Evgeny Boger c3fda73ab1 release-npm: publish via npm OIDC trusted publishing; restore agentd-from-source ... Why: the v0.1.22 publish failed — first npm E404 (NPM_TOKEN expired/ rejected), then ENEEDAUTH (token empty). Move off the long-lived token to OIDC trusted publishing: npm mints short-lived credentials from the GitHub Actions id-token (already `id-token: write` at the workflow level), and provenance is generated automatically. How (publish job): - Drop NODE_AUTH_TOKEN / secrets.NPM_TOKEN from both publish steps. - Drop setup-node's `registry-url:` — that input writes an empty `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into .npmrc, which makes npm error ENEEDAUTH instead of using OIDC. The default registry is registry.npmjs.org regardless. - `npm install -g npm@latest` so the runner has npm >= 11.5.1 (node 22 ships npm 10.x, which has no OIDC trusted-publishing support). Requires a one-time npm-side setup: a trusted publisher configured for BOTH @wirenboard/agent-vm and @wirenboard/agent-vm-linux-x64 (repo wirenboard/agent-vm, workflow release-npm.yml). The NPM_TOKEN secret is no longer used and can be deleted. Also restores the "Build agentd from source (musl)" step + the msb `--no-default-features` build that a prior edit had dropped. agentd is embedded in msb and must ship at the same revision as the producer: the boot-params side channel (v0.1.22) needs both halves in lockstep. Without this, msb downloads the stale 0.4.6 prebuilt agentd (no boot-params reader) and silently drops every mount — for all users, not just non-ASCII paths. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-06-01 20:26:08 +00:00
..
workflows	release-npm: publish via npm OIDC trusted publishing; restore agentd-from-source	2026-06-01 20:26:08 +00:00
dependabot.yml	ci: bump all GH actions to Node-24 majors + add Dependabot	2026-05-25 14:27:41 +03:00