ci(release): fix publish by dropping dist-tag add#9100
Conversation
The OIDC-exchanged token from the npm registry is only valid for the publish operation; using it for npm dist-tag add produced E401. Remove the multi-tag logic and the OIDC exchange entirely: each branch now publishes with a single tag (latest for the current release line, latest-nodeXX for older lines), which is all npm's trusted publishing model supports without a stored token. Co-Authored-By: Claude Sonnet 4.6 (1M context) <[email protected]>
Overall package sizeSelf size: 6.37 MB Dependency sizes| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.2.0 | 104.26 kB | 843.44 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |🤖 This report was automatically generated by heaviest-objects-in-the-universe |
🎉 All green!🧪 All tests passed 🔗 Commit SHA: e35875c | Docs | Datadog PR Page | Give us feedback! |
BenchmarksBenchmark execution time: 2026-06-26 20:41:02 Comparing candidate commit e35875c in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 2255 metrics, 31 unstable metrics.
|
The OIDC-exchanged token from the npm registry is only valid for the publish operation; using it for npm dist-tag add produced E401. Remove the multi-tag logic and the OIDC exchange entirely: each branch now publishes with a single tag (latest for the current release line, latest-nodeXX for older lines), which is all npm's trusted publishing model supports without a stored token. Co-authored-by: Claude Sonnet 4.6 (1M context) <[email protected]>
The OIDC-exchanged token from the npm registry is only valid for the publish operation; using it for npm dist-tag add produced E401. Remove the multi-tag logic and the OIDC exchange entirely: each branch now publishes with a single tag (latest for the current release line, latest-nodeXX for older lines), which is all npm's trusted publishing model supports without a stored token. Co-authored-by: Claude Sonnet 4.6 (1M context) <[email protected]>
Summary
npm publishoperation; using it fornpm dist-tag addreturns E401, causing the v5.110.0 release job to fail after a successful publishlatestfor the current release line,latest-node14/latest-node16/latest-node18for older lines — matching what trusted publishing supports without a stored tokenTest plan
latestonly and no E401latest-nodeXXtags