Run details

virtualWorkspace

CI Pipeline Executions
- Current executionSucceeded
  v3.0.0-rc.0
- Runs and Agents
- Configuration
- Self-Healing CI
- Project Graph
- Circular DependenciesEnterprise
- Resource Usage
- Analysis
- ConformanceEnterprise
Runs

Insights

Compare tasks
Analytics

feat: Solid 2 support (#2) * feat: Solid 2 support * feat(solid-virtual): publish as @rigelbuild/solid-virtual with a fork-owned workflow (RIG-2187) Publish a Solid-2-compatible `@tanstack/solid-virtual` fork to npm as `@rigelbuild/solid-virtual`, so `compass` can drop its unresolvable `github:` pin (`github:RigelBuild/virtual#solid-2-support` resolves the monorepo root — no package export) and consume a real published package on the Solid-1→2 migration (RIG-2187). Frozen design record: `docs/designs/platform/rigelbuild-solid-virtual-publish.md` (orion, DL-015). ## What this branch contains Two commits, kept separate so the Solid-2 work stays upstreamable to `TanStack/virtual`: - **`feat: Solid 2 support`** — the Solid-2 API port (`packages/solid-virtual/{src,tests,package.json}` + lockfile), unchanged from the `solid-2-support` branch. Kept as its own commit so it stays a clean, contributable diff for the eventual upstream PR (branch from upstream `main` + cherry-pick this commit). - **this commit (publish-only)** — renames the package and wires the fork-owned publish: - `packages/solid-virtual/package.json`: `name` `@tanstack/solid-virtual` → `@rigelbuild/solid-virtual`, `version` → `3.0.0-rc.0`. The `@tanstack/virtual-core` dep stays `workspace:*` — `pnpm publish` rewrites the `workspace:` protocol to the resolved range (`3.17.8`) at pack time, so no committed dep edit and no republish of `virtual-core` (it is unchanged from upstream). `repository`/`funding` metadata left as upstream (honest for a fork; keeps this commit minimal). - `.github/workflows/publish-rigelbuild.yml`: a fork-owned publish gated `if: github.repository_owner == 'RigelBuild'`, firing on a `v*` tag or manual dispatch. Runs the monorepo `test:ci` (nx `run-many`, not `affected` — a tag push has no affected base, so `affected` would run nothing and could ship an unbuilt dist; `run-many` builds every package in dependency order), then a direct `pnpm publish --filter @rigelbuild/solid-virtual --tag <disttag> --no-git-checks`. The dist-tag is computed from the version (prerelease → `next`, GA → `latest`), mirroring the solid-markdown fork's `publish.yml`. Authenticated by the `NPM_TOKEN` Actions secret provisioned via orion Pulumi (separate PR). Upstream `release.yml` (gated `if: github.repository_owner == 'TanStack'`) is left untouched. `changeset publish` is deliberately not used: it ignores `config.ignore`, rejects ignoring `virtual-core` while a non-ignored package depends on it, and mis-tags a prerelease as `latest` — the direct filtered publish scopes the one renamed package cleanly while still reusing the pnpm monorepo build/test infra (frozen record D2). The publish itself (tag + workflow run + npm verify) is a follow-up once this and the orion token PR merge. Refs RIG-2187 Co-authored-by: Matt Wilkinson <matt@rigel.build> * fix(solid-virtual): make the publish workflow actually authenticate + publish (RIG-2187) Fold review findings on the fork-owned publish workflow — three runtime-only failures a local build can't surface, all in the publish/auth plumbing: - **HIGH — provenance needs `id-token: write`.** The fork root `.npmrc` sets `provenance=true`, so `pnpm publish` generates an npm provenance attestation signed via GitHub OIDC, which requires the job to hold `id-token: write`. The job had only `contents: read`, so the first `v*` tag would fail at the publish step. Added job-level `permissions: { contents: read, id-token: write }`, mirroring upstream `release.yml`. The NPM_TOKEN still authenticates the upload; provenance is the attestation, not the auth (this is not trusted publishing). - **MEDIUM — first scoped publish needs public access.** `@rigelbuild/solid-virtual` is a new scoped package; npm defaults scoped packages to `restricted`, so the first publish would 402 (or publish privately, breaking the compass consumer contract). Added `"publishConfig": { "access": "public" }` to `packages/solid-virtual/package.json`, matching the proven `@rigelbuild/solid-markdown` precedent. - **MEDIUM — pnpm auth was wired to inert env vars.** `NPM_CONFIG_TOKEN` maps to the legacy global `token` config registry.npmjs.org no longer accepts, and `NODE_AUTH_TOKEN` is a setup-node convention pnpm doesn't read natively — so the publish would 401/ENEEDAUTH. Replaced both with the per-registry URL-scoped env var `pnpm_config_//registry.npmjs.org/:_authToken`, which pnpm (>=11.6) honors natively: file-free, and un-redirectable since the registry is baked into the key. Spec-impact: none Refs RIG-2187 Co-authored-by: Matt Wilkinson <matt@rigel.build> * fix(solid-virtual): publish without provenance to match the fork's upstream-pointed manifest (RIG-2187) Round-2 review HIGH: the previous review-fix added `id-token: write` to let `pnpm publish` sign a provenance attestation, but the package's `repository.url` points at the upstream `TanStack/virtual` repo (frozen in DL-015 as "honest for a fork"), while the workflow publishes from `RigelBuild/virtual`. npm provenance requires `repository.url` to match the publishing repo (OIDC-derived) or the registry rejects the upload (422/EPROVENANCE) — so the first `v*` tag would fail at publish. The design-consistent resolution is to publish WITHOUT provenance, exactly like the `@rigelbuild/solid-markdown` precedent (no provenance, no id-token, `repository.url` left as-is), keeping DL-015's frozen decision to leave `repository.url` pointing upstream: - Force provenance off at publish time via `pnpm_config_provenance: "false"` on the Publish step. This is the only surface pnpm 11 reads provenance from: `isNpmrcReadableKey` (pnpm11 config/reader localConfig.ts) admits only auth/network keys, so a `provenance` line in any `.npmrc` (including the repo-root `provenance=true`) is silently ignored — the env var (`pnpm_config_*`, lowercase; pnpm 11 dropped `npm_config_*`) makes OFF explicit and version-proof rather than relying on that default. No `.npmrc` edit (which pnpm ignores) and no CLI flag (pnpm exposes none) can do this. - Drop the now-dead `id-token: write`, reverting the job to `permissions: { contents: read }` — no OIDC token is minted, matching the solid-markdown precedent and avoiding an orphaned permission widening on a token-handling workflow. Spec-impact: none Refs RIG-2187 Co-authored-by: Matt Wilkinson <matt@rigel.build> --------- Co-authored-by: Matt Wilkinson <matt@rigel.build>

nx run-many --targets=test:sherif,test:knip,test:docs,test:eslint,test:lib,test:e2e,test:types,test:build,build

Succeeded

4 CPU cores

61270bf3v3.0.0-rc.0

Get faster results

Learn how to enable distribution.

Atomizer enabled

69 groups of tasks optimized.

Resource usage reports are turned off for this workspace

Your organization has the Resource usage add-on, but this workspace does not collect metrics for non distributed runs. Turn it back on in workspace settings.

© 2026 - Nx Cloud

Terms of Service Privacy Policy Changelog Status Docs Contact Nx Cloud Pricing Company @NxDevTools

virtualWorkspace