Skip to content

Comments

Revert npm publish workflow runner to ubuntu-latest#54

Merged
coleaeason merged 1 commit intomainfrom
claude-revertBlacksmithForNpmPublish
Feb 12, 2026
Merged

Revert npm publish workflow runner to ubuntu-latest#54
coleaeason merged 1 commit intomainfrom
claude-revertBlacksmithForNpmPublish

Conversation

@MelvinBot
Copy link
Contributor

Details

Reverts runs-on for the npm publish job from blacksmith-2vcpu-ubuntu-2404 back to ubuntu-latest.

Blacksmith runners are classified as "self-hosted" by GitHub Actions, but npm publish --provenance strictly requires "github-hosted" runners for Sigstore provenance verification. This causes an E422 error when any Expensify npm package tries to publish:

npm error code E422
npm error 422 Unprocessable Entity - Error verifying sigstore provenance bundle:
Unsupported GitHub Actions runner environment: "self-hosted".
Only "github-hosted" runners are supported when publishing with provenance.

This single change fixes publishing for all repos that call this reusable workflow:
react-native-wallet, react-native-onyx, react-native-live-markdown, expensify-common, eslint-config-expensify, react-native-qrcode-svg, react-native-key-command, react-native-x-maps, react-native-x-draggable-list, and react-native-x-geolocation.

Related Issues

https://github.com/Expensify/Expensify/issues/599808

Manual Tests

Merge this PR and verify that npm publish succeeds on one of the affected repos (e.g., push a change to react-native-wallet main and confirm the publish workflow completes without E422).

Linked PRs

N/A - no downstream changes needed. All affected repos reference npmPublish.yml@main so they pick up this fix automatically.

Blacksmith runners are classified as self-hosted, which causes
npm publish --provenance to fail with E422 because npm's Sigstore
provenance verification requires GitHub-hosted runners.

Co-authored-by: Andrew Gable <[email protected]>
@MelvinBot MelvinBot requested a review from a team February 12, 2026 18:37
@AndrewGable AndrewGable marked this pull request as ready for review February 12, 2026 18:46
@melvin-bot melvin-bot bot requested review from arosiclair and removed request for a team February 12, 2026 18:47
@coleaeason coleaeason merged commit 1157ee0 into main Feb 12, 2026
4 checks passed
@coleaeason coleaeason deleted the claude-revertBlacksmithForNpmPublish branch February 12, 2026 18:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants