After switching to npm Trusted Publishing the publish step still
returned 'PUT 404' because actions/setup-node injects an
'//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}' line into
.npmrc. With NODE_AUTH_TOKEN unset that placeholder evaluates to
an empty string, so npm tries an empty token before reaching for
the OIDC ID token and the registry rejects it.
- Add a step that strips any _authToken line from both project-
local and $HOME/.npmrc before publishing, so npm CLI proceeds
to OIDC token exchange.
- Bump publish commands to --loglevel verbose so future failures
expose the actual auth path (provenance attestation, OIDC
exchange, etc.) in workflow logs.
NODE_AUTH_TOKEN expired (set 90 days ago, the npm token default
expiry) causing all publish runs to fail with 'PUT 404 Not Found'
since 2026-04-30.
Migrate publish.yml and publish-platform.yml to npm Trusted
Publishing (OIDC) so we no longer depend on long-lived secrets:
- Bump actions/setup-node v4 -> v6 (improves OIDC compatibility)
- Add 'npm install -g npm@latest' to guarantee npm CLI >= 11.5.1
(the minimum required for trusted publishing).
- Drop NODE_AUTH_TOKEN env from every publish step. The npm CLI
picks up the GitHub Actions OIDC token automatically.
- Keep --provenance / NPM_CONFIG_PROVENANCE=true (real-world
reports indicate provenance is not auto-emitted yet).
Per-package trusted publisher must still be configured on
npmjs.com (Settings -> Trusted Publisher) for all 24 packages
(oh-my-opencode + oh-my-openagent main + 11 platform packages
each, dual-published) before the next publish run.
Bun-compiled binaries contain a malformed LC_CODE_SIGNATURE load
command that prevents codesign from directly replacing it. Remove
the existing signature first, then apply a fresh ad-hoc signature.
Bun on github macos-latest runners does not emit linker-signed
signatures by default. Sign explicitly with 'codesign --sign -'
without preserve-metadata since the binary has no prior signature.
The previous ad-hoc codesign step failed with 'invalid or unsupported
format for signature' because it tried to preserve the 'linker-signed'
flag which cannot be re-signed. The native macOS build already produces
a valid ad-hoc signature via Bun's linker, so we only need to verify
the signature exists rather than re-sign it.
v3.16.0 binaries had 'adhoc,linker-signed' signatures because newer
Bun versions no longer emit linker-signed signatures when cross-compiling
darwin targets from Linux. Current releases have 'code object is not
signed at all', causing macOS Gatekeeper to reject them immediately.
Verified empirically:
- v3.16.0 darwin-arm64: Signature=adhoc, flags=0x20002(adhoc,linker-signed)
- v3.17.0 darwin-arm64: 'code object is not signed at all'
- Local bun build on macos: produces linker-signed signature (matches v3.16.0)
Changes:
- Route darwin-* platforms to macos-latest runner (native compile)
- Add explicit ad-hoc codesign step as belt-and-suspenders safety net
- publish-platform.yml: Build job now checks BOTH oh-my-opencode and
oh-my-openagent before skipping. Build only skips when both are published.
Added 'Publish oh-my-openagent-{platform}' step that renames package.json
and publishes under the openagent name.
- publish.yml: Added 'Publish oh-my-openagent' step after opencode publish.
Rewrites package name and optionalDependencies to oh-my-openagent variants,
then publishes. Restores package.json after.
Previously, oh-my-openagent platform packages were never published because
the build skip check only looked at oh-my-opencode (which was already published),
causing the entire build to be skipped.
Keep installer, config detection, schema generation, and publish workflows aligned with the long-lived oh-my-opencode package so this release does not split across two npm names.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
After publishing oh-my-opencode-{platform}, rename package.json and
publish oh-my-openagent-{platform} from the same build artifact.
Download/extract steps now run if either package needs publishing.
Bun's internal download of baseline compile targets from npm registry
consistently fails on Windows CI runners (ExtractionFailed error).
Pre-download the baseline binary via curl into Bun's cache directory
so the compile step finds it already cached and skips the download.
Also makes publish job resilient with if: always() so one failed
platform doesn't block publishing all other successful platforms.
publish job now runs with if: always() && !cancelled(), and gates
each publish step on download.outcome == 'success'. One flaky target
(e.g. windows-x64-baseline) no longer blocks all other platforms.
- Use nick-fields/retry@v3 for Build binary step
- 5 minute timeout per attempt
- Max 5 attempts with 10s wait between retries
- Prevents infinite hang on Bun cross-compile network issues
setup-node with registry-url injects NODE_AUTH_TOKEN secret which is revoked.
Create .npmrc manually with empty _authToken to force OIDC authentication.
- Remove registry-url from setup-node (was injecting NODE_AUTH_TOKEN)
- Add npm version check and auto-upgrade for OIDC support (11.5.1+)
- Add explicit --registry flag to npm publish
- Remove empty NODE_AUTH_TOKEN/NPM_CONFIG_USERCONFIG env vars that were breaking OIDC
Bun cross-compilation from Linux to Windows produces binaries that crash
with 'Segmentation fault at address 0xFFFFFFFFFFFFFFFF'.
Root cause: oven-sh/bun#18416
Solution:
- Use windows-latest runner for Windows platform in publish-platform.yml
- Set shell: bash for consistent behavior across runners
This is a simpler fix than PR #938 which modified publish.yml (wrong workflow).
The platform binaries are built and published by publish-platform.yml.
Fixes#873Fixes#844
Co-authored-by: justsisyphus <justsisyphus@users.noreply.github.com>
- publish.yml: main package only, triggers platform workflow on success
- publish-platform.yml: dedicated workflow with fresh OIDC token per run
- Fixes OIDC token expiration during large binary uploads (~40MB+)
- Platform workflow can also be triggered manually via workflow_dispatch
YeonGyu-Kim