Remove npm auth handling in favor of docs - #695
Merged
Conversation
🦋 Changeset detectedLatest commit: 5695dfa The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Andarist
reviewed
Jul 16, 2026
Andarist
reviewed
Jul 23, 2026
Andarist
reviewed
Jul 23, 2026
Andarist
approved these changes
Jul 24, 2026
Merged
This was referenced Jul 28, 2026
Merged
DaYePython
added a commit
to DaYePython/lanhu-context
that referenced
this pull request
Aug 14, 2026
v2 removed automatic .npmrc creation from NPM_TOKEN (changesets/action#695); token auth now goes through setup-node's registry-url + NODE_AUTH_TOKEN. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Aug 17, 2026
7 tasks
arshad-shah
added a commit
to arshad-shah/extforge
that referenced
this pull request
Sep 1, 2026
The 1.0.0 and 1.1.0 releases published to npm but created no git tag and no GitHub release, while the workflow reported success. changesets/action v1 detects what was published by regex-matching `changeset publish` stdout for `New tag: <pkg>@<version>`. #77 upgraded @changesets/cli to v3, whose clack-style output no longer prints that line, so the action concluded nothing had been published and skipped both the tag push and the release creation without failing. Tags were created on the runner and discarded with it — which is why `git ls-remote --tags` still stops at 0.6.0. Upstream replaced stdout parsing with a CHANGESETS_OUTPUT file in v2 (changesets/action#678) and v2 now rejects the CLI v2/action v1 mismatch outright (changesets/action#699). v2 renamed every input, so this is not a bare SHA bump: version -> version-script, publish -> publish-script, commit -> commit-message, title -> pr-title. Both env vars are dropped. GITHUB_TOKEN is no longer read from the environment (changesets/action#674); the `github-token` input defaults to `github.token`, which is what was being passed. NPM_TOKEN is no longer used to write an .npmrc (changesets/action#695) — publishing already goes through OIDC trusted publishing, confirmed by the SLSA provenance attestation on the published 1.1.0 tarball. v2 pushes commits and tags through the GitHub API rather than the git CLI, so `persist-credentials: false` stays safe and tags are signed with GitHub's GPG key. Claude-Session: https://claude.ai/code/session_01AZSFjNFjuoeXUjuFkA6Cha Co-authored-by: Arshad shah <arshad.shah@hmhco.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues:
NPM_TOKENnot accurately while use actions/setup-node #132PRs:
.npmrcfiles. #529