From 0828937f81913ffe79d55616426061604a93b525 Mon Sep 17 00:00:00 2001 From: decentraland-bot <44584806+decentraland-bot@users.noreply.github.com> Date: Mon, 8 Jun 2026 20:29:55 +0000 Subject: [PATCH 1/5] chore: update oddish-action for npm Trusted Publishing (OIDC) Update oddish-action to the version supporting npm Trusted Publishing (OIDC auth) and remove NODE_AUTH_TOKEN. The old action version writes _authToken to .npmrc which prevents npm from using OIDC-based Trusted Publishing, causing E404 errors after npm invalidated granular tokens that bypass 2FA. Reference: https://github.com/decentraland/oddish-action/pull/10 Co-Authored-By: Claude Opus 4.6 --- .github/workflows/ci.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 76393cb..de389ca 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: node-version: 24 - name: set package.json version - uses: decentraland/oddish-action@914e7c59e93e708152aa703c50196740c0526c1d # @master + uses: decentraland/oddish-action@0074f2d535c43b5c83f136525304a6277166d77f # @master with: deterministic-snapshot: true only-update-versions: true @@ -42,7 +42,7 @@ jobs: run: make test - name: Publish - uses: decentraland/oddish-action@914e7c59e93e708152aa703c50196740c0526c1d # @master + uses: decentraland/oddish-action@0074f2d535c43b5c83f136525304a6277166d77f # @master with: registry-url: 'https://registry.npmjs.org' access: public @@ -51,4 +51,3 @@ jobs: ## sign the deployment provenance: true env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} From 2a7c48bcbfae7ef9e1b175775579c2d7735ccfdf Mon Sep 17 00:00:00 2001 From: decentraland-bot <44584806+decentraland-bot@users.noreply.github.com> Date: Mon, 8 Jun 2026 20:42:05 +0000 Subject: [PATCH 2/5] fix: install npm@11 for Trusted Publishing OIDC auth GitHub Actions runner ships npm 10.9.8 which does not support tokenless Trusted Publishing. npm 11 is required for OIDC auth. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index de389ca..50bfc13 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,6 +41,8 @@ jobs: - name: test run: make test + - name: upgrade npm for Trusted Publishing + run: corepack install -g npm@11 && npm --version - name: Publish uses: decentraland/oddish-action@0074f2d535c43b5c83f136525304a6277166d77f # @master with: From 1ef929f25c1a6f74b768b0b296039cc7f0729589 Mon Sep 17 00:00:00 2001 From: decentraland-bot <44584806+decentraland-bot@users.noreply.github.com> Date: Mon, 8 Jun 2026 21:06:44 +0000 Subject: [PATCH 3/5] Revert "fix: install npm@11 for Trusted Publishing OIDC auth" This reverts commit 2a7c48bcbfae7ef9e1b175775579c2d7735ccfdf. --- .github/workflows/ci.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 50bfc13..de389ca 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,8 +41,6 @@ jobs: - name: test run: make test - - name: upgrade npm for Trusted Publishing - run: corepack install -g npm@11 && npm --version - name: Publish uses: decentraland/oddish-action@0074f2d535c43b5c83f136525304a6277166d77f # @master with: From 61b3c52f098b108ef3de2b3ac403d3d258be8fb6 Mon Sep 17 00:00:00 2001 From: decentraland-bot <44584806+decentraland-bot@users.noreply.github.com> Date: Mon, 8 Jun 2026 21:30:41 +0000 Subject: [PATCH 4/5] chore: bump actions to v6 (node24 runtime) and fix repository.url - Bump actions/checkout and actions/setup-node to v6 (node24 runtime, replacing the node20 runtime being phased out) - Fix package.json repository field for npm provenance verification where applicable Co-Authored-By: Claude Opus 4.6 --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index de389ca..7cebc3f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,10 +15,10 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # @v4.3.0 + - uses: actions/checkout@v6 - name: Use Node.js 18.x - uses: actions/setup-node@v1 + uses: actions/setup-node@v6 with: node-version: 24 From 2f7cd09e00456c1410b2fd9950416d4d7325203b Mon Sep 17 00:00:00 2001 From: decentraland-bot <44584806+decentraland-bot@users.noreply.github.com> Date: Mon, 8 Jun 2026 21:40:38 +0000 Subject: [PATCH 5/5] fix: remove empty env: block left after NODE_AUTH_TOKEN removal Empty env: mappings are invalid GitHub Actions YAML, causing "Unexpected value ''" workflow validation errors. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/ci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7cebc3f..a5d3056 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -50,4 +50,3 @@ jobs: main-branch-latest-tag: true ## sign the deployment provenance: true - env: