Skip to content

fix: validate JSR token before publishing snapshots #642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jumski wants to merge 1 commit into
base: portable-worker-flows-template
Choose a base branch
from
+24 −17
Open

fix: validate JSR token before publishing snapshots #642

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 24 additions & 17 deletions scripts/snapshot-release.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,27 +98,30 @@ else
fi
fi

# JSR authentication - always validate with dry-run
JSR_DRY_RUN_CMD="pnpm jsr publish --dry-run --allow-slow-types --allow-dirty"
# JSR authentication
# `deno publish --dry-run` exits 0 even with an invalid token (it never
# contacts the registry), so validate JSR_TOKEN against the JSR API instead
if [[ -n "${JSR_TOKEN:-}" ]]; then
JSR_DRY_RUN_CMD="$JSR_DRY_RUN_CMD --token $JSR_TOKEN"
fi
JSR_CHECK=$(cd pkgs/edge-worker && $JSR_DRY_RUN_CMD 2>&1 || true)
if echo "$JSR_CHECK" | grep -qi "unauthorized\|not logged in\|authentication"; then
if [[ -n "${JSR_TOKEN:-}" ]]; then
echo -e " ${YELLOW}!${NC} jsr: JSR_TOKEN set but invalid/expired - opening browser..."
else
echo -e " ${YELLOW}jsr: not logged in - opening browser...${NC}"
fi
if deno login; then
echo -e " ${GREEN}✓${NC} jsr: authenticated via browser"
if command -v curl >/dev/null \
&& JSR_HTTP=$(curl -s -o /dev/null -w '%{http_code}' \
-H "Authorization: Bearer $JSR_TOKEN" https://api.jsr.io/user) \
&& [[ "$JSR_HTTP" == "200" ]]; then
echo -e " ${GREEN}✓${NC} jsr: token valid"
else
echo -e "${RED}Error: JSR login failed${NC}"
echo -e "${RED}Error: JSR_TOKEN is invalid or expired (api.jsr.io: ${JSR_HTTP:-unreachable})${NC}"
echo -e "Create a fresh token at ${BLUE}https://jsr.io/settings/tokens${NC}"
exit 1
fi
else
if [[ -n "${JSR_TOKEN:-}" ]]; then
echo -e " ${GREEN}✓${NC} jsr: authenticated (via token)"
JSR_CHECK=$(cd pkgs/edge-worker && pnpm jsr publish --dry-run --allow-slow-types --allow-dirty 2>&1 || true)
if echo "$JSR_CHECK" | grep -qi "unauthorized\|not logged in\|authentication\|invalidBearerToken"; then
echo -e " ${YELLOW}jsr: not logged in - opening browser...${NC}"
if deno login; then
echo -e " ${GREEN}✓${NC} jsr: authenticated via browser"
else
echo -e "${RED}Error: JSR login failed${NC}"
exit 1
fi
else
echo -e " ${GREEN}✓${NC} jsr: authenticated (existing session)"
fi
Expand Down Expand Up @@ -360,7 +363,11 @@ if [[ -f pkgs/edge-worker/jsr.json ]]; then
if [[ -n "${JSR_TOKEN:-}" ]]; then
JSR_PUBLISH_CMD="$JSR_PUBLISH_CMD --token $JSR_TOKEN"
fi
if ( cd pkgs/edge-worker && $JSR_PUBLISH_CMD ) ; then
# jsr's error output echoes the full deno command line, which contains
# the token - redact it so logs stay shareable
if ( cd pkgs/edge-worker && $JSR_PUBLISH_CMD ) \
> >(sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g') \
2> >(sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g' >&2) ; then
Comment on lines +368 to +370

@graphite-app graphite-app Bot Aug 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Process substitution race condition causing incomplete output

The process substitutions > >(sed...) and 2> >(sed...) spawn background processes. The if statement evaluates the exit code of the subshell immediately, but bash does not automatically wait for these background sed processes to complete. This creates a race condition where:

  1. The script continues execution before output is fully redacted/written
  2. Output may be truncated or appear out of order
  3. The script could exit before redaction completes, losing output entirely

Fix: Store output to variables first, then redact:

OUTPUT=$(cd pkgs/edge-worker && $JSR_PUBLISH_CMD 2>&1)
EXIT_CODE=$?
echo "$OUTPUT" | sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g'
if [[ $EXIT_CODE -eq 0 ]]; then

Or use a temporary file to capture output, then cat it through sed synchronously.

Suggested change
if ( cd pkgs/edge-worker && $JSR_PUBLISH_CMD ) \
> >(sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g') \
2> >(sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g' >&2) ; then
OUTPUT=$(cd pkgs/edge-worker && $JSR_PUBLISH_CMD 2>&1)
EXIT_CODE=$?
echo "$OUTPUT" | sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g'
if [[ $EXIT_CODE -eq 0 ]]; then

Spotted by Graphite

Fix in Graphite

Is this helpful? React 👍 or 👎 to let us know.

echo -e "${GREEN}✓ JSR package published${NC}"
else
echo -e "${RED}✗ JSR publish failed${NC}"
Expand Down
Loading