publish.yml read three secrets that do not exist - #104
Merged
Conversation
The workflow referenced `secrets.CARGO_REGISTRY_TOKEN`,
`secrets.NUGET_API_KEY` and `secrets.PYPI_API_TOKEN`. None of them exist for
this repo at either level:
gh api /repos/SmooAI/observability/actions/secrets -> total_count 0
gh api .../actions/organization-secrets -> GH_PAT,
SMOOAI_CARGO_REGISTRY_TOKEN, SMOOAI_NPM_TOKEN,
SMOOAI_NUGET_API_KEY, SMOOAI_PYPI_TOKEN
A missing secret is the EMPTY STRING in a GitHub expression, not an error. So
every publish job would have installed a toolchain, run its full suite, packaged
cleanly, and only then failed at the upload — or sent an unauthenticated one.
This is the last thing standing between the four SDKs and a working release, and
it is invisible until someone pushes a tag.
Points every job at the org secrets that DO exist, which is also how
SmooAI/logger publishes smooai-logger today:
- crates.io: SMOOAI_CARGO_REGISTRY_TOKEN
- NuGet: NUGET_API_KEY || SMOOAI_NUGET_API_KEY — repo-level first, because that
is where fetch and logger keep theirs, org-level as the fallback, so it works
whichever is present
- PyPI: SMOOAI_PYPI_TOKEN via `uv publish`
The Python job also drops OIDC Trusted Publishing, which needed three things
that are not true here: a `pypi` environment (this repo has ZERO environments),
a Trusted Publisher registered on PyPI for repo+workflow+environment, and — for
a package that does not exist yet — a PENDING publisher created by hand FIRST.
That is three manual steps to enable a path the org already has a working token
for.
Each publish job now also refuses to start when its credential is empty, before
the suite runs rather than after a clean package. Skipped on dry runs, where no
credential is needed.
RELEASING.md updated to name the real secrets and to say plainly that all three
already exist — nothing to create.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The last thing between the four SDKs and a working release
publish.ymlreferencedsecrets.CARGO_REGISTRY_TOKEN,secrets.NUGET_API_KEYandsecrets.PYPI_API_TOKEN. None of them exist for this repo, at either level:A missing secret is the empty string in a GitHub expression, not an error. Every publish job would have installed a toolchain, run its full test suite, packaged cleanly — and only then failed at the upload with an auth error, or sent an unauthenticated request. Invisible until someone pushes a tag, which is the one moment you least want to find out.
Fix
Point every job at the org secrets that do exist — the same ones
SmooAI/loggeruses to publishsmooai-loggertoday:SMOOAI_CARGO_REGISTRY_TOKENNUGET_API_KEY || SMOOAI_NUGET_API_KEY— repo-level first (wherefetchandloggerkeep theirs), org-level as fallbackSMOOAI_PYPI_TOKEN, viauv publishThe Python job also drops OIDC Trusted Publishing. That path needed three things that are not true here: a
pypienvironment (this repo has zero environments configured), a Trusted Publisher registered on PyPI for repo+workflow+environment, and — for a package that does not exist yet — a pending publisher created by hand first. Three manual setup steps to enable a path the org already has a working token for.Preflight
Each publish job now refuses to start when its credential resolves to empty — before the suite runs, rather than after a clean package at the upload step. Skipped on dry runs, where no credential is needed.
RELEASING.mdupdated to name the real secrets and to say plainly that all three already exist, so the runbook does not send anyone to create tokens they already have.🤖 Generated with Claude Code
https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC