ci: move npm publish to GHA for trusted publishing with provenance#7061
ci: move npm publish to GHA for trusted publishing with provenance#7061serhalp wants to merge 5 commits into
Conversation
- Add release.yml workflow using release-please-action for stable releases - Update pre-release.yml with OIDC permissions and --provenance flag - Remove release-please job from CircleCI (update-lockfile stays) https://claude.ai/code/session_011HCWQbTc6LTeMxgdwTH2R6
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Pin actions to their full commit SHAs with version comments for security (immutable references) and readability. https://claude.ai/code/session_01HtVRxL8TMLfQTbTvvaLYWz
With id-token: write permission and trusted publishing configured on npmjs.com, npm uses the short-lived OIDC token automatically. NODE_AUTH_TOKEN was bypassing OIDC and using the long-lived token. https://claude.ai/code/session_01NmU7gnap9unNWgcsUyN3J7
|
|
||
| publish: | ||
| needs: release-please | ||
| if: ${{ needs.release-please.outputs.releases_created == 'true' }} |
There was a problem hiding this comment.
on npm publishing flakes when release-please run determine that release was created, but actual publish fails (i.e. some network or npm registry issues) this would mean there is no way to "retry" to actually publish to npm, so this is a change from the way CircleCi workflow works
| run: npx lerna publish from-package --yes --no-private | ||
| env: | ||
| NPM_CONFIG_PROVENANCE: true |
There was a problem hiding this comment.
https://lerna.js.org/docs/recipes/oidc-trusted-publishing - not sure of details, but they say lerna 9 added support, but we use
Line 60 in 0f6098d
3 participants
Summary
release.ymlworkflow (stable releases) from CircleCI to GitHub ACtionspre-release.yml(already on GHA) to use OIDC permissions and--provenanceflag