$ the-wire · showcase
Hydrogen's /snapit publishes again through OIDC; App Security stops trusting mistyped client IDs
By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology
2 people shipped this
Shopify's two most-used developer surfaces both closed trust gaps today: Hydrogen's broken snapshot release path is wired to npm Trusted Publishing, and the CLI's app security checks now verify a --client-id against the account before they scan or save anything.
Publish /snapit snapshots via workflow_dispatch and npm OIDC (#4057) Shopify/hydrogen
snapit.yml no longer publishes anything itself: it validates the /snapit request and dispatches release.yml, the trusted publisher for every package, on the PR branch, where the branch is built and packed without a publish credential and a job that runs no repository code validates the tarball. The move was forced because npm now rejects Trusted Publishing token exchanges for issue_comment runs...
Publish /snapit snapshots through release.yml with npm OIDC Shopify/hydrogen
The /snapit command has been dead since npm revoked classic tokens on 2025-12-09, when the NPM_TOKEN it used stopped working; run 28592264687 failed with E404 PUT @shopify/cli-hydrogen even with the token set. The superseded approach of registering snapit.yml as a second trusted publisher would not have worked either.
Validate --client-id in App Security check, record and review Shopify/cli
The app security check now resolves --client-id against the user's account, the same way deploy does, before gathering, scanning, writing or reading results and before the no-app-configuration prompt. The TOML's client_id and the picker's client ID are still not looked up, and clean and instructions do not opt in, so results saved under a mistyped client ID can still be removed.
Merge pull request #8763 from Shopify/app-security/nested-app-configs Shopify/cli
Scans no longer assume the app is the directory you are standing in: extension and web directories outside the app directory are now scanned, and the CLI warns when App Security is about to scan another app's files.
Don't suggest --reset when an app security --client-id isn't found Shopify/cli
The shared missing-app error used to suggest passing --reset, which the app security commands do not accept; appFromIdentifiers now takes offerReset, true by default, and the app security lookup passes false. The account and login steps stay as they were.
