fix(ci): switch npm publishing to GitHub Packages registry

AlexMikhalev · claude · AlexMikhalev · commit 8fa905d52ca9 · 2026-01-03T19:31:24.000Z
- Update publish-bun.yml to use npm.pkg.github.com instead of npmjs.org
- Update publish-npm.yml to use npm.pkg.github.com
- Add publishConfig to package.json for GitHub Packages
- Use GITHUB_TOKEN instead of NPM_TOKEN for authentication
- Remove OIDC provenance flag (not needed for GitHub Packages)
- Bump version to 1.3.1

This fixes the npm publishing 404 error caused by expired/revoked
access token and OIDC authentication issues with npmjs.org.

GitHub Packages uses the built-in GITHUB_TOKEN which is automatically
available in GitHub Actions with proper permissions.

Generated with Terraphim AI

Co-Authored-By: Claude Opus 4.5 &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/publish-bun.yml b/.github/workflows/publish-bun.yml
@@ -1,4 +1,4 @@
-name: Publish to Bun Registry
+name: Publish to GitHub Packages (Bun Compatible)
 
 on:
   workflow_dispatch:
@@ -342,7 +342,7 @@ jobs:
           if-no-files-found: error
 
   publish-to-bun:
-    name: Publish to Bun Registry
+    name: Publish to GitHub Packages
     runs-on: [self-hosted, Linux]
     needs: build
     # Run after builds complete (tests and universal are optional)
@@ -362,19 +362,13 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@terraphim'
 
-      - name: Get publish token
-        id: token
+      - name: Verify GitHub token
         run: |
-          # Use NPM_TOKEN from GitHub secrets (works for both npm and Bun)
-          TOKEN="${{ secrets.NPM_TOKEN }}"
-          if [[ -z "$TOKEN" ]]; then
-            echo "No NPM_TOKEN available for publishing"
-            exit 1
-          fi
-          echo "token=$TOKEN" >> $GITHUB_OUTPUT
-          echo "Publish token configured"
+          echo "Using GITHUB_TOKEN for GitHub Packages authentication"
+          echo "Registry: https://npm.pkg.github.com"
 
       - name: Download all artifacts
         uses: actions/download-artifact@v4
@@ -400,16 +394,18 @@ jobs:
           fi
 
       - name: Configure package managers
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          # Configure npm (primary registry)
-          echo "//registry.npmjs.org/:_authToken=${{ steps.token.outputs.token }}" > ~/.npmrc
-          npm config set provenance true
-
-          # Configure Bun registry (if different token available)
-          if [[ "${{ secrets.BUN_TOKEN }}" != "" && "${{ secrets.BUN_TOKEN }}" != "${{ steps.token.outputs.token }}" ]]; then
-            echo "//registry.npmjs.org/:_authToken=${{ secrets.BUN_TOKEN }}" > ~/.bunfig.toml
-            echo "[install.scopes]\n\"@terraphim\" = \"https://registry.npmjs.org/\"" >> ~/.bunfig.toml
-          fi
+          # Configure npm for GitHub Packages
+          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_TOKEN }}" > ~/.npmrc
+          echo "@terraphim:registry=https://npm.pkg.github.com" >> ~/.npmrc
+
+          # Configure Bun registry for GitHub Packages
+          cat > ~/.bunfig.toml << 'EOF'
+          [install.scopes]
+          "@terraphim" = { url = "https://npm.pkg.github.com", token = "$NODE_AUTH_TOKEN" }
+          EOF
 
           # Show current package info
           echo "Package information:"
@@ -458,43 +454,45 @@ jobs:
           echo "Platform packages created:"
           ls -la npm/ 2>/dev/null || echo "No npm/ directory"
 
-      - name: Publish to npm (works with Bun)
+      - name: Publish to GitHub Packages (works with Bun)
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           if [[ "${{ inputs.dry_run }}" == "true" ]]; then
             echo "Dry run mode - checking package only"
-            npm publish --dry-run --access public --tag ${{ steps.strategy.outputs.npm_tag }} --provenance --ignore-scripts
+            npm publish --dry-run --access public --tag ${{ steps.strategy.outputs.npm_tag }} --ignore-scripts
           else
-            echo "Publishing @terraphim/autocomplete to npm (Bun-compatible)"
+            echo "Publishing @terraphim/autocomplete to GitHub Packages"
+            echo "Registry: https://npm.pkg.github.com"
             echo "Tag: ${{ steps.strategy.outputs.npm_tag }}"
 
-            # Publish with OIDC provenance (no token needed - trusted publishing)
-            npm publish --access public --tag ${{ steps.strategy.outputs.npm_tag }} --provenance --ignore-scripts
+            # Publish to GitHub Packages
+            npm publish --access public --tag ${{ steps.strategy.outputs.npm_tag }} --ignore-scripts
 
-            echo "Package published successfully! (Bun users can install with: bun add @terraphim/autocomplete)"
+            echo "Package published successfully!"
+            echo "Install with: npm install @terraphim/autocomplete --registry=https://npm.pkg.github.com"
+            echo "Or with Bun: bun add @terraphim/autocomplete"
           fi
 
-      - name: Verify package for Bun users
+      - name: Verify package on GitHub Packages
         if: inputs.dry_run != 'true'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo "🔍 Verifying package for Bun users..."
+          echo "Verifying package on GitHub Packages..."
 
-          # Wait a moment for npm registry to update
-          sleep 30
+          # Wait a moment for registry to update
+          sleep 10
 
           # Check if package is available
           PACKAGE_NAME="@terraphim/autocomplete"
           PACKAGE_VERSION=$(node -p "require('./package.json').version")
 
           echo "Checking: $PACKAGE_NAME@$PACKAGE_VERSION"
-          npm view $PACKAGE_NAME@$PACKAGE_VERSION || echo "⚠️  Package not immediately visible (may take a few minutes)"
-
-          echo "📊 Package verification completed for Bun users"
+          npm view $PACKAGE_NAME@$PACKAGE_VERSION --registry=https://npm.pkg.github.com || echo "Package not immediately visible (may take a few minutes)"
 
-          # Test Bun installation
-          echo "🧪 Testing Bun installation..."
-          bunx pkg install $PACKAGE_NAME@$PACKAGE_VERSION --dry-run || echo "⚠️  Dry run failed (package may not be ready yet)"
+          echo "Package verification completed"
+          echo "GitHub Packages URL: https://github.com/terraphim/terraphim-ai/packages"
 
       - name: Create Bun-specific GitHub Release
         if: startsWith(github.ref, 'refs/tags/') && inputs.dry_run != 'true'
@@ -553,8 +551,8 @@ jobs:
             - **Fast Test Execution**: Bun's test runner integration
             - **Enhanced Dependency Resolution**: Faster and more accurate
 
-            ### 🔗 Links
-            - [npm package](https://www.npmjs.com/package/@terraphim/autocomplete)
+            ### Links
+            - [GitHub Package](https://github.com/terraphim/terraphim-ai/packages)
             - [Bun documentation](https://bun.sh/docs)
             - [Package Documentation](https://github.com/terraphim/terraphim-ai/tree/main/terraphim_ai_nodejs)
 
@@ -567,8 +565,12 @@ jobs:
       - name: Notify on success
         if: inputs.dry_run != 'true'
         run: |
-          echo "🎉 Bun publishing workflow completed successfully!"
-          echo "📦 Package: @terraphim/autocomplete"
-          echo "🏷️  Tag: ${{ steps.strategy.outputs.npm_tag }}"
-          echo "🐢 Runtime: Bun-optimized"
-          echo "📋 Version: $(node -p "require('./package.json').version")"
+          echo "Publishing workflow completed successfully!"
+          echo "Package: @terraphim/autocomplete"
+          echo "Registry: GitHub Packages (npm.pkg.github.com)"
+          echo "Tag: ${{ steps.strategy.outputs.npm_tag }}"
+          echo "Version: $(node -p "require('./package.json').version")"
+          echo ""
+          echo "Install with:"
+          echo "  npm install @terraphim/autocomplete --registry=https://npm.pkg.github.com"
+          echo "  bun add @terraphim/autocomplete"
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
@@ -1,4 +1,4 @@
-name: Publish Node.js Package to npm
+name: Publish Node.js Package to GitHub Packages
 
 on:
   workflow_dispatch:
@@ -316,7 +316,7 @@ jobs:
           if-no-files-found: error
 
   publish:
-    name: Publish to npm
+    name: Publish to GitHub Packages
     runs-on: [self-hosted, Linux, X64]
     needs: [test-universal, test-macos]
     environment: production
@@ -328,42 +328,15 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@terraphim'
           cache: 'yarn'
           cache-dependency-path: terraphim_ai_nodejs/yarn.lock
 
       - name: Install dependencies
         working-directory: terraphim_ai_nodejs
         run: yarn install --frozen-lockfile
 
-      - name: Install 1Password CLI
-        run: |
-          curl -sSf https://downloads.1password.com/linux/keys/1password.asc | \
-            gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg
-          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/$(dpkg --print-architecture) stable main" | \
-            sudo tee /etc/apt/sources.list.d/1password.list
-          sudo apt update && sudo apt install op -y
-
-      - name: Authenticate with 1Password
-        run: |
-          echo "${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}" | op account add --service-account-token
-
-      - name: Get npm token from 1Password
-        id: token
-        run: |
-          TOKEN=$(op read "op://TerraphimPlatform/npm.token/token" || echo "")
-          if [[ -z "$TOKEN" ]]; then
-            echo "⚠️  npm token not found in 1Password, checking GitHub secrets"
-            TOKEN="${{ secrets.NPM_TOKEN }}"
-          fi
-
-          if [[ -z "$TOKEN" ]]; then
-            echo "❌ No npm token available"
-            exit 1
-          fi
-
-          echo "token=$TOKEN" >> $GITHUB_OUTPUT
-          echo "✅ npm token retrieved successfully"
-
       - name: Download all artifacts
         uses: actions/download-artifact@v4
         with:
@@ -397,14 +370,16 @@ jobs:
             npm version ${{ inputs.version }} --no-git-tag-version
           fi
 
-      - name: Configure npm for publishing
+      - name: Configure npm for GitHub Packages
         working-directory: terraphim_ai_nodejs
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{ steps.token.outputs.token }}" > ~/.npmrc
-          npm config set provenance true
+          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_TOKEN }}" > ~/.npmrc
+          echo "@terraphim:registry=https://npm.pkg.github.com" >> ~/.npmrc
 
           # Show current package info
-          echo "📋 Package information:"
+          echo "Package information:"
           npm pack --dry-run | head -20
 
       - name: Determine publishing strategy
@@ -437,40 +412,45 @@ jobs:
           echo "npm_tag=$NPM_TAG" >> $GITHUB_OUTPUT
           echo "🎯 Publishing strategy: $VERSION_TYPE -> $NPM_TAG"
 
-      - name: Publish to npm
+      - name: Publish to GitHub Packages
         working-directory: terraphim_ai_nodejs
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           if [[ "${{ inputs.dry_run }}" == "true" ]]; then
-            echo "🧪 Dry run mode - checking package only"
+            echo "Dry run mode - checking package only"
             npm publish --dry-run --access public --tag ${{ steps.strategy.outputs.npm_tag }}
           else
-            echo "🚀 Publishing @terraphim/autocomplete to npm"
+            echo "Publishing @terraphim/autocomplete to GitHub Packages"
+            echo "Registry: https://npm.pkg.github.com"
             echo "Tag: ${{ steps.strategy.outputs.npm_tag }}"
 
-            # Publish with appropriate tag
+            # Publish to GitHub Packages
             npm publish --access public --tag ${{ steps.strategy.outputs.npm_tag }}
 
-            echo "✅ Package published successfully!"
+            echo "Package published successfully!"
+            echo "Install with: npm install @terraphim/autocomplete --registry=https://npm.pkg.github.com"
           fi
 
       - name: Verify published package
         if: inputs.dry_run != 'true'
         working-directory: terraphim_ai_nodejs
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo "🔍 Verifying published package..."
+          echo "Verifying published package..."
 
-          # Wait a moment for npm to update
-          sleep 30
+          # Wait a moment for registry to update
+          sleep 10
 
           # Check if package is available
           PACKAGE_NAME="@terraphim/autocomplete"
           PACKAGE_VERSION=$(node -p "require('./package.json').version")
 
           echo "Checking: $PACKAGE_NAME@$PACKAGE_VERSION"
-          npm view $PACKAGE_NAME@$PACKAGE_VERSION || echo "⚠️  Package not immediately visible (may take a few minutes)"
+          npm view $PACKAGE_NAME@$PACKAGE_VERSION --registry=https://npm.pkg.github.com || echo "Package not immediately visible (may take a few minutes)"
 
-          echo "📊 Package info:"
-          npm view $PACKAGE_NAME || echo "⚠️  General package info not available yet"
+          echo "GitHub Packages URL: https://github.com/terraphim/terraphim-ai/packages"
 
       - name: Create GitHub Release
         if: startsWith(github.ref, 'refs/tags/') && inputs.dry_run != 'true'
@@ -487,25 +467,25 @@ jobs:
             **Version**: ${{ steps.strategy.outputs.version_type }}
             **Tag**: ${{ steps.strategy.outputs.npm_tag }}
 
-            ### 🚀 Installation
+            ### Installation
             ```bash
-            npm install @terraphim/autocomplete@${{ steps.strategy.outputs.npm_tag }}
+            npm install @terraphim/autocomplete@${{ steps.strategy.outputs.npm_tag }} --registry=https://npm.pkg.github.com
             ```
 
-            ### ✨ Features
+            ### Features
             - **Autocomplete**: Fast prefix search with scoring
             - **Knowledge Graph**: Semantic connectivity analysis
             - **Native Performance**: Rust backend with NAPI bindings
             - **Cross-Platform**: Linux, macOS, Windows support
             - **TypeScript**: Auto-generated type definitions
 
-            ### 📊 Performance
+            ### Performance
             - **Autocomplete Index**: ~749 bytes
             - **Knowledge Graph**: ~856 bytes
             - **Native Library**: ~10MB (optimized for production)
 
-            ### 🔗 Links
-            - [npm package](https://www.npmjs.com/package/@terraphim/autocomplete)
+            ### Links
+            - [GitHub Package](https://github.com/terraphim/terraphim-ai/packages)
             - [Documentation](https://github.com/terraphim/terraphim-ai/tree/main/terraphim_ai_nodejs)
 
             ---
@@ -515,8 +495,13 @@ jobs:
 
       - name: Notify on success
         if: inputs.dry_run != 'true'
+        working-directory: terraphim_ai_nodejs
         run: |
-          echo "🎉 npm publishing workflow completed successfully!"
-          echo "📦 Package: @terraphim/autocomplete"
-          echo "🏷️  Tag: ${{ steps.strategy.outputs.npm_tag }}"
-          echo "📋 Version: $(node -p "require('./package.json').version")"
+          echo "Publishing workflow completed successfully!"
+          echo "Package: @terraphim/autocomplete"
+          echo "Registry: GitHub Packages (npm.pkg.github.com)"
+          echo "Tag: ${{ steps.strategy.outputs.npm_tag }}"
+          echo "Version: $(node -p "require('./package.json').version")"
+          echo ""
+          echo "Install with:"
+          echo "  npm install @terraphim/autocomplete --registry=https://npm.pkg.github.com"
diff --git a/terraphim_ai_nodejs/package.json b/terraphim_ai_nodejs/package.json
@@ -1,9 +1,12 @@
 {
   "name": "@terraphim/autocomplete",
-  "version": "1.0.0",
+  "version": "1.3.1",
   "description": "Fast autocomplete and knowledge graph functionality for Terraphim AI with native Node.js and WASM support",
   "main": "index.js",
   "types": "index.d.ts",
+  "publishConfig": {
+    "registry": "https://npm.pkg.github.com"
+  },
   "napi": {
     "name": "terraphim_ai_nodejs",
     "triples": {
