Merge pull request #148 from Max-Health-Inc/develop

🚀 Promote develop → main

Author: quotentiroler

.github/workflows/_parity-tests.yml

@@ -27,6 +27,14 @@ on:
 # In local dev, babelfhir-ts defaults to ~/.fhir/packages/ (shared with HL7 Validator).
 env:
   FHIR_CACHE_ROOT: .cache
+  # @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a
+  # token even though the package is public. Set at workflow level so every `npm ci` in
+  # every job below is covered, including the one that installs inside packages/zod.
+  # Callers MUST pass `secrets: inherit` — a reusable workflow sees no secrets otherwise,
+  # and an unset secret expands to an EMPTY string that fails with a 401 identical to a bad
+  # token. Nothing here publishes, so a repo-wide NODE_AUTH_TOKEN is safe; the release
+  # workflows scope theirs to the install step so it cannot reach `npm publish`.
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
 
 jobs:
   # ── Resolve validator versions ─────────────────────────────────────────────
@@ -105,6 +113,9 @@ jobs:
   internal:
     needs: [setup]
     runs-on: ubuntu-latest
+    # Generates the packages the other two jobs reuse, so it is the longest of the
+    # three; bounded for the same reason as hl7 below.
+    timeout-minutes: 45
     permissions:
       contents: read
     strategy:
@@ -231,6 +242,9 @@ jobs:
     needs: [setup, internal, resolve-versions]
     if: ${{ !cancelled() }}
     runs-on: ubuntu-latest
+    # Same exposure as hl7: an external validator subprocess that can stall on the
+    # network with no output.
+    timeout-minutes: 30
     permissions:
       contents: read
     strategy:
@@ -360,6 +374,11 @@ jobs:
     needs: [setup, internal, resolve-versions]
     if: ${{ !cancelled() }}
     runs-on: ubuntu-latest
+    # The external validator runs as a subprocess with no output while it works, so
+    # a network stall inside it reads as a live job. Without a bound it inherits
+    # GitHub's 6-hour default: one hl7 (ips) job sat for 30+ minutes on nothing
+    # before being cancelled by hand. A whole package takes single-digit minutes.
+    timeout-minutes: 30
     permissions:
       contents: read
     strategy:

.github/workflows/_release.yml

@@ -50,6 +50,14 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
+        # Scoped to THIS step on purpose. setup-node above wrote
+        # `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into the project .npmrc, so a
+        # workflow-level NODE_AUTH_TOKEN would be sent to npmjs.org by `npm publish` below —
+        # a GitHub token is not valid there, and it would override the OIDC trusted publishing
+        # this workflow relies on. Here it only authenticates the @max-health-inc scope in the
+        # committed .npmrc (GitHub Packages needs a token even for a public package).
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
         run: npm ci
 
       - name: Update npm to latest (required for OIDC)

.github/workflows/ci.yml

@@ -6,6 +6,13 @@ on:
   pull_request:
     branches: [develop, main]
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/deploy-docs.yml

@@ -10,6 +10,13 @@ on:
       - 'package.json'
   workflow_dispatch:
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   deploy-docs:
     runs-on: ubuntu-latest

.github/workflows/pipeline-parity-develop.yml

@@ -23,10 +23,20 @@ concurrency:
   group: parity-develop-${{ github.ref }}
   cancel-in-progress: false
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   # ── Run both validators in parallel (reusable workflow) ────────────────────
   parity-tests:
     uses: ./.github/workflows/_parity-tests.yml
+    # Required: the reusable workflow's `npm ci` needs GH_PACKAGES_TOKEN to fetch
+    # @max-health-inc/config, and a called workflow sees NO secrets without this.
+    secrets: inherit
     with:
       packages: ${{ github.event.inputs.packages || 'all' }}
       validator_version: ${{ github.event.inputs.validator_version || 'latest' }}

.github/workflows/pipeline-parity-main.yml

@@ -19,10 +19,20 @@ on:
         required: false
         default: 'latest'
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   # ── Run both validators in parallel (reusable workflow) ────────────────────
   parity-tests:
     uses: ./.github/workflows/_parity-tests.yml
+    # Required: the reusable workflow's `npm ci` needs GH_PACKAGES_TOKEN to fetch
+    # @max-health-inc/config, and a called workflow sees NO secrets without this.
+    secrets: inherit
     with:
       packages: ${{ github.event.inputs.packages || 'all' }}
       validator_version: ${{ github.event.inputs.validator_version || 'latest' }}

.github/workflows/prerelease-develop.yml

@@ -6,6 +6,13 @@ on:
       - develop
   workflow_dispatch:
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   prerelease:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -56,6 +56,14 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
+        # Scoped to THIS step on purpose. setup-node above wrote
+        # `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into the project .npmrc, so a
+        # workflow-level NODE_AUTH_TOKEN would be sent to npmjs.org by `npm publish` below —
+        # a GitHub token is not valid there, and it would override the OIDC trusted publishing
+        # this workflow relies on. Here it only authenticates the @max-health-inc scope in the
+        # committed .npmrc (GitHub Packages needs a token even for a public package).
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
         run: npm ci
 
       - name: Update npm to latest (required for OIDC)

.github/workflows/self-heal.yml

@@ -25,6 +25,13 @@ permissions:
   contents: write
   actions: read
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   self-heal:
     name: Auto-Fix Test Failures

.npmrc

@@ -0,0 +1,13 @@
+# @max-health-inc/config comes from the GitHub Packages npm registry, not npmjs.org. A
+# GitHub Packages scope resolves to the OWNER hosting it, so the scope must be mapped
+# explicitly — without this line npm resolves @max-health-inc/* against registry.npmjs.org
+# and 404s.
+#
+# npm substitutes ${NODE_AUTH_TOKEN} at install time, so no token is committed. CI supplies
+# it as GH_PACKAGES_TOKEN on every `npm ci` step; locally, `gh auth token` works. The
+# registry requires a token even though the package is PUBLIC.
+#
+# Everything else this repo installs, and everything it PUBLISHES (@babelfhir-ts/* ->
+# registry.npmjs.org, see _release.yml), is unaffected: only this one scope is redirected.
+@max-health-inc:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}