[renovate]

This PR contains the following updates:

Package	Type	Update	Change
flatt-security/setup-takumi-guard-npm	action	minor	v1.2.0 → v1.4.0

---

Release Notes

flatt-security/setup-takumi-guard-npm

v1.4.0

Compare Source

What changed

• An authentication failure now fails the step. With bot-id set, a missing id-token: write permission, a failed OIDC request or an STS refusal used to print an error annotation and continue, so later installs reached Takumi Guard anonymously while the job stayed green. The step now exits with an error regardless of set-registry. Omitting bot-id still runs in anonymous mode. Fixes #​7.
• Each failure names its cause. An unreachable STS fails with Could not reach the STS at <url>., and a response that is not JSON, such as an HTML error page, fails with STS returned non-JSON (HTTP <code>). followed by the start of the response in the log.
• The OIDC request and the STS exchange time out after 15 seconds and are retried up to 3 times on transient errors, so a brief outage does not fail the job.

Scenario (bot-id set)	v1.3.0	v1.4.0
Job lacks permissions: { id-token: write }	Error annotation, step succeeds, installs anonymous	Step fails: OIDC not available. Add 'permissions: { id-token: write }' to your job.
OIDC token request fails	Error annotation, step succeeds, installs anonymous	Step fails: Failed to get OIDC token.
STS refuses the exchange (unknown bot, trust condition mismatch)	Error annotation, step succeeds, installs anonymous	Step fails: Authentication failed: <STS message>
STS cannot be reached	Error annotation with no reason, step succeeds, installs anonymous	Step fails: Could not reach the STS at <url>.
STS answers with something other than JSON	Step fails with exit code 4 or 5 and no error message	Step fails: STS returned non-JSON (HTTP <code>).
bot-id omitted	Anonymous mode	Anonymous mode (unchanged)

Behaviour changes for existing workflows

A workflow that sets bot-id but does not authenticate today fails at this step:

1. The job lacks permissions: { id-token: write }. Add it to the job.
2. Pull requests from forks. GitHub does not issue OIDC tokens to them. Skip the step or omit bot-id for those runs.
3. A wrong Bot ID or trust condition. Correct it in Shisho Cloud byGMO; the error now shows the STS's message.

To run without a bot, omit bot-id. To keep a failure from failing the job, set continue-on-error: true on the step.

Opting out

Pin flatt-security/setup-takumi-guard-npm@v1.3.0. The floating v1 tag is not moved by this release.

v1.3.0

Compare Source

What changed

• Installs in any directory now go through Takumi Guard. The configuration is written to $RUNNER_TEMP/.npmrc (mode 600) instead of your checkout, and NPM_CONFIG_USERCONFIG, NPM_CONFIG_REGISTRY, pnpm_config_registry and YARN_NPM_REGISTRY_SERVER are exported through $GITHUB_ENV. Subdirectories, workspaces and working-directory no longer bypass the proxy, and a committed project .npmrc that names another default registry no longer leaves an install on it. Nothing in your checkout is modified. Fixes #​2.
• Yarn Berry receives the token through YARN_NPM_AUTH_TOKEN and now YARN_NPM_ALWAYS_AUTH=true, so unscoped packages are attributed to your bot as well. bun receives it through BUN_CONFIG_TOKEN.
• New input always-auth (default false): writes a host-bound //npm.flatt.tech/:always-auth=true entry so Yarn Classic also sends the token for unscoped packages. Off by default because npm 11 and later warn about the setting on every command.
• New output npmrc-path: the file's location, for example for docker build --secret.
• If $HOME/.npmrc exists its contents are carried into the new file, and if another step already exported NPM_CONFIG_USERCONFIG (as actions/setup-node does with registry-url) the settings are appended to that file.

Behaviour changes for existing workflows

Each has its fix in the README section "Migrating from a version that wrote into your checkout".

1. A Dockerfile that runs COPY .npmrc. The token is no longer in the build context. With a committed .npmrc the build still succeeds but the install inside the container runs anonymously and is not attributed; without one the COPY fails. Use a build secret: docker build --secret id=npmrc,src="$NPM_CONFIG_USERCONFIG" with RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm ci.
2. echo … >> ~/.npmrc after the action has no effect; write to $NPM_CONFIG_USERCONFIG or use npm config set.
3. A token committed in your project .npmrc now outranks the bot's token for npm, pnpm and Yarn Classic. Remove it.
4. Token expiry applies to every install in the job, including subdirectories and bun/Yarn Berry installs that earlier versions left unauthenticated. Raise expires-in (default 30 minutes, max 24 hours) if installs run late in the job.
5. Steps that read $GITHUB_WORKSPACE/.npmrc fail with "No such file" and are no longer needed.
6. npm publish from a subdirectory without publishConfig.registry now targets the read-only proxy; name the publish registry explicitly.

Opting out

Pin flatt-security/setup-takumi-guard-npm@v1.2.0. The floating v1 tag still points at v1.2.0 and will move to v1.3.0 after a short soak.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.