ci: stop publishing component snaps to npm on PR builds

[zkochan]

Problem

bit_pr has been failing repeatedly with:

429 Too Many Requests - PUT https://registry.npmjs.org/@teambit%2fmulti-tester

The job runs the full pipeline, which includes PublishComponents. That means every push to any open PR publishes a snap-tagged version of every changed component to registry.npmjs.org. All PRs share one npm token, so the token gets rate-limited. @teambit/multi-tester alone received 14 snap publishes over the last two days.

Fix

Pass --skip-tasks PublishComponents to bit ci pr in the bit_pr job. A PR build exists to validate the pipeline — it doesn't need the snap versions on npmjs, and the packages are published for real on the export to main (bit_merge is untouched). Every other task still runs.

Notes

The alternative of dropping the teambit.pkg/pkg config from workspace.jsonc was considered and rejected: packageJson.name: "@teambit/{name}" is what gives the core aspects their short package names. Removing it would rename the 134 @teambit/* packages that the released @teambit/bit depends on, and break every from '@teambit/<aspect>' import in this repo.

The setting npmjs registry with publishing permission step is left in place in bit_pr — harmless, and worth removing separately if we want PR containers to stop carrying a publish token.

🤖 Generated with Claude Code

[qodo-free-for-open-source-projects]

PR Summary by Qodo

CI: skip npm snap publishing on PR builds

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Stop running PublishComponents during PR CI to avoid npm rate limits
• Keep PR builds focused on pipeline validation; main export still publishes packages
• Clarify how commit-message skip-tasks tokens interact with the new default skip

Diagram

graph TD
  A["CircleCI: bit_pr job"] --> B["Run: bit ci pr"] --> C["Bit pipeline tasks"] --> D["PublishComponents"] --> E[("npmjs.org registry")]
  B --> F["--skip-tasks PublishComponents"]
  F -. "prevents" .-> D

  subgraph Legend
    direction LR
    _job["CI job"] ~~~ _cmd["Command"] ~~~ _task["Task"] ~~~ _ext[("External")]
  end

Loading

High-Level Assessment

Skipping PublishComponents for PR builds is the right tradeoff: it removes shared-token npm rate limiting without reducing pipeline validation coverage, since real publishing still occurs on the main/export path. Alternative options (e.g., removing pkg config or reworking naming/publishing) are disproportionate and risk breaking package naming and imports.

Files changed (1) +8 / -4

Other (1) +8 / -4

config.ymlSkip PublishComponents during 'bit ci pr' in PR job +8/-4

Skip PublishComponents during 'bit ci pr' in PR job

• Updates the 'bit_pr' job to run 'bit ci pr' with '--skip-tasks PublishComponents', preventing snap publishes to npm during PR builds. Expands inline documentation to explain the rate-limit issue and how commit-message '[skip-tasks: ...]' tokens combine with the new default skip.

.circleci/config.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📜 Skill insights (0)

1. PR job keeps publish token 🐞 Bug ⛨ Security

Description

bit_pr now always skips PublishComponents, but it still writes an npmjs auth token (explicitly
labeled as having publishing permission) into ~/.npmrc, even though the publish task won’t run. If
PR builds don’t otherwise require authenticated npm access, this keeps an unnecessarily powerful
secret in the job and increases exposure risk.

Code

.circleci/config.yml[869]

+          command: 'cd bit && bit ci pr --build --skip-cleanup --skip-tasks PublishComponents'

Evidence

The PR changes bit_pr to always skip PublishComponents, but the job still writes an npm auth
token described as having publishing permission. PublishComponents is the task that actually
performs npm publish, so keeping a publish-capable token in this job is potentially unnecessary
after this change (depending on other authenticated registry needs).

.circleci/config.yml[846-871]
scopes/pkg/pkg/publish.task.ts[6-31]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`bit_pr` now runs `bit ci pr ... --skip-tasks PublishComponents`, but still configures an npmjs token with publishing permission in `~/.npmrc`. Since `PublishComponents` is the npm publish task, PR builds may no longer need a publish-capable token.

### Issue Context
- This PR intentionally stops publishing snaps to npm on PR builds.
- The CircleCI job still injects an npm auth token.

### Fix Focus Areas
- Verify whether `bit ci pr --build` (with PublishComponents skipped) requires authenticated npm access for anything else. If not, remove the token setup step from `bit_pr`.
- If authenticated npm access is still required for reads, replace the token with a least-privilege/read-only token and/or scope it to only the registries needed.

#### Code references
- .circleci/config.yml[849-870]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Publish failures deferred to master 🐞 Bug ☼ Reliability

Description

Because bit_pr now always skips PublishComponents, PR CI no longer executes the npm publish
path, so failures specific to publishing will be detected later (e.g., when bit ci merge tags on
main) rather than during PR validation. This reduces pre-merge signal for changes that affect
publishing behavior.

Code

.circleci/config.yml[869]

+          command: 'cd bit && bit ci pr --build --skip-cleanup --skip-tasks PublishComponents'

Evidence

bit_pr runs on non-master branches and now skips PublishComponents. bit ci merge performs
tagging (which runs the tag pipeline), and PublishComponents is part of the tag pipeline task list,
so publish-path execution is shifted away from PR builds and into merge-to-main runs.

.circleci/config.yml[1482-1544]
.circleci/config.yml[846-871]
scopes/git/ci/ci.main.runtime.ts[1679-1693]
e2e/harmony/build-cmd.e2e.ts[60-69]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
PR CI no longer runs the publish task, so publish-specific regressions can slip past PR validation and surface only on the main-branch merge workflow.

### Issue Context
- The change is intentional to avoid npm rate limiting.
- Still, it may be useful to have an opt-in way to validate publishing when the publish pipeline itself is being modified.

### Fix Focus Areas
- Add a separate, opt-in workflow/job that runs publishing validation (e.g., manual approval job, scheduled job, or a guarded parameter) so publish-path changes can be tested without publishing on every PR push.

#### Code references
- .circleci/config.yml[1482-1544]
- .circleci/config.yml[846-871]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

1. Pr job keeps publish token 🐞 Bug ⛨ Security

bit_pr now always skips PublishComponents, but it still writes an npmjs auth token (explicitly
labeled as having publishing permission) into ~/.npmrc, even though the publish task won’t run. If
PR builds don’t otherwise require authenticated npm access, this keeps an unnecessarily powerful
secret in the job and increases exposure risk.

Agent Prompt

### Issue description
`bit_pr` now runs `bit ci pr ... --skip-tasks PublishComponents`, but still configures an npmjs token with publishing permission in `~/.npmrc`. Since `PublishComponents` is the npm publish task, PR builds may no longer need a publish-capable token.

### Issue Context
- This PR intentionally stops publishing snaps to npm on PR builds.
- The CircleCI job still injects an npm auth token.

### Fix Focus Areas
- Verify whether `bit ci pr --build` (with PublishComponents skipped) requires authenticated npm access for anything else. If not, remove the token setup step from `bit_pr`.
- If authenticated npm access is still required for reads, replace the token with a least-privilege/read-only token and/or scope it to only the registries needed.

#### Code references
- .circleci/config.yml[849-870]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-free-for-open-source-projects]

2. Publish failures deferred to master 🐞 Bug ☼ Reliability

Because bit_pr now always skips PublishComponents, PR CI no longer executes the npm publish
path, so failures specific to publishing will be detected later (e.g., when bit ci merge tags on
main) rather than during PR validation. This reduces pre-merge signal for changes that affect
publishing behavior.

Agent Prompt

### Issue description
PR CI no longer runs the publish task, so publish-specific regressions can slip past PR validation and surface only on the main-branch merge workflow.

### Issue Context
- The change is intentional to avoid npm rate limiting.
- Still, it may be useful to have an opt-in way to validate publishing when the publish pipeline itself is being modified.

### Fix Focus Areas
- Add a separate, opt-in workflow/job that runs publishing validation (e.g., manual approval job, scheduled job, or a guarded parameter) so publish-path changes can be tested without publishing on every PR push.

#### Code references
- .circleci/config.yml[1482-1544]
- .circleci/config.yml[846-871]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools