ci: Fixed NPM Trusted Publishing by frol · Pull Request #603 · near/near-cli-rs

frol · 2026-06-17T16:46:51Z

I tested it on near-valirator-cli-rs: https://github.com/near/near-validator-cli-rs/actions/runs/27699830257/job/81937368485

The Node.js version must be 22+ and id-token: write permissions is required.

Copilot

Pull request overview

Updates the release CI configuration generated by cargo-dist to support npm publishing requirements (notably newer Node.js and OIDC id-token permissions) and bumps the cargo-dist version used by the workspace/CI.

Changes:

Bump cargo-dist from 0.30.2 to 0.32.0.
Refresh the autogenerated release.yml to use the newer cargo-dist installer and update the npm publish job (Node 24 + id-token: write).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
Cargo.toml	Bumps the `cargo-dist` version used by CI generation.
.github/workflows/release.yml	Updates the autogenerated release workflow and adjusts npm publishing requirements (Node version + OIDC permission).

Comments suppressed due to low confidence (1)

.github/workflows/release.yml:314

This job is still authenticating to npm via NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}. If the intent of this PR is to switch to npm Trusted Publishing via OIDC (as implied by adding id-token: write and the PR description), NODE_AUTH_TOKEN will keep using classic token-based auth instead. Consider removing the token-based auth (and any dependency on secrets.NPM_TOKEN) or clarifying that both methods are intended.

      - run: |
          for release in $(echo "$PLAN" | jq --compact-output '.releases[] | select([.artifacts[] | endswith("-npm-package.tar.gz")] | any)'); do
            pkg=$(echo "$release" | jq '.artifacts[] | select(endswith("-npm-package.tar.gz"))' --raw-output)
            npm publish --access public "./npm/${pkg}"
          done
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

frol · 2026-06-17T18:20:50Z

I have opened a PR to cargo-dist to upstream the fix there: axodotdev/cargo-dist#2434

## 🤖 New release * `near-cli-rs`: 0.27.0 -> 0.28.0 (⚠ API breaking changes) ### ⚠ `near-cli-rs` breaking changes ```text --- failure constructible_struct_adds_field: externally-constructible struct adds field --- Description: A pub struct constructible with a struct literal has a new pub field. Existing struct literals must be updated to include the new field. ref: https://doc.rust-lang.org/reference/expressions/struct-expr.html impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/constructible_struct_adds_field.ron Failed in: field CliSignPrivateKey.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_private_key/mod.rs:5 field InteractiveClapContextScopeForGenerateKeypair.signature_scheme in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/create_account/sponsor_by_faucet_service/add_key/autogenerate_new_keypair/mod.rs:3 field CliSignLedger.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_ledger/mod.rs:18 field CliSignLegacyKeychain.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_legacy_keychain/mod.rs:12 field CliSignKeychain.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_keychain/mod.rs:9 field SignLedgerContext.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_ledger/mod.rs:51 field InteractiveClapContextScopeForSignSeedPhrase.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_seed_phrase/mod.rs:7 field CliSignAccessKeyFile.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_access_key_file/mod.rs:5 field CliGenerateKeypair.signature_scheme in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/create_account/sponsor_by_faucet_service/add_key/autogenerate_new_keypair/mod.rs:3 field InteractiveClapContextScopeForSignPrivateKey.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_private_key/mod.rs:5 field InteractiveClapContextScopeForSignLedger.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_ledger/mod.rs:18 field InteractiveClapContextScopeForSignLegacyKeychain.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_legacy_keychain/mod.rs:12 field InteractiveClapContextScopeForSignKeychain.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_keychain/mod.rs:9 field InteractiveClapContextScopeForSignAccessKeyFile.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_access_key_file/mod.rs:5 field CliSignSeedPhrase.nonce_index in /tmp/.tmpat9wFR/near-cli-rs/src/transaction_signature_options/sign_with_seed_phrase/mod.rs:7 --- failure enum_no_repr_variant_discriminant_changed: enum variant had its discriminant change value --- Description: The enum's variant had its discriminant value change. This breaks downstream code that used its value via a numeric cast like `as isize`. ref: https://doc.rust-lang.org/reference/items/enumerations.html#assigning-discriminant-values impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/enum_no_repr_variant_discriminant_changed.ron Failed in: variant TopLevelCommandDiscriminants::Extensions 7 -> 8 in /tmp/.tmpat9wFR/near-cli-rs/src/commands/mod.rs:60 variant TopLevelCommandDiscriminants::Extensions 7 -> 8 in /tmp/.tmpat9wFR/near-cli-rs/src/commands/mod.rs:60 variant AccountActionsDiscriminants::GetPublicKey 7 -> 8 in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:69 variant AccountActionsDiscriminants::AddKey 8 -> 9 in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:74 variant AccountActionsDiscriminants::DeleteKeys 9 -> 12 in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:89 variant AccountActionsDiscriminants::ManageStorageDeposit 10 -> 13 in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:94 variant AccountActionsDiscriminants::GetPublicKey 7 -> 8 in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:69 variant AccountActionsDiscriminants::AddKey 8 -> 9 in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:74 variant AccountActionsDiscriminants::DeleteKeys 9 -> 12 in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:89 variant AccountActionsDiscriminants::ManageStorageDeposit 10 -> 13 in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:94 --- failure enum_variant_added: enum variant added on exhaustive enum --- Description: A publicly-visible enum without #[non_exhaustive] has a new variant. ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/enum_variant_added.ron Failed in: variant AccountActionsDiscriminants:ViewGasKeyNonces in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:64 variant AccountActionsDiscriminants:FundGasKey in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:79 variant AccountActionsDiscriminants:WithdrawFromGasKey in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:84 variant AccountActionsDiscriminants:ViewGasKeyNonces in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:64 variant AccountActionsDiscriminants:FundGasKey in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:79 variant AccountActionsDiscriminants:WithdrawFromGasKey in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:84 variant CliTopLevelCommand:GenerateKeypair in /tmp/.tmpat9wFR/near-cli-rs/src/commands/mod.rs:16 variant CliAccountActions:ViewGasKeyNonces in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:27 variant CliAccountActions:FundGasKey in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:27 variant CliAccountActions:WithdrawFromGasKey in /tmp/.tmpat9wFR/near-cli-rs/src/commands/account/mod.rs:27 variant TopLevelCommandDiscriminants:GenerateKeypair in /tmp/.tmpat9wFR/near-cli-rs/src/commands/mod.rs:56 variant TopLevelCommandDiscriminants:GenerateKeypair in /tmp/.tmpat9wFR/near-cli-rs/src/commands/mod.rs:56 --- failure function_missing: pub fn removed or renamed --- Description: A publicly-visible function cannot be imported by its prior path. A `pub use` may have been removed, or the function itself may have been renamed or removed entirely. ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/function_missing.ron Failed in: function near_cli_rs::transaction_signature_options::send::sleep_after_error, previously in file /tmp/.tmppWZUdR/near-cli-rs/src/transaction_signature_options/send/mod.rs:193 --- failure trait_method_added: pub trait method added --- Description: A non-sealed public trait added a new method without a default implementation, which breaks downstream implementations of the trait ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_method_added.ron Failed in: trait method near_cli_rs::common::RpcQueryResponseExt::gas_key_nonces_view in file /tmp/.tmpat9wFR/near-cli-rs/src/common.rs:3499 ``` <details><summary>Changelog</summary> <blockquote> ## [0.28.0](v0.27.0...v0.28.0) - 2026-07-02 ### Added - sign transactions with a gas key (nonce_index) ([#608](#608)) - gas-key support (nearcore 2.13) ([#607](#607)) - post-quantum (ML-DSA-65) key generation (draft) ([#605](#605)) - Validate beneficiary account before deleting account ([#596](#596)) ### Fixed - Fixed output information for transaction status "Started" ([#594](#594)) ### Other - Fixed NPM Trusted Publishing ([#603](#603)) </blockquote> </details> --- This PR was generated with [release-plz](https://github.com/release-plz/release-plz/). --------- Co-authored-by: r-near <[email protected]>

ci: Fixed NPM Trusted Publishing

41ed435

Copilot AI review requested due to automatic review settings June 17, 2026 16:46

frol requested a review from a team as a code owner June 17, 2026 16:46

thisisjoshford added this to DevTools Jun 17, 2026

github-project-automation Bot moved this to NEW❗ in DevTools Jun 17, 2026

Copilot started reviewing on behalf of frol June 17, 2026 16:47 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

frol mentioned this pull request Jun 17, 2026

ci: use npm trusted publishing (OIDC) instead of NPM_TOKEN #600

Closed

frol merged commit 6dc91ee into main Jun 17, 2026
15 checks passed

github-project-automation Bot moved this from NEW❗ to Shipped 🚀 in DevTools Jun 17, 2026

frol deleted the fix/npm-publishing branch June 17, 2026 19:17

nearprotocol-ci mentioned this pull request Jun 17, 2026

chore: release v0.28.0 #604

Merged

nearprotocol-ci mentioned this pull request Jul 2, 2026

chore: release v0.28.0-rc.1 #610

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: Fixed NPM Trusted Publishing#603

ci: Fixed NPM Trusted Publishing#603
frol merged 1 commit into
mainfrom
fix/npm-publishing

frol commented Jun 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

frol commented Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

frol commented Jun 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

frol commented Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants