From 85e8e4817f79423177dca2a088f1ab620238abee Mon Sep 17 00:00:00 2001 From: Ondrej Machek Date: Fri, 24 Jul 2026 22:56:06 +0200 Subject: [PATCH] Add a loglevel input to the publish workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two 3.0.0 publish attempts have now failed with `E403 Forbidden - PUT` at the very last step, and npm's default `notice` output says nothing at all about the OIDC exchange — there is no way to tell from the log whether npm attempted it, or what the registry objected to. Expose the npm loglevel as a workflow_dispatch choice so a publish can be re-run with `verbose` (or `silly`) without editing this file under time pressure. `release` events pass no inputs, hence the `|| 'notice'` fallback, and the value goes through `env:` rather than being interpolated into the script body. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/publish.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 48329cd..a144bee 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -15,6 +15,12 @@ on: release: types: [published] workflow_dispatch: + inputs: + loglevel: + description: 'npm loglevel for the publish step — "verbose" shows the OIDC exchange' + default: notice + type: choice + options: [notice, verbose, silly] permissions: contents: read @@ -109,7 +115,11 @@ jobs: # Provenance is automatic under trusted publishing, but --provenance is # kept explicit so the run fails loudly rather than silently publishing # an unattested tarball if the exchange ever stops happening. + # LOGLEVEL goes through env, never `${{ }}` inside the script body. + # `release` events supply no inputs, hence the fallback. + env: + LOGLEVEL: ${{ inputs.loglevel || 'notice' }} run: | npm install -g npm@latest npm --version - npm publish --provenance --access public + npm publish --provenance --access public --loglevel "$LOGLEVEL"