sqlrite 0.1.5__tar.gz → 0.1.7__tar.gz

{sqlrite-0.1.5 → sqlrite-0.1.7}/.github/workflows/release.yml

@@ -778,10 +778,32 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # NOTE: deliberately NO `registry-url:` here. setting that
+      # makes setup-node generate an `.npmrc` with
+      # `_authToken=${NODE_AUTH_TOKEN}`, which forces npm into
+      # token-based auth and *bypasses* the trusted-publisher
+      # OIDC pathway entirely. The v0.1.5 canary blew up on this
+      # exact issue: `404 Not Found - PUT ... is not in this
+      # registry` because npm sent an empty/missing
+      # NODE_AUTH_TOKEN instead of minting an OIDC token.
+      #
+      # With registry-url omitted, no `.npmrc` is generated, and
+      # npm CLI ≥ 11.5 auto-detects the GitHub Actions OIDC
+      # environment (via ACTIONS_ID_TOKEN_REQUEST_URL +
+      # permissions: id-token: write below), mints an OIDC token,
+      # and exchanges it at npm for a one-time publish token. The
+      # public default registry is fine — that's where
+      # registry.npmjs.org lives anyway.
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
+
+      # Node 20 LTS ships with npm 10.x, but trusted publishing
+      # auto-detection landed in npm 11.5. Force-upgrade so we
+      # don't depend on the runner image happening to ship a
+      # recent-enough npm.
+      - name: Upgrade npm to latest (need 11.5+ for trusted publishing)
+        run: npm install -g npm@latest
 
       # Pull every platform's `.node` binary plus the JS
       # dispatcher into sdk/nodejs/, overlaying them on top of
@@ -799,29 +821,61 @@ jobs:
           name: nodejs-dispatcher
           path: sdk/nodejs
 
-      - name: List publish payload
+      - name: List publish payload + OIDC env diagnostics
         working-directory: sdk/nodejs
         run: |
           ls -la
           echo "---"
+          npm --version
+          echo "---"
+          # Confirm the OIDC env vars GitHub Actions auto-sets when
+          # `permissions: id-token: write` is granted. If either of
+          # these is empty, OIDC token exchange CAN'T happen and
+          # npm publish will fall back to "no auth available".
+          # Just print whether they're set, not their values
+          # (the URL has a trailing token-issuance path; treat as
+          # sensitive).
+          echo "ACTIONS_ID_TOKEN_REQUEST_URL  is set: ${ACTIONS_ID_TOKEN_REQUEST_URL:+yes}${ACTIONS_ID_TOKEN_REQUEST_URL:-NO}"
+          echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN is set: ${ACTIONS_ID_TOKEN_REQUEST_TOKEN:+yes}${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-NO}"
+          echo "---"
           # Dry-run the pack to see exactly what ends up in the
           # published tarball. A missing .node file or a stray
           # devDep pulled in by accident would be visible here.
           npm pack --dry-run
 
-      # Single atomic publish. `--provenance` signs the package
-      # with a sigstore-backed attestation linking it to this
-      # workflow run. `--access public` is REQUIRED because
-      # `@joaoh82/sqlrite` is a scoped package and scoped
-      # packages default to private; without the flag, npm
-      # would reject the upload for a free-tier account that
-      # can't host private packages.
+      # Single atomic publish via OIDC trusted publisher.
+      #
+      # The `--provenance` flag is what tells npm CLI to use the
+      # OIDC code path. Without it, npm only checks for `_authToken`
+      # config and gives up with ENEEDAUTH (this happened on the
+      # v0.1.6 canary attempt that ran without the flag — npm
+      # never even tried OIDC). With it, npm:
+      #   1. Reads ACTIONS_ID_TOKEN_REQUEST_URL +
+      #      ACTIONS_ID_TOKEN_REQUEST_TOKEN from the GHA env
+      #   2. Mints an OIDC token bearing the workflow's identity
+      #      claims (repo, environment, workflow filename, etc.)
+      #   3. Exchanges it at npm for a one-time publish token
+      #   4. Publishes the package + attaches a sigstore-signed
+      #      provenance attestation linking the artifact to this
+      #      exact workflow run
+      #
+      # The previous v0.1.5 failure with `--provenance` set was a
+      # different bug — `registry-url` on setup-node was generating
+      # an `.npmrc` that forced token-auth and bypassed OIDC. With
+      # registry-url removed (this file's previous fix) and
+      # `--provenance` restored, both bugs are addressed.
+      #
+      # `--access public` is REQUIRED because `@joaoh82/sqlrite`
+      # is a scoped package and scoped packages default to private;
+      # without the flag, npm rejects the upload for a free-tier
+      # account that can't host private packages.
+      #
+      # `--loglevel verbose` makes auth/transport errors
+      # diagnosable from the run log without re-running with
+      # debug-on. Cheap insurance against another silent failure.
       - name: Publish to npm
         working-directory: sdk/nodejs
-        run: npm publish --provenance --access public
-        env:
-          # OIDC trusted publisher — no static token.
-          NPM_CONFIG_PROVENANCE: "true"
+        run: npm publish --access public --provenance --loglevel verbose
 
       - name: GitHub Release
         uses: softprops/action-gh-release@v2

{sqlrite-0.1.5 → sqlrite-0.1.7}/Cargo.lock

@@ -3736,7 +3736,7 @@ dependencies = [
 
 [[package]]
 name = "sqlrite-desktop"
-version = "0.1.5"
+version = "0.1.7"
 dependencies = [
  "serde",
  "serde_json",
@@ -3748,7 +3748,7 @@ dependencies = [
 
 [[package]]
 name = "sqlrite-engine"
-version = "0.1.5"
+version = "0.1.7"
 dependencies = [
  "clap",
  "env_logger",
@@ -3763,7 +3763,7 @@ dependencies = [
 
 [[package]]
 name = "sqlrite-ffi"
-version = "0.1.5"
+version = "0.1.7"
 dependencies = [
  "cbindgen",
  "sqlrite-engine",
@@ -3771,7 +3771,7 @@ dependencies = [
 
 [[package]]
 name = "sqlrite-nodejs"
-version = "0.1.5"
+version = "0.1.7"
 dependencies = [
  "napi",
  "napi-build",
@@ -3781,7 +3781,7 @@ dependencies = [
 
 [[package]]
 name = "sqlrite-python"
-version = "0.1.5"
+version = "0.1.7"
 dependencies = [
  "pyo3",
  "sqlrite-engine",

{sqlrite-0.1.5 → sqlrite-0.1.7}/Cargo.toml

@@ -27,7 +27,7 @@ resolver = "3"
 # `package =` key so the import name stays `sqlrite` internally:
 #     sqlrite = { package = "sqlrite-engine", path = "…" }
 name = "sqlrite-engine"
-version = "0.1.5"
+version = "0.1.7"
 authors = ["Joao Henrique Machado Silva <joaoh82@gmail.com>"]
 edition = "2024"
 rust-version = "1.85"

{sqlrite-0.1.5 → sqlrite-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sqlrite
-Version: 0.1.5
+Version: 0.1.7
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{sqlrite-0.1.5 → sqlrite-0.1.7}/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sqlrite-desktop-frontend",
   "private": true,
-  "version": "0.1.5",
+  "version": "0.1.7",
   "type": "module",
   "scripts": {
     "dev": "vite",

{sqlrite-0.1.5 → sqlrite-0.1.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "sqlrite"
-version = "0.1.5"
+version = "0.1.7"
 description = "Python bindings for SQLRite — a small, embeddable SQLite clone written in Rust."
 authors = [{ name = "Joao Henrique Machado Silva", email = "joaoh82@gmail.com" }]
 license = { text = "MIT" }

{sqlrite-0.1.5 → sqlrite-0.1.7}/sdk/python/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sqlrite-python"
-version = "0.1.5"
+version = "0.1.7"
 authors = ["Joao Henrique Machado Silva <joaoh82@gmail.com>"]
 edition = "2024"
 rust-version = "1.85"