v0.6.0 publish is blocked on six Trusted Publisher registrations — runbook #370

Activity

1. tps-flint commented on Sep 17, 2026

   

   tps-flint

   on Sep 17, 2026

   ContributorAuthor

   More actions

   Status 2026-09-17 15:0xZ — the tag now carries the corrected failure path.

   v0.6.0 re-cut onto 55b6bce8 (the #369 merge). Preconditions re-verified before moving it:
   main settled green (11 checks, no non-success conclusions), all six packages and all four
   optionalDependencies pins at 0.6.0, and nothing published at 0.6.0 on npm.

   Run 35237223167 behaved exactly as
   designed: preflight, smoke and all four binary builds green; publish-packages failed at npm
   auth; github-release skipped; release endpoint confirmed 404; nothing published.

   The failure message is now the corrected one, verified from the runtime output (not from the
   script GitHub echoes before executing it — that echo is unexpanded source and is easy to mistake
   for evidence):

   stage publish failed for @tpsdev-ai/cli-darwin-arm64@0.6.0 and it is not published.
   npm reported an authentication failure (ENEEDAUTH) — OIDC did not authenticate
   for this package.
   Check, for THIS exact package name (@tpsdev-ai/cli-darwin-arm64):
     - a Trusted Publisher registration exists for @tpsdev-ai/cli-darwin-arm64 on npmjs.com,
       with repository + workflow filename matching this job (trust is
       per package, so a missing registration affects only @tpsdev-ai/cli-darwin-arm64)
     ...
   Fix the registration or the OIDC claim, then re-run this tag.
   

   Counted in that run: 0 "ALREADY STAGED" claims and 0 "PARTIAL STAGE" lines — the latter
   correctly absent, because the failure was on the first package so nothing was pending.

   Nothing further can happen without the six registrations in this issue. Once they exist,
   re-running this tag stages all six for approval. Note the last step is still manual and separate:
   approval publishes under staged, and latest moves only via npm dist-tag add (#366) — the
   Summary now prints that reminder even on a re-run where nothing new was staged.
2. tps-flint commented on Sep 20, 2026

   

   tps-flint

   on Sep 20, 2026

   ContributorAuthor

   More actions

   Done 2026-09-19. All six Trusted Publishers are registered and v0.6.0 is published.

   Registered on tpsdev-ai/cli / release.yml, environment blank, npm stage publish only (the
   "Allow npm publish" box deliberately left unchecked, so CI can stage but nothing publishes directly —
   2FA stays the real gate):

   @tpsdev-ai/cli · agent · cli-darwin-arm64 · cli-darwin-x64 · cli-linux-arm64 · cli-linux-x64
   

   Re-ran release.yml on the existing v0.6.0 tag (--failed, reusing the smoke-tested binary
   artifacts rather than rebuilding). All six staged with signed provenance — sigstore transparency
   log index 2893232779 — and were approved. First release we have ever shipped with provenance;
   0.5.4 has no attestations at all.

   Verified after publish rather than from the green job: cli@0.6.0 bin is intact
   ({"tps": "bin/tps.cjs"} — npm's "bin[tps] … invalid and removed" warning describes its own
   normalisation, not a removal), and dist.attestations is present with predicateType
https://slsa.dev/provenance/v1.

   Not fully closed for users yet, and that is #366, not this issue: latest still points at
   0.5.4. Approval cannot move a dist-tag. ./scripts/promote-latest.sh 0.6.0 must run from main
   — not from the tag, which predates #371 — on an npm-authenticated machine.

   Three findings worth carrying, filed or noted separately:

   • Three of the six were first registered against tpsdev-ci, a GitHub org that does not exist —
     an unclaimed namespace anyone could have registered to gain publish rights to the three packages
     that ship the actual binaries. Caught by reading back npm trust list, revoked, re-registered.
     npm validates neither the org nor the workflow filename at registration.
   • npm trust list / npm trust github exist and are the better path than the web form on a current
     npm — but an older client cannot express stage-only and 400s on create (filed as ops-uxfo).
   • The v0.6.0 tag has been moved at least three times, so "the artifact built from v0.6.0" is not a
     stable referent. Filed separately as ops-99ja.
3. tps-flint

   closed this as completedon Sep 20, 2026