ta
TanStack
GitHub
virtual
Workspace
GitHub
CI Pipeline Executions
Current execution
Succeeded
compass-ui/rig-2187-publish-solid-virtual
Runs and Agents
Configuration
Self-Healing CI
Project Graph
Circular Dependencies
Enterprise
Resource Usage
Analysis
Conformance
Enterprise
Runs
Current run
Succeeded
Tasks
Resource Usage
Insights
Compare tasks
Analytics
Sign in
Toggle sidebar
fix(solid-virtual): publish without provenance to match the fork's upstream-pointed manifest (RIG-2187) Round-2 review HIGH: the previous review-fix added `id-token: write` to let `pnpm publish` sign a provenance attestation, but the package's `repository.url` points at the upstream `TanStack/virtual` repo (frozen in DL-015 as "honest for a fork"), while the workflow publishes from `RigelBuild/virtual`. npm provenance requires `repository.url` to match the publishing repo (OIDC-derived) or the registry rejects the upload (422/EPROVENANCE) — so the first `v*` tag would fail at publish. The design-consistent resolution is to publish WITHOUT provenance, exactly like the `@rigelbuild/solid-markdown` precedent (no provenance, no id-token, `repository.url` left as-is), keeping DL-015's frozen decision to leave `repository.url` pointing upstream: - Force provenance off at publish time via `pnpm_config_provenance: "false"` on the Publish step. This is the only surface pnpm 11 reads provenance from: `isNpmrcReadableKey` (pnpm11 config/reader localConfig.ts) admits only auth/network keys, so a `provenance` line in any `.npmrc` (including the repo-root `provenance=true`) is silently ignored — the env var (`pnpm_config_*`, lowercase; pnpm 11 dropped `npm_config_*`) makes OFF explicit and version-proof rather than relying on that default. No `.npmrc` edit (which pnpm ignores) and no CLI flag (pnpm exposes none) can do this. - Drop the now-dead `id-token: write`, reverting the job to `permissions: { contents: read }` — no OIDC token is minted, matching the solid-markdown precedent and avoiding an orphaned permission widening on a token-handling workflow. Spec-impact: none Refs RIG-2187 Co-authored-by: Matt Wilkinson <matt@rigel.build>
nx affected --targets=test:sherif,test:knip,test:docs,test:eslint,test:lib,test:e2e,test:types,test:build,build
⌘K
Succeeded
nx affected --targets=test:sherif,test:knip,test:docs,test:eslint,test:lib,test:e2e,test:types,test:build,build
Click to copy
Linux
4 CPU cores
b49d3d97
2
Get faster results
Learn how to enable distribution.
Atomizer enabled
69 groups of tasks optimized.
GitHub
virtual
Workspace