Use OIDC publishing for abis and solidity packages by alvarof2 · Pull Request #11695 · celo-org/celo-monorepo

alvarof2 · 2026-03-12T09:44:30Z

Publish contracts abi OIDC

Note

Medium Risk
Changes the NPM release workflow authentication path (removing token-based publishing in favor of OIDC) and bumps the Node/npm toolchain, which could break or alter package publishing if the runner or npm configuration is incompatible.

Overview
Updates the publish-contracts-abi-release GitHub Actions workflow to publish @celo/contracts and @celo/abis via OIDC trusted publishing instead of injecting an NPM_TOKEN from Akeyless.

The job now runs on Node 20 and explicitly upgrades to npm@11.5.1 before npm publish, removing NODE_AUTH_TOKEN usage from the publish steps while keeping the existing build/validation and dist-tagging behavior.

^{Written by Cursor Bugbot for commit d176e1b. This will update automatically on new commits. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 4 potential issues.

Bugbot Free Tier Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

^{Bugbot Autofix is kicking off a free cloud agent to fix these issues. This run is complimentary, but you can enable autofix for all future PRs in the Cursor dashboard.}

cursor · 2026-03-12T09:49:12Z

      - uses: actions/setup-node@v4
        with:
-          node-version: '18.x'
+          node-version: '20.x'


Node.js 20.x doesn't meet OIDC minimum version requirement

High Severity

npm OIDC trusted publishing requires Node.js 22.14.0 or higher, but node-version is set to '20.x'. The version was upgraded from 18.x to 20.x, but that's still insufficient for trusted publishing. Both npm publish steps will fail authentication because the OIDC token exchange mechanism is not available on Node.js 20.

This is not true

cursor · 2026-03-12T09:49:12Z

        run: echo "COMMIT_HASH=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+
+      - name: Update npm for OIDC trusted publishing (v11.5.1)
+        run: npm install -g npm@11.5.1


OIDC trusted publishing unsupported on self-hosted runners

High Severity

npm OIDC trusted publishing currently only supports GitHub-hosted runners, not self-hosted ones. This job uses runs-on: ['self-hosted', 'org', 'npm-publish']. The npm registry will reject the OIDC token from a self-hosted runner because it verifies the runner_environment claim. The old token-based auth that worked on self-hosted runners has been removed.

cursor · 2026-03-12T09:49:12Z

-        uses: docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
-        with:
-          api-url: https://api.gateway.akeyless.celo-networks-dev.org
-          access-id: p-kf9vjzruht6l


setup-node registry-url creates .npmrc conflicting with OIDC

Medium Severity

The actions/setup-node step with registry-url generates an .npmrc file containing //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}. Since NODE_AUTH_TOKEN was removed from the env vars, this resolves to empty, which can prevent npm from falling through to OIDC authentication — a known issue tracked in actions/setup-node#1440.

cursor · 2026-03-12T09:49:12Z

+
+      - name: Update npm for OIDC trusted publishing (v11.5.1)
+        run: npm install -g npm@11.5.1
+


OIDC trusted publishing doesn't authenticate npm dist-tag add

High Severity

npm OIDC trusted publishing only authenticates the npm publish command. The npm dist-tag add calls at lines 110 and 127 will fail with auth errors because OIDC doesn't cover that command (tracked as npm/cli#8547). Previously, NODE_AUTH_TOKEN provided a persistent token that worked for both operations. After a successful publish, the step will error out on dist-tag add, leaving packages published but untagged with the commit hash.

Additional Locations (1)

.github/workflows/publish-contracts-abi-release.yml#L117-L133

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d176e1b46e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-12T09:59:34Z

        env:
          RELEASE_TYPE: --tag ${{ env.RELEASE_TYPE != '' && env.RELEASE_TYPE || 'canary' }}
          RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
-          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
          DRY_RUN: ${{ env.RELEASE_VERSION == '' && '--dry-run' || '' }}
          COMMIT_HASH: ${{ env.COMMIT_HASH }}


Provide auth for dist-tag updates

This change removes NODE_AUTH_TOKEN from the publish step env while still running npm dist-tag add in non-dry-run releases, so the tag update now runs without explicit npm credentials. In this workflow that path is taken whenever RELEASE_VERSION is set, and npm dist-tag is a registry write operation (npm dist-tag --help: add, rm, ls) that fails unauthenticated (403/ENEEDAUTH), which would make release jobs fail after publishing and skip the commit-hash dist-tagging.

Useful? React with 👍 / 👎.

cursor · 2026-03-12T10:01:42Z

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 11.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

cursor · 2026-03-12T10:12:07Z

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 11.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

alvarof2 · 2026-03-12T10:13:37Z

Commented the # npm dist-tag add @celo/abis@$RELEASE_VERSION $COMMIT_HASH lines. Unsure if this is required, but this requires an NPM token

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e89c28521a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-12T10:16:40Z

            exit 0
          fi
-          npm dist-tag add @celo/contracts@$RELEASE_VERSION $COMMIT_HASH              
+          # npm dist-tag add @celo/contracts@$RELEASE_VERSION $COMMIT_HASH              


Restore commit-hash dist-tagging in release publishes

In non-dry-run releases (RELEASE_VERSION set), this line is now commented out, so the workflow no longer creates the $COMMIT_HASH dist-tag alias after publishing. That silently removes the commit-to-package traceability behavior this job previously provided (the same change appears in both publish steps), even though the workflow still computes and logs commit-hash tagging.

Useful? React with 👍 / 👎.

cursor · 2026-03-12T13:11:10Z

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 11.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

cursor · 2026-03-12T13:30:47Z

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 11.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

cursor · 2026-03-12T13:58:46Z

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 11.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

…ersist in CI)

cursor · 2026-03-12T14:07:04Z

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 11.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a8b4abd4d7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-23T12:52:31Z

-          node-version: '18.x'
-          registry-url: 'https://registry.npmjs.org'
-          #scope: '@celo'
+          node-version: '20.x'


Use a Truffle-supported Node version in this workflow

This job still runs yarn build --include-dependencies, which reaches packages/protocol's build script and shells out to truffle compile in packages/protocol/scripts/build.ts. The repo is pinned to truffle@5.9.0 (packages/protocol/package.json), and Truffle only added Node 20 support in later releases, so bumping this runner from 18.x to 20.x can break the compile step before either package is published. That would block every contracts/abis release until Truffle is upgraded or the workflow stays on Node 18.

Useful? React with 👍 / 👎.

Use OIDC publishing for abis and solidity packages

d176e1b

alvarof2 requested a review from a team March 12, 2026 09:44

alvarof2 requested a review from a team as a code owner March 12, 2026 09:44

alvarof2 requested a review from jcortejoso March 12, 2026 09:44

cursor bot reviewed Mar 12, 2026

View reviewed changes

runs-on

16b39a4

chatgpt-codex-connector bot reviewed Mar 12, 2026

View reviewed changes

Fixes

e89c285

chatgpt-codex-connector bot reviewed Mar 12, 2026

View reviewed changes

Fix scripts for dry-run

b0fe6f8

Fix paths in CI

4afbcf7

Comment CONTRACTS_PACKAGE_SRC_DIR

6820b7f

# Fallback: ensure package.json has version (prepare script may not p…

3f21d65

…ersist in CI)

Merge branch 'release/core-contracts/16' into publish-contracts-abi-oidc

a8b4abd

chatgpt-codex-connector bot reviewed Mar 23, 2026

View reviewed changes

martinvol changed the base branch from release/core-contracts/16 to release/core-contracts/17 April 14, 2026 14:38


		- name: Update npm for OIDC trusted publishing (v11.5.1)
		run: npm install -g npm@11.5.1

Conversation

alvarof2 commented Mar 12, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 12, 2026

Choose a reason for hiding this comment

Node.js 20.x doesn't meet OIDC minimum version requirement

Uh oh!

alvarof2 Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 12, 2026

Choose a reason for hiding this comment

OIDC trusted publishing unsupported on self-hosted runners

Uh oh!

alvarof2 Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 12, 2026

Choose a reason for hiding this comment

setup-node registry-url creates .npmrc conflicting with OIDC

Uh oh!

alvarof2 Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 12, 2026

Choose a reason for hiding this comment

OIDC trusted publishing doesn't authenticate npm dist-tag add

Uh oh!

alvarof2 Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot commented Mar 12, 2026

Uh oh!

cursor bot commented Mar 12, 2026

Uh oh!

alvarof2 commented Mar 12, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot commented Mar 12, 2026

Uh oh!

cursor bot commented Mar 12, 2026

Uh oh!

cursor bot commented Mar 12, 2026

Uh oh!

cursor bot commented Mar 12, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

alvarof2 commented Mar 12, 2026 •

edited by cursor bot

Loading

OIDC trusted publishing doesn't authenticate `npm dist-tag add`