ci: use corrected trusted npm publisher (QQQ #915) #46

Merged
KofTwentyTwo merged 2 commits from feature/GH-915-publisher-pin into develop 2026-09-29 20:22:10 +00:00
KofTwentyTwo commented 2026-09-29 20:19:40 +00:00 (Migrated from github.com)

Pin the npm publisher to immutable kingsrook/qqq-orb@0.6.8, which recognizes CircleCI's 1 value for the trusted-publishing Boolean. Orb 0.6.7 skipped OIDC setup, causing publisher 377 to fail with ENEEDAUTH despite valid npm settings.

The exact reviewed orb passes all 25 publisher regression cases and production CI; the expanded consumer configuration validates. Publishing instructions use the same new version. Product source, dependencies and the lockfile are unchanged. Merge triggers a real snapshot publish, followed by a clean public-registry consumer check.

Tracks https://github.com/QRun-IO/qqq/issues/915 and https://github.com/QRun-IO/qqq/issues/912.

Pin the npm publisher to immutable `kingsrook/qqq-orb@0.6.8`, which recognizes CircleCI's `1` value for the trusted-publishing Boolean. Orb 0.6.7 skipped OIDC setup, causing publisher 377 to fail with ENEEDAUTH despite valid npm settings. The exact reviewed orb passes all 25 publisher regression cases and production CI; the expanded consumer configuration validates. Publishing instructions use the same new version. Product source, dependencies and the lockfile are unchanged. Merge triggers a real snapshot publish, followed by a clean public-registry consumer check. Tracks https://github.com/QRun-IO/qqq/issues/915 and https://github.com/QRun-IO/qqq/issues/912.
Sign in to join this conversation.