Skip to content

#242 update github actions #247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ienaga merged 1 commit into from
Feb 10, 2026
Merged

#242 update github actions #247

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 10 additions & 37 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,10 @@ on:
branches:
- main

permissions:
id-token: write
contents: read
Comment on lines +8 to +10
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow-level permissions block grants id-token: write, but this job also defines its own permissions (lines 15-17) which overrides the workflow defaults. As written, the build job will NOT receive id-token: write, so any OIDC/trusted-publishing flow will fail. Consider either adding id-token: write to the job permissions, or removing the job-level permissions block if it’s not needed.

Copilot uses AI. Check for mistakes.

jobs:
build:
runs-on: ubuntu-latest
Expand All @@ -20,40 +24,9 @@ jobs:
- run: npm install -g npm@latest
- run: npm install
- run: npm run publish:dist
- run: cd ~/work/player/player/dist/src && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/cache && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/core && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/display && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/events && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/filters && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/geom && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/media && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/net && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/render-queue && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/text && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player/dist/packages/ui && npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
- run: cd ~/work/player/player && npm run clean
- name: Publish packages
run: |
find ./dist -name "package.json" -not -path "*/node_modules/*" -exec dirname {} \; | while read dir; do
npm publish --workspace="${dir}"
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

npm publish --workspace="${dir}" is likely incorrect here: the directories under ./dist are not declared as npm workspaces (root package.json only includes packages/*), so this may fail with “no matching workspace” or publish the wrong thing. Also, the previous workflow used --access public and an auth token; this new step doesn’t pass --access public (needed for scoped public packages) or any explicit auth mechanism unless you’re relying on npm trusted publishing (which would also require the correct id-token permission and usually --provenance). Recommend publishing by running npm publish with the needed flags from within each dist/... directory, and ensuring authentication/provenance is configured intentionally.

Suggested change
npm publish --workspace="${dir}"
(cd "$dir" && npm publish --provenance --access public)

Copilot uses AI. Check for mistakes.
done
- run: npm run clean
Loading