From 7d73d20dd8528d25df40deae0815c74e4e0dabc4 Mon Sep 17 00:00:00 2001 From: Brent Rager Date: Mon, 24 Aug 2026 16:59:31 -0400 Subject: [PATCH 1/2] chore(ci): adopt mise, move to Node 24 so npm can do OIDC trusted publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm trusted publishing needs npm >= 11.5.1. Every workflow here pinned `node-version: 22`, which ships npm 10.9.x — so OIDC could never have worked regardless of npm-side configuration. Node 24.14.0 ships npm 11.9.0. `pnpm publish` delegates the registry PUT to the npm CLI on PATH (verified: it emits npm's own `npm notice` output), so npm's version is what gates OIDC, not pnpm's. pnpm is pinned at 10.34.5 and deliberately NOT 11.x — pnpm 11 regressed OIDC by no longer delegating (pnpm#11513). Toolchain versions move into mise.toml, read by mise locally and by jdx/mise-action in CI, so a developer's shell and the runner cannot drift. Pinned here: node = "24.14.0" Left on their existing actions on purpose: pnpm/action-setup (already reads the "packageManager" pin), dtolnay/rust-toolchain (rustup is canonical and mise defers to it), and actions/setup-dotnet (installs several SDKs side by side, which mise's single-version dotnet backend cannot do). Restored explicitly because actions/setup-node was providing them implicitly: the pnpm store cache, and the .npmrc token write that `registry-url:` performed. npm tries OIDC first and falls back to that token, so it stays until each package has a trusted publisher registered. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013YaefW6U442PHZf94fMAer --- .github/workflows/pr-checks.yml | 10 ++++------ .github/workflows/release.yml | 19 +++++++++++++------ mise.toml | 11 +++++++++++ sst/package.json | 3 ++- 4 files changed, 30 insertions(+), 13 deletions(-) create mode 100644 mise.toml diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index bc72b73..8adcafc 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -29,13 +29,11 @@ jobs: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4 - with: - version: 10 - # SST 4.x requires Node 22 (silently crashes on 24). - - uses: actions/setup-node@v4 - with: - node-version: 22 + # Toolchains come from mise.toml, read here by mise-action so the runner + # and a developer's shell resolve identical versions. + - name: Setup toolchains (mise) + uses: jdx/mise-action@v4 # --no-frozen-lockfile: the committed lockfile carries a # settings.injectWorkspacePackages value that a frozen install rejects diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 084b183..a0cde40 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,13 +20,20 @@ jobs: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4 - with: - version: 10 - - uses: actions/setup-node@v4 - with: - node-version: 22 - registry-url: 'https://registry.npmjs.org' + # Toolchains come from mise.toml, read here by mise-action so the runner + # and a developer's shell resolve identical versions. + - name: Setup toolchains (mise) + uses: jdx/mise-action@v4 + + # actions/setup-node's `registry-url:` used to write this. npm tries OIDC + # first and falls back to the token, so it stays until this package has + # a trusted publisher registered on npmjs.com. + - name: Configure npm registry auth (token fallback) + run: | + echo "//registry.npmjs.org/:_authToken=\${NODE_AUTH_TOKEN}" > ~/.npmrc + env: + NODE_AUTH_TOKEN: ${{ secrets.SMOOAI_NPM_TOKEN }} - name: Install run: pnpm install --no-frozen-lockfile diff --git a/mise.toml b/mise.toml new file mode 100644 index 0000000..4d5d00a --- /dev/null +++ b/mise.toml @@ -0,0 +1,11 @@ +# Toolchain versions for this repo — read by mise locally and by +# jdx/mise-action in CI, so a developer's shell and the runner agree. +# +# Not listed here on purpose: +# pnpm -> package.json "packageManager". pnpm self-substitutes to that +# version regardless of which pnpm binary launches it, so a mise +# pin would be cosmetic and would drift. +# rust -> rust-toolchain.toml + dtolnay/rust-toolchain. rustup is canonical +# and mise defers to it anyway. +[tools] +node = "24.14.0" # ships npm 11.9.0 — required (>=11.5.1) for npm OIDC trusted publishing diff --git a/sst/package.json b/sst/package.json index 5f9636c..246dced 100644 --- a/sst/package.json +++ b/sst/package.json @@ -46,5 +46,6 @@ }, "publishConfig": { "access": "public" - } + }, + "packageManager": "pnpm@10.34.5" } From 98888cefba698648da459b5dc82cfd56bd097ba9 Mon Sep 17 00:00:00 2001 From: Brent Rager Date: Mon, 24 Aug 2026 17:05:20 -0400 Subject: [PATCH 2/2] fix(ci): point pnpm/action-setup at sst/package.json MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This repo has no root package.json — the package (and now the packageManager pin) lives in sst/. Unpinning the action's version made it look for the pin at the repo root and fail with 'No pnpm version is specified'. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013YaefW6U442PHZf94fMAer --- .github/workflows/pr-checks.yml | 6 ++++++ .github/workflows/release.yml | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 8adcafc..16cd5b8 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -30,6 +30,12 @@ jobs: - uses: pnpm/action-setup@v4 + with: + + # this repo has no root package.json — the pnpm pin lives in sst/ + + package_json_file: sst/package.json + # Toolchains come from mise.toml, read here by mise-action so the runner # and a developer's shell resolve identical versions. - name: Setup toolchains (mise) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a0cde40..3c4aa3e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,6 +21,12 @@ jobs: - uses: pnpm/action-setup@v4 + with: + + # this repo has no root package.json — the pnpm pin lives in sst/ + + package_json_file: sst/package.json + # Toolchains come from mise.toml, read here by mise-action so the runner # and a developer's shell resolve identical versions. - name: Setup toolchains (mise)