wirenboard-agent-vm

mirror of https://github.com/wirenboard/agent-vm.git synced 2026-07-10 00:14:30 +00:00

History

Evgeny Boger c3fda73ab1 release-npm: publish via npm OIDC trusted publishing; restore agentd-from-source Why: the v0.1.22 publish failed — first npm E404 (NPM_TOKEN expired/ rejected), then ENEEDAUTH (token empty). Move off the long-lived token to OIDC trusted publishing: npm mints short-lived credentials from the GitHub Actions id-token (already `id-token: write` at the workflow level), and provenance is generated automatically. How (publish job): - Drop NODE_AUTH_TOKEN / secrets.NPM_TOKEN from both publish steps. - Drop setup-node's `registry-url:` — that input writes an empty `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into .npmrc, which makes npm error ENEEDAUTH instead of using OIDC. The default registry is registry.npmjs.org regardless. - `npm install -g npm@latest` so the runner has npm >= 11.5.1 (node 22 ships npm 10.x, which has no OIDC trusted-publishing support). Requires a one-time npm-side setup: a trusted publisher configured for BOTH @wirenboard/agent-vm and @wirenboard/agent-vm-linux-x64 (repo wirenboard/agent-vm, workflow release-npm.yml). The NPM_TOKEN secret is no longer used and can be deleted. Also restores the "Build agentd from source (musl)" step + the msb `--no-default-features` build that a prior edit had dropped. agentd is embedded in msb and must ship at the same revision as the producer: the boot-params side channel (v0.1.22) needs both halves in lockstep. Without this, msb downloads the stale 0.4.6 prebuilt agentd (no boot-params reader) and silently drops every mount — for all users, not just non-ASCII paths. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-01 20:26:08 +00:00
..
build-image.yml	ci(build-image): bust cache for the three agent installers each run	2026-05-29 13:17:34 +00:00
release-npm.yml	release-npm: publish via npm OIDC trusted publishing; restore agentd-from-source	2026-06-01 20:26:08 +00:00

Evgeny Boger c3fda73ab1 release-npm: publish via npm OIDC trusted publishing; restore agentd-from-source

Why: the v0.1.22 publish failed — first npm E404 (NPM_TOKEN expired/
rejected), then ENEEDAUTH (token empty). Move off the long-lived token to
OIDC trusted publishing: npm mints short-lived credentials from the GitHub
Actions id-token (already `id-token: write` at the workflow level), and
provenance is generated automatically.

How (publish job):
  - Drop NODE_AUTH_TOKEN / secrets.NPM_TOKEN from both publish steps.
  - Drop setup-node's `registry-url:` — that input writes an empty
    `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into .npmrc, which
    makes npm error ENEEDAUTH instead of using OIDC. The default registry is
    registry.npmjs.org regardless.
  - `npm install -g npm@latest` so the runner has npm >= 11.5.1 (node 22
    ships npm 10.x, which has no OIDC trusted-publishing support).

Requires a one-time npm-side setup: a trusted publisher configured for BOTH
@wirenboard/agent-vm and @wirenboard/agent-vm-linux-x64 (repo
wirenboard/agent-vm, workflow release-npm.yml). The NPM_TOKEN secret is no
longer used and can be deleted.

Also restores the "Build agentd from source (musl)" step + the msb
`--no-default-features` build that a prior edit had dropped. agentd is
embedded in msb and must ship at the same revision as the producer: the
boot-params side channel (v0.1.22) needs both halves in lockstep. Without
this, msb downloads the stale 0.4.6 prebuilt agentd (no boot-params reader)
and silently drops every mount — for all users, not just non-ASCII paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-01 20:26:08 +00:00

build-image.yml

ci(build-image): bust cache for the three agent installers each run

2026-05-29 13:17:34 +00:00

release-npm.yml

release-npm: publish via npm OIDC trusted publishing; restore agentd-from-source

2026-06-01 20:26:08 +00:00