v5.0.0 not published: registry trusted publishers still name release.yml #1456

Activity

1. Mikola Lysenko (mikolalysenko)

   added

   ci-janitorOpened by the CI janitor routine (flakes, redundant tests, CI perf)Opened by the CI janitor routine (flakes, redundant tests, CI perf)

   agent:needs-human

   agent:triaged

   priority:p1

   on Oct 12, 2026
2. mikolalysenko commented on Oct 12, 2026

   

   Mikola Lysenko (mikolalysenko)

   on Oct 12, 2026

   CollaboratorAuthor

   More actions

   [agent] Triaged (CI lane). Confirmed on origin/main@15c2c83: release.yml hands publishing to .github/workflows/publish-cargo.yml / publish-npm.yml via scripts/dispatch-publish.sh, so the OIDC JWT carries the new filenames. The fix is registry-side trusted-publisher config plus a manual publish dispatch, which agents must not do (release/publish workflows and registry settings are off-limits). Labelled agent:needs-human, priority:p1 because v5.0.0 is tagged but unpublished on both registries.

   ---

   Generated by Claude Code
3. mikolalysenko commented on Oct 13, 2026

   

   Mikola Lysenko (mikolalysenko)

   on Oct 13, 2026

   CollaboratorAuthor

   More actions

   Update from the 2026-10-13 16:40 UTC CI janitor run: #1485 moved the npm leg back into release.yml, but the 5.0.1 release still didn't publish @socketsecurity/socket-patch.

   • Release run: https://github.com/SocketDev/socket-patch/actions/runs/38422888250. tag, github-release and cargo-publish succeeded. npm-publish failed (job 115390986463).
   • Every @socketsecurity/socket-patch-* platform package staged at 5.0.1 from the same job with the same OIDC setup. The last one was win32-x64, staged with id 39821f25-….
   • Step Stage-publish main package (npm stage publish ./npm/socket-patch) then failed with:

     npm error code E401 Unable to authenticate, your authentication token seems to be invalid.

   • npm/socket-patch/package.json has the same publishConfig and repository as the platform packages. So the OIDC exchange fails only for the main package, which points to that one package's trusted-publisher entry on npmjs.com. It probably still names publish-npm.yml (it may have been changed for 5.0.0) or another environment, while the platform packages name release.yml.
   • As of now, npm latest for @socketsecurity/socket-patch is still 4.0.0.

   Needs a human (registry admin):

   1. On npmjs.com, set the trusted publisher for @socketsecurity/socket-patch to repo SocketDev/socket-patch, workflow release.yml, with no environment, matching the platform packages.
   2. Dispatch release.yml with npm-retry-version=5.0.1. The main-package step accepts already-staged platform packages.
   3. Approve the staged versions: platform packages first, then the main package.

   ---

   Generated by Claude Code
4. mikolalysenko commented on Oct 13, 2026

   

   Mikola Lysenko (mikolalysenko)

   on Oct 13, 2026

   CollaboratorAuthor

   More actions

   Update from the 2026-10-13 19:40 UTC CI janitor run: 5.0.1 is still not on npm (npm view @socketsecurity/socket-patch versions ends at 4.0.0; 5.0.0 isn't there either). Two more npm-retry-version=5.0.1 attempts failed the same way:

   • 18:50 run, job 115477985998: Stage-publish platform packages stopped on the first package with 409 Cannot stage previously published version "5.0.1". ci(release): skip npm packages an earlier attempt already staged #1499 fixed that.
   • 19:19 run, job 115491432865, which has ci(release): skip npm packages an earlier attempt already staged #1499: every platform package logged Signed provenance statement and then 409, which the step now accepts as "Already staged awaiting approval". So their OIDC exchange works from release.yml. Stage-publish main package then failed with E401 Unable to authenticate, with no provenance line. The OIDC exchange failed for @socketsecurity/socket-patch only, and npm fell back to setup-node's placeholder token.

   The workflow side is done. The only blocker left is registry-side and needs a human:

   1. On npmjs.com, set the trusted publisher of @socketsecurity/socket-patch to repo SocketDev/socket-patch, workflow release.yml, no environment, the same as the platform packages.
   2. Dispatch release.yml with npm-retry-version=5.0.1. The platform packages will be skipped as already staged.
   3. Approve the staged versions at https://www.npmjs.com/settings/socketsecurity/staged-packages, platform packages first.

   ---

   Generated by Claude Code
5. mikolalysenko commented on Oct 13, 2026

   

   Mikola Lysenko (mikolalysenko)

   on Oct 13, 2026

   CollaboratorAuthor

   More actions

   Update from the 2026-10-13 20:40 UTC CI janitor run: the 19:48 UTC retry (run 38457783819, job 115504855501) failed the same way. Stage-publish main package printed Staging to https://registry.npmjs.org/ with tag latest, then E401 Unable to authenticate, again with no provenance line. The OIDC exchange for @socketsecurity/socket-patch still fails, so the trusted-publisher setting for that package (step 1 above) isn't in effect yet. Nothing has changed on the workflow side. The next retry will only help once that setting is saved on npmjs.com.

   ---

   Generated by Claude Code
6. mikolalysenko commented on Oct 14, 2026

   

   Mikola Lysenko (mikolalysenko)

   on Oct 14, 2026

   CollaboratorAuthor

   More actions

   Update from the 2026-10-14 00:45 UTC CI janitor run: resolved. @socketsecurity/socket-patch@5.0.1 landed on npm at 2026-10-13 20:55 UTC (latest dist-tag, platform packages too, e.g. socket-patch-linux-x64-gnu@5.0.1), and crates.io has socket-patch-core and socket-patch-cli at 5.0.1 (5.0.0 also present there). npm never got 5.0.0; 5.0.1 supersedes it, so no further publish is needed. Closing.

   ---

   Generated by Claude Code
7. Mikola Lysenko (mikolalysenko)

   closed this as completedon Oct 14, 2026