@shopify/test-oidc-runner-2026-06-03 0.1.2 → 0.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,12 +1,13 @@
|
|
|
1
1
|
name: oidc-runner-test
|
|
2
|
-
#
|
|
3
|
-
#
|
|
4
|
-
#
|
|
5
|
-
#
|
|
6
|
-
#
|
|
7
|
-
#
|
|
8
|
-
#
|
|
9
|
-
#
|
|
2
|
+
# Extended 2026-06-12 (branch: oidc-pnpm-dlx-test) — A/B the publish METHOD under
|
|
3
|
+
# shop/setup-javascript-action to reproduce + fix the polaris-types OIDC 404 (Kyle Durand).
|
|
4
|
+
# method=pnpm -> reproduces the bug: pnpm publish fetches the OIDC id-token but
|
|
5
|
+
# never completes npm's trusted-publishing handshake -> PUT 404
|
|
6
|
+
# method=pnpm-dlx-npm -> the fix: real npm via the sanctioned `pnpm dlx` hatch, which
|
|
7
|
+
# routes around the Tectonix shim -> OIDC completes -> success
|
|
8
|
+
# The original runner A/B (2026-06-03, IAM-1879) already proved OIDC works on
|
|
9
|
+
# shopify-ubuntu-latest from this private repo with real npm. This run isolates the
|
|
10
|
+
# pnpm-vs-npm variable under setup-javascript-action (Kyle's exact setup).
|
|
10
11
|
on:
|
|
11
12
|
workflow_dispatch:
|
|
12
13
|
inputs:
|
|
@@ -14,9 +15,16 @@ on:
|
|
|
14
15
|
description: 'Runner to publish from'
|
|
15
16
|
type: choice
|
|
16
17
|
options:
|
|
17
|
-
- ubuntu-latest
|
|
18
18
|
- shopify-ubuntu-latest
|
|
19
|
-
|
|
19
|
+
- ubuntu-latest
|
|
20
|
+
default: shopify-ubuntu-latest
|
|
21
|
+
method:
|
|
22
|
+
description: 'Publish method'
|
|
23
|
+
type: choice
|
|
24
|
+
options:
|
|
25
|
+
- pnpm-dlx-npm
|
|
26
|
+
- pnpm
|
|
27
|
+
default: pnpm-dlx-npm
|
|
20
28
|
|
|
21
29
|
jobs:
|
|
22
30
|
publish:
|
|
@@ -27,27 +35,31 @@ jobs:
|
|
|
27
35
|
steps:
|
|
28
36
|
- uses: actions/checkout@v4
|
|
29
37
|
|
|
30
|
-
-
|
|
38
|
+
- name: Setup Node/pnpm (mirror polaris-types)
|
|
39
|
+
uses: shop/setup-javascript-action@main
|
|
31
40
|
with:
|
|
32
|
-
node-version: '22
|
|
33
|
-
|
|
34
|
-
# confounding variable from the Feb thread. publishConfig handles routing.
|
|
35
|
-
|
|
36
|
-
- name: Upgrade npm for OIDC support
|
|
37
|
-
run: npm install -g npm@latest
|
|
41
|
+
node-version: '22'
|
|
42
|
+
pnpm-version: '11.0.0'
|
|
38
43
|
|
|
39
44
|
- name: Context
|
|
40
45
|
run: |
|
|
41
|
-
echo "runner
|
|
42
|
-
node -v
|
|
46
|
+
echo "runner=${{ inputs.runner }} method=${{ inputs.method }}"
|
|
47
|
+
node -v
|
|
43
48
|
|
|
44
|
-
- name:
|
|
45
|
-
run: npm version "0.
|
|
49
|
+
- name: Bump to a unique throwaway version
|
|
50
|
+
run: pnpm dlx npm@latest version "0.2.${{ github.run_number }}" --no-git-tag-version --allow-same-version
|
|
46
51
|
|
|
47
52
|
- name: Publish via OIDC (no token)
|
|
48
|
-
run:
|
|
53
|
+
run: |
|
|
54
|
+
set -x
|
|
55
|
+
if [ "${{ inputs.method }}" = "pnpm" ]; then
|
|
56
|
+
pnpm publish --tag next --access public --no-git-checks
|
|
57
|
+
else
|
|
58
|
+
pnpm dlx npm@latest publish --tag next --access public --no-git-checks
|
|
59
|
+
fi
|
|
49
60
|
env:
|
|
50
|
-
# Force OIDC: explicitly blank any org-injected token so npm
|
|
61
|
+
# Force OIDC: explicitly blank any org-injected token so npm/pnpm can't
|
|
51
62
|
# silently fall back to token auth and mask the result.
|
|
52
63
|
NPM_TOKEN: ""
|
|
53
64
|
NODE_AUTH_TOKEN: ""
|
|
65
|
+
NPM_CONFIG_GLOBALCONFIG: ""
|
package/package.json
CHANGED