publish --access public
|
|
49
|
+
env:
|
|
50
|
+
# Force OIDC: explicitly blank any org-injected token so npm cannot
|
|
51
|
+
# silently fall back to token auth and mask the result.
|
|
52
|
+
NPM_TOKEN: ""
|
|
53
|
+
NODE_AUTH_TOKEN: ""
|
package/package.json
ADDED
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "@shopify/test-oidc-runner-2026-06-03",
|
|
3
|
+
"version": "0.0.1",
|
|
4
|
+
"description": "OIDC runner A/B test (AI Ops, IAM-1879): does OIDC publish work on shopify-ubuntu-latest vs ubuntu-latest?",
|
|
5
|
+
"license": "MIT",
|
|
6
|
+
"publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" }
|
|
7
|
+
}
|
|
@@ -0,0 +1,77 @@
|
|
|
1
|
+
# Private @shopify/* packages natively hosted on Cloudsmith (NOT on npmjs.com).
|
|
2
|
+
# Source: "Private @shopify/* packages natively hosted on Cloudsmith" sheet +
|
|
3
|
+
# projects/npm/cloudsmith-package-audit.md (72 packages, verified 404 on npm 2026-04-28).
|
|
4
|
+
# These must migrate to @shopify-internal before @shopify can route direct to npm.
|
|
5
|
+
# Lines starting with # are ignored.
|
|
6
|
+
@shopify/checkout-web-ui
|
|
7
|
+
@shopify/checkout-react-testing
|
|
8
|
+
@shopify/checkout-web-ui-post-purchase
|
|
9
|
+
@shopify/checkout-react-router
|
|
10
|
+
@shopify/shop-pay-external-interface
|
|
11
|
+
@shopify/checkout-performance
|
|
12
|
+
@shopify/checkout-utilities
|
|
13
|
+
@shopify/editor-bridge
|
|
14
|
+
@shopify/checkout-react-html
|
|
15
|
+
@shopify/signals-react
|
|
16
|
+
@shopify/checkout-react-async
|
|
17
|
+
@shopify/checkout-i18n
|
|
18
|
+
@shopify/checkout-graphql
|
|
19
|
+
@shopify/checkout-react-performance
|
|
20
|
+
@shopify/card-fields-react
|
|
21
|
+
@shopify/checkout-assistant
|
|
22
|
+
@shopify/checkout-react-server-render
|
|
23
|
+
@shopify/eslint-plugin-checkout-web
|
|
24
|
+
@shopify/extensibility-host
|
|
25
|
+
@shopify/extensibility-host-runtimes
|
|
26
|
+
@shopify/extensibility-host-react
|
|
27
|
+
@shopify/extensibility-host-plugins
|
|
28
|
+
@shopify/extensibility-host-mobile
|
|
29
|
+
@shopify/extensibility-host-shared
|
|
30
|
+
@shopify/remote-dom-runtime
|
|
31
|
+
@shopify/dev-console-plugin
|
|
32
|
+
@shopify/web-production-validation
|
|
33
|
+
@shopify/docs-mcp
|
|
34
|
+
@shopify/extensibility-host-docs
|
|
35
|
+
@shopify/online-store-ui
|
|
36
|
+
@shopify/richtext
|
|
37
|
+
@shopify/editor-core
|
|
38
|
+
@shopify/richtext-toolbar-html
|
|
39
|
+
@shopify/richtext-plugin-bold
|
|
40
|
+
@shopify/richtext-editor
|
|
41
|
+
@shopify/richtext-presets
|
|
42
|
+
@shopify/richtext-toolbar-core
|
|
43
|
+
@shopify/gravity
|
|
44
|
+
@shopify/gravity-web
|
|
45
|
+
@shopify/gravity-react
|
|
46
|
+
@shopify/gravity-tokens
|
|
47
|
+
@shopify/gravity-tailwind
|
|
48
|
+
@shopify/gravity-typescript-config
|
|
49
|
+
@shopify/react-native-customerview-library
|
|
50
|
+
@shopify/polaris-react-native
|
|
51
|
+
@shopify/mobile-workflow-tooling
|
|
52
|
+
@shopify/type-diff
|
|
53
|
+
@shopify/type-diff-github-action
|
|
54
|
+
@shopify/credit-card-bin
|
|
55
|
+
@shopify/docs-ai
|
|
56
|
+
@shopify/docusaurus-docuchat
|
|
57
|
+
@shopify/edge-worker-fetch
|
|
58
|
+
@shopify/event-id-service
|
|
59
|
+
@shopify/i18n-linter
|
|
60
|
+
@shopify/lang-liquid
|
|
61
|
+
@shopify/opentelemetry-js
|
|
62
|
+
@shopify/opentelemetry-propagation-shopify
|
|
63
|
+
@shopify/otel-cf-workers-shopify
|
|
64
|
+
@shopify/pci-script-inventory
|
|
65
|
+
@shopify/qr-code-generator
|
|
66
|
+
@shopify/rataris
|
|
67
|
+
@shopify/swc-plugins
|
|
68
|
+
@shopify/consent-tracking-api
|
|
69
|
+
@shopify/privacy-banner-templates
|
|
70
|
+
@shopify/dev-server
|
|
71
|
+
@shopify/web-pixels-internal
|
|
72
|
+
@shopify/pipeline-schema
|
|
73
|
+
@shopify/guidance-ui
|
|
74
|
+
@shopify/token-protocol
|
|
75
|
+
@shopify/quick
|
|
76
|
+
@shopify/magic-ui
|
|
77
|
+
@shopify/whoowns
|