[DOCS] `npm trust circle` docs should warn that OIDC token exchange in SSH reruns isn't supported

Open Beginner friendly
#10,004 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Active
Tech stack
javascript
Domain
cli, documentation

Research direction

Start at the documentation entry point for npm trust circle and read the trusted publishing guidance alongside the CircleCI SSH rerun limitation described in the issue. Update the relevant docs to warn that OIDC token exchange is unsupported in SSH reruns, so users do not misdiagnose the resulting 404; confirm the warning is visible in the npm trust circle documentation.

Written by the indexing model from the issue text.

Description

Documentation Needs Triage
Is there an existing issue for this?
  • I have searched the existing issues
This is a CLI Docs Problem, not another kind of Docs Problem.
  • This is a CLI Docs Problem.
Description of Problem

When I first tried to set up trusted publishing with CircleCI, I was getting 404s even though all the UUIDs I had configured for my trusted publisher were valid. I had no idea what was wrong for two reasons:

  • It was giving me a 404 package not found error instead of something like 403 not supported in SSH reruns
  • OIDC exchange failures aren't even logged by default: https://github.com/npm/cli/issues/9923
  • I read all of your docs about npm trust circle and trusted publishing, but they didn't warn that SSH reruns aren't supported.

The CircleCI docs say that SSH reruns aren't supported, but I read your docs. Your docs and error messages alone should be sufficient to figure out how to get trusted publishing to work. Paying customers deserve a better DX than this.

Potential Solution

No response

Affected URL

No response

Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
21

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from npm/cli

All issues in npm/cli

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.