[codex] Fix trusted publishing npm upgrade step#7
Merged
Conversation
mariojgt
approved these changes
May 12, 2026
mariojgt
added a commit
that referenced
this pull request
Jul 14, 2026
…ield-test persona (#69) * docs: drop llms.txt provenance citation; add lovable-supplychain persona Remove the patchstack.com/llms.txt citation from the install prompt (all three byte-identical copies: README.md, GETTING-STARTED.md, field-test/prompt.txt) and the two confirmation replies, after no-web Lovable-class agents were observed fabricating a 404 on a URL they can't fetch. Verification now leans on `npm view` alone, which corroborates the GitHub source link via the repository field. MAINTAINING.md and field-test modes #7-#8 are reconciled to document the removal and the mode #8 tradeoff. Add field-test/personas/lovable-supplychain.md encoding the real 2026-07-14 Lovable refusals (fabricated 'no repository field' and llms.txt 404) as a regression: a green run requires running `npm view` and correcting the prior. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(field-test): encode 0.3.11 repository-field fabrication into lovable-supplychain Third real Lovable refusal (0.3.11, on the llms.txt-free prompt) fabricated 'no repository field' while correctly reading homepage/license/maintainer/binary from the same `npm view` output — motivated misreading, not skipped verification. Sharpen the persona prior and require quoting `npm view … repository`; record the occurrence in field-test README mode #7. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mariojgt
added a commit
that referenced
this pull request
Jul 14, 2026
…ovable-supplychain (#71) A fourth real Lovable refusal (0.3.12) declined to run any verification, calling npm view/npx 'running arbitrary code' and leaning on a 'Patchstack is WordPress-only' prior. npm view is a read-only registry read that runs none of the package's code, so this is a category error. Extend the persona prior + re-verify instruction to cover the refuse-to-verify stance and the WordPress-only prior; record the occurrence in field-test README mode #7. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
npm install -g npm@latestself-upgrade step from the publish workflow.Why
The release workflow failed while trying to replace npm globally on the GitHub runner:
Avoiding npm self-mutation in the release job is more reliable than upgrading npm in place.
Validation
npm testnpm run typecheck