Commit Graph

16 Commits

Author SHA1 Message Date
YeonGyu-Kim 37a2dbcace fix(ci): add shell: bash to retry action for Windows compatibility 2026-02-01 19:58:23 +09:00
justsisyphus c4fd877c03 fix(ci): add retry logic for platform binary builds
- Use nick-fields/retry@v3 for Build binary step
- 5 minute timeout per attempt
- Max 5 attempts with 10s wait between retries
- Prevents infinite hang on Bun cross-compile network issues
2026-02-01 17:03:35 +09:00
justsisyphus c215487660 fix: add NODE_AUTH_TOKEN env to publish step 2026-01-30 13:36:20 +09:00
justsisyphus f3e3f63a01 fix: restore registry-url for npm auth with new granular token 2026-01-30 13:21:35 +09:00
justsisyphus dda06e4026 fix: remove registry-url from setup-node to enable OIDC auth 2026-01-30 13:11:44 +09:00
justsisyphus 4768fe269e fix: manually create .npmrc without token for OIDC
setup-node with registry-url injects NODE_AUTH_TOKEN secret which is revoked.
Create .npmrc manually with empty _authToken to force OIDC authentication.
2026-01-30 12:57:15 +09:00
justsisyphus 5928a504eb fix: match main workflow's OIDC setup exactly
Main workflow works with registry-url + NPM_CONFIG_PROVENANCE.
Removed all extra env vars and debugging - simplify to match working pattern.
2026-01-30 12:52:57 +09:00
justsisyphus 351cfed550 fix: remove registry-url to enable npm OIDC auto-detection
- Remove registry-url from setup-node (was injecting NODE_AUTH_TOKEN)
- Add npm version check and auto-upgrade for OIDC support (11.5.1+)
- Add explicit --registry flag to npm publish
- Remove empty NODE_AUTH_TOKEN/NPM_CONFIG_USERCONFIG env vars that were breaking OIDC
2026-01-30 12:47:15 +09:00
justsisyphus df9004d6f7 fix(ci): override env vars to disable token auth, force OIDC 2026-01-30 12:41:00 +09:00
justsisyphus 6d1ee8d1e6 fix(ci): also remove NPM_CONFIG_USERCONFIG .npmrc and unset tokens for OIDC 2026-01-30 12:37:12 +09:00
justsisyphus 8f24950cdd fix(ci): remove .npmrc to enable pure OIDC auth for npm publish 2026-01-30 12:33:51 +09:00
justsisyphus 78e7f75a33 fix(ci): remove registry-url to use pure OIDC auth for npm publish 2026-01-30 12:29:33 +09:00
justsisyphus 7c51096c65 fix(publish-platform): use 7z on Windows, simplify skip logic 2026-01-30 12:25:30 +09:00
justsisyphus f30a7d495a ci(publish-platform): separate build/publish jobs with OIDC provenance
- Split into two jobs: build (compile binaries) and publish (npm publish)
- Build job uploads compressed artifacts (tar.gz/zip)
- Publish job downloads artifacts and uses OIDC Trusted Publishing
- Removes NODE_AUTH_TOKEN dependency, uses npm provenance instead
- Increased timeout for large binary uploads (40-120MB)
- Build parallelism increased to 7 (all platforms simultaneously)
- Fixes npm classic token deprecation issue

Benefits:
- Fresh OIDC token at publish time avoids timeout issues
- No token rotation needed (OIDC is ephemeral)
- Build failures isolated from publish failures
- Artifacts can be reused if publish fails
2026-01-30 12:21:24 +09:00
justsisyphus e591f562f7 fix(ci): build Windows binary natively to fix segfault (#1019)
Bun cross-compilation from Linux to Windows produces binaries that crash
with 'Segmentation fault at address 0xFFFFFFFFFFFFFFFF'.

Root cause: oven-sh/bun#18416

Solution:
- Use windows-latest runner for Windows platform in publish-platform.yml
- Set shell: bash for consistent behavior across runners

This is a simpler fix than PR #938 which modified publish.yml (wrong workflow).
The platform binaries are built and published by publish-platform.yml.

Fixes #873
Fixes #844

Co-authored-by: justsisyphus <justsisyphus@users.noreply.github.com>
2026-01-23 16:30:47 +09:00
justsisyphus d418ef8bd6 refactor(ci): separate platform publish into dedicated workflow
- publish.yml: main package only, triggers platform workflow on success
- publish-platform.yml: dedicated workflow with fresh OIDC token per run
- Fixes OIDC token expiration during large binary uploads (~40MB+)
- Platform workflow can also be triggered manually via workflow_dispatch
2026-01-22 11:22:26 +09:00