[ci] Bug Fix: Trusted-publishing follow-ups (TTY-aware setup script, unify nightly, drop NPM_TOKEN)

[etrepum]

Description

Follow-up to #8587. The first real dev-channel test publish under OIDC failed end-to-end because the helper script's pre-check was wrong, npm enforces a constraint I didn't account for, and the dual-auth scaffolding hid the actual failure mode. Three changes:

1. Fix setup-trusted-publishing.mjs pre-check (scripts/npm/setup-trusted-publishing.mjs)

pnpm run setup-trusted-publishing --setup-trust --replace was supposed to detect each package's existing call-release.yml trust config, revoke it, and add the new pre-release.yml one. Instead it reported unable to check for every package, fell back to "try anyway", which skipped the revoke step, and returned E409 Conflict for all 31 packages.

The pre-check shells out to npm trust list <pkg> --json to read the existing config. npm trust list requires auth and can require OTP — I had incorrectly documented it as read-only / no-OTP. npm only runs its interactive web-auth/OTP recovery when both process.stdin.isTTY and process.stdout.isTTY are true. The pre-check was capturing stdout (necessary to parse JSON), which makes stdout a non-TTY, so npm fell through to throwing EOTP immediately. The script's catch then collapsed every distinct failure into a single "unable to check" log line, hiding the real cause.

Fix:

• New warmTrustAuth(): runs one npm trust list <firstPkg> with stdio: 'inherit' (full TTY) before the per-package loop. Lets the user complete web-auth once and choose "Skip 2FA for the next 5 minutes"; subsequent captured reads then succeed inside the window because they hit the warmed session instead of a fresh OTP challenge.
• fetchTrustConfigs now returns {configs} or {error} instead of an array-or-null, and the loop prints the real npm message (unable to check (401 Unauthorized …)) instead of a bare string.
• Deleted the old hand-rolled token resolver (fetchAuthToken, readNpmrcAuthTokens, escapedName) that read ~/.npmrc manually — npm's own auth resolution is what works, and that's what's used now via the CLI.

2. Unify the nightly schedule into pre-release.yml

After running real test publishes I confirmed two npm constraints that change the workflow shape:

• npm matches trust against the OIDC workflow_ref claim (the calling workflow), same as PyPI. The earlier setup pointed trust at the reusable call-release.yml, which never appears in that claim, so every publish 404'd. The setup script now defaults --workflow to pre-release.yml.
• npm enforces one trust configuration per package. POSTing a second one (even for a different filename) returns E409 while the old one is present. The setup script's --replace flag now revokes the existing non-matching config by id and adds the new one, so the migration from call-release.yml to pre-release.yml is a single command instead of 30+ manual revoke/add pairs.

To make the one-config rule actually workable, every publish has to come through the same caller workflow. Deleted nightly-release.yml and folded its schedule: trigger into pre-release.yml, branching on github.event_name:

• schedule path hardcodes nightly behavior (increment-version=true, channel=nightly, ref=main, ignore-previously-published=true)
• workflow_dispatch path threads the inputs through as before
• guard job's "no increment-version + latest" check is restricted to workflow_dispatch (schedule is always nightly)
• channel choice list adds nightly so a manual nightly retry is possible

3. Drop NPM_TOKEN fallback and the use-trusted-publishing toggle

Now that OIDC is confirmed working, the dual-auth scaffolding is dead weight that hides failures. Removed from call-release.yml and pre-release.yml:

• use-trusted-publishing workflow_dispatch input (forced OIDC when NPM_TOKEN was set)
• secrets.NPM_TOKEN declaration on call-release.yml and the passthrough from pre-release.yml
• The Configure npm auth step (NODE_AUTH_TOKEN=$NPM_TOKEN setup, mode-detection logging)
• The Verify npm authentication step (npm whoami preflight — only meaningful for the persistent-token path; OIDC mints a per-call token at publish time)

What stays: permissions: id-token: write, actions/setup-node with registry-url, and pnpm publish --provenance. A misconfigured trust setup now fails loudly at publish instead of silently falling through to token auth.

Defaults review

Confirmed pre-release.yml's workflow_dispatch defaults still match step 4 of the Release Procedure ("publish to NPM after the version PR is merged to main"):

Input	Default	Step-4 expectation
ref	main	publish whatever main has now
channel	latest	real release goes to default dist-tag
increment-version	unchecked	version.yml already bumped on the merged PR
ignore-previously-published	unchecked	fail loudly on duplicate version

So a normal release run is "Actions → Publish to NPM → Run workflow → Run", no toggling.

Test plan

Before

• pnpm run setup-trusted-publishing --setup-trust --replace reported unable to check; will try anyway for every package, skipped the revoke step, and got E409 on every add.
• The dev-channel manual test publish from a PR branch produced 31 E404 Not Found - PUT https://registry.npmjs.org/<pkg> errors after provenance signing succeeded — npm matched the OIDC token's workflow_ref (pre-release.yml) against a stored config that said call-release.yml.
• The publish workflow accepted NPM_TOKEN as a silent fallback, so a misconfigured OIDC setup wouldn't necessarily be visible.

After

• pnpm install --frozen-lockfile clean on pnpm 10.34.1
• pnpm run ci-check — green (tsc, tsc-scripts, tsc-extension, tsc-website, flow, prettier, lint)
• Both edited workflow YAMLs parse cleanly (yaml.safe_load)
• scripts/npm/setup-trusted-publishing.mjs — node --check clean; symbol audit shows zero orphan helpers from the old token-resolver path
• pnpm run setup-trusted-publishing --setup-trust --replace on a laptop with npm whoami working: warmTrustAuth opens web-auth once; after ticking "Skip 2FA for 5 minutes" the per-package loop reports CONFLICT: existing config(s) for [call-release.yml] for each, revokes them, and registers pre-release.yml. Subsequent runs report already configured for all.
• Re-run the dev-channel test publish (Actions → Publish to NPM, branch + ref = PR branch, channel = dev, increment-version = ✓) — should publish 0.X.Y-dev.0 under the dev dist-tag via OIDC with provenance; latest untouched.
• Confirm the next scheduled nightly (Mon 02:30 UTC) goes through pre-release.yml's schedule path with event_name == 'schedule' and produces the same 0.X.Y-nightly.YYYYMMDD artifact as before.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lexical	Ready	Preview, Comment	May 30, 2026 4:52pm
lexical-playground	Ready	Preview, Comment	May 30, 2026 4:52pm

[potatowagon]

Review by Navi (potatowagon's AI assistant)

This is a well-structured follow-up to #8587 that resolves real issues encountered during the first OIDC test publish. I reviewed the full 900-line diff across workflow YAML and the setup script.

What I verified:

1. Workflow consolidation logic is correct — pre-release.yml now handles both scheduled nightly and manual dispatch via github.event_name branching. The schedule path hardcodes nightly defaults (increment-version=true, channel=nightly, ref=main, ignore-previously-published=true), while dispatch threads inputs through unchanged. The guard job's "no increment + latest" check is correctly gated to workflow_dispatch only.

2. NPM_TOKEN removal is safe — since OIDC is confirmed working, removing the dual-auth path eliminates a failure mode where misconfigured trust silently falls through to token auth. The id-token: write permission and registry-url setup-node config are preserved (both required for OIDC).

3. warmTrustAuth() TTY fix addresses the root cause — npm's OTP recovery requires both stdin and stdout to be TTYs. The pre-check was piping stdout to parse JSON, which broke OTP. Running one fully-interactive read first (stdio: 'inherit') lets the user auth once, then captured reads succeed within the "skip 2FA for 5 minutes" window. Clever fix.

4. fetchTrustConfigs() refactor — replaces hand-rolled .npmrc parsing with shelling out to npm trust list --json, which uses npm's own auth resolution. Returns {configs} or {error} instead of the old null sentinel, so failures are never silently swallowed. Handles 404 (no config), JSON parse errors, and non-zero exits distinctly.

5. --replace flow — correctly detects conflicting configs (different workflow file), revokes by id, then registers the new one. The E409 failure mode from the first attempt is fully addressed.

6. Fork guard — github.repository_owner == 'facebook' added to the release job prevents the scheduled trigger from running on forks. Correct placement.

7. Documentation updates — maintainers guide reflects the simplified workflow (no more use-trusted-publishing toggle, no NPM_TOKEN mentions).

CI status: ALL GREEN (30+ jobs including all e2e matrices, core tests, integration tests, CodeQL).

Verdict: Safe to approve. The changes are logically sound, CI confirms no regressions, and the test plan in the PR description is thorough (real E2E validation on the npm registry).

[potatowagon]

Reviewed by Navi (Tater Thoughts Bobblehead) on behalf of @potatowagon.

LGTM ✅ — CI infrastructure cleanup: consolidates release workflows and fully adopts npm trusted publishing.

What this does:

1. Removes the separate nightly-release.yml workflow — merges nightly schedule into pre-release.yml (now the single entry point for all publishes).
2. Removes the NPM_TOKEN secret and use-trusted-publishing input from call-release.yml — OIDC trusted publishing is now the ONLY auth method.
3. Removes the "Configure npm auth" and "Verify npm authentication" steps (no longer needed with OIDC).
4. Adds id-token: write permission to the publish job (required for OIDC).
5. Adds github.repository_owner == 'facebook' guard to prevent forks from running scheduled publishes.

What I checked:

• ✅ Logic correctness: npm trusted publishing via OIDC requires exactly: (a) id-token: write permission, (b) the workflow file path matching what's configured on npmjs.com. By consolidating to a single workflow file, all publishes share one OIDC identity — correct approach since npm allows only one trusted-publisher config per package.
• ✅ Schedule preserved: The nightly cron: '30 2 * * 1-5' schedule is preserved in the consolidated workflow. The schedule path correctly forces channel=nightly, increment-version=true, ref=main, ignore-previously-published=true.
• ✅ Guard logic correct: The "refuse increment+latest" guard now correctly gates on github.event_name == 'workflow_dispatch' so scheduled runs don't hit it.
• ✅ Fork protection: github.repository_owner == 'facebook' in the release job prevents scheduled trigger from running on forks.
• ✅ Backward compat: The NPM_TOKEN removal only affects this workflow (CI infra). No library API changes. No www impact.
• ✅ CI: All checks green (including CodeQL).

Safe to land. Clean consolidation of release infrastructure with proper OIDC adoption.