Skip to content

fix: ensure trusted publishing uses npm 11 [FEPLAT-5048] - #54

Merged
ilan-phantom merged 1 commit into
masterfrom
dan/feplat-5048-fix-trusted-publishing
Aug 13, 2026
Merged

fix: ensure trusted publishing uses npm 11 [FEPLAT-5048]#54
ilan-phantom merged 1 commit into
masterfrom
dan/feplat-5048-fix-trusted-publishing

Conversation

@ilan-phantom

@ilan-phantom ilan-phantom commented Aug 12, 2026

Copy link
Copy Markdown

Summary

  • remove the obsolete Semantic Release script and dependencies
  • remove the transitive npm 6 binary that shadows the workflow-installed npm 11
  • keep Changesets as the only release implementation

Why

The failed release run used node_modules/.bin/npm 6.14.18. That version cannot perform npm Trusted Publishing's OIDC exchange, so the publish continued unauthenticated and npm returned E404.

Failed run: https://github.com/phantom/react-native-webview/actions/runs/31612642119/job/94167581149

Validation

  • frozen Yarn install
  • TypeScript and ESLint
  • declaration generation and Babel build
  • confirmed no local node_modules/.bin/npm remains
  • confirmed the release subprocess resolves npm 11 instead of npm 6

Summary by CodeRabbit

  • Chores
    • Removed the automated publishing workflow and related release tooling.

@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c2557a3c-7b76-4ca8-a87f-f2b9920d8f0a

📥 Commits

Reviewing files that changed from the base of the PR and between 17d8ca6 and ca90b99.

⛔ Files ignored due to path filters (1)
  • yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (1)
  • package.json
💤 Files with no reviewable changes (1)
  • package.json

📝 Walkthrough

Walkthrough

The package manifest removes the ci:publish script and the @semantic-release/git and semantic-release development dependencies.

Changes

Release tooling removal

Layer / File(s) Summary
Remove semantic-release configuration
package.json
The manifest no longer defines the ci:publish script or the semantic-release development dependencies.

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: removing npm 6 shadowing so trusted publishing uses npm 11.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dan/feplat-5048-fix-trusted-publishing

Comment @coderabbitai help to get the list of available commands.

@ilan-phantom
ilan-phantom merged commit ebd8509 into master Aug 13, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants