Repository navigation
Publish approved npm releases through GitHub OIDC - #51
Merged
Merged
Conversation
Change Log for @ericblade/react-currency-input (1.4.5 → 1.4.6)Bug Fixes
|
There was a problem hiding this comment.
🔵 Needs a closer look
It reworks the credentialed npm publishing pipeline to OIDC trusted publishing, which the author notes cannot be fully validated without a live GitHub-hosted release run and correct npm-side configuration, so it warrants human verification.
4 open issues
What changed in this PR
This PR migrates the npm release process for @ericblade/react-currency-input from token-based publishing (NPM_TOKEN/NODE_AUTH_TOKEN) to npm trusted publishing via GitHub OIDC, addressing release failures caused by an expiring publishing token. The existing Rolling Versions rollingversions_publish_approved repository-dispatch approval trigger is preserved, and a new release guide documents the required one-time npm-side configuration and troubleshooting steps.
Changes:
- Grants
id-token: write(pluscontents: write) and upgrades the publish job to Node 24 / npm 11, removing theregistry-url/NODE_AUTH_TOKENtoken setup. - Pins the Rolling Versions CLI to
rollingversions@3.5.0and adds pre-publish assertions that the OIDC request env vars are present. - Adds
.github/RELEASING.mddocumenting npm trusted-publisher setup, release flow, and failure diagnosis.
| File | Description |
|---|---|
.github/workflows/publish.yml |
Switches the publish job to OIDC trusted publishing: adds permissions, bumps Node/npm, removes token config, pins the CLI, and asserts OIDC env vars. |
.github/RELEASING.md |
New documentation describing one-time npm trusted-publisher configuration, the release/validation flow, and troubleshooting. |
Review effort: Balanced
| @@ -0,0 +1,30 @@ | |||
| # Publishing approved releases | |||
|
|
|||
| The publish workflow remains triggered by Rolling Versions' `rollingversions_publish_approved` repository dispatch. It uses GitHub-hosted runners, Node24 and npm11 to publish through npm trusted publishing (OIDC), without an npm publishing token. | |||
|
|
||
| The fields must match exactly. npm does not verify the relationship when settings are saved; the first actual publish verifies it. Current npm documentation requires the first successful publish within two days of creating the trust entry, so configure it when ready to merge and release. If it expires, recreate it. | ||
|
|
||
| See [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/). This workflow uses npm11, above the documented minimum11.5.1, and Node24, above the minimum22.14. GitHub's `id-token: write` permission supplies OIDC. `contents: write` permits release/tag operations performed by Rolling Versions with `GITHUB_TOKEN`. |
|
|
||
| Merge the workflow change into the default branch before approving/retrying a Rolling Versions release. A fresh repository dispatch will use the updated default-branch workflow; rerunning an old failed workflow may use its old definition. Preserve the Rolling Versions approval process rather than running an independent manual publish with an uncoordinated version. | ||
|
|
||
| The workflow installs/builds the package and invokes the pinned, inspected Rolling Versions3.5.0. Its publish implementation spawns the runner's `npm publish`, inheriting the OIDC environment. Its `withNpmVersion` helper temporarily changes package versions; it does not downgrade the npm executable. The separate Playwright workflow continues to own browser/React-version tests. |
|
|
||
| The workflow no longer uses `secrets.NPM_TOKEN` or setup-node's token-based registry configuration. Private dependencies would require separate read-only installation credentials; this package currently uses public dependencies. Once OIDC publishing succeeds, remove/revoke the unused automation publishing token as appropriate. Do not copy credentials into source or diagnostic logs. | ||
|
|
||
| If a publish fails, verify the runner npm version, exact trusted-publisher fields, `id-token: write`, GitHub-hosted runner, and package `repository.url`. An old Node20 workflow indicates that the retry is still using the previous workflow definition. Keep permission/configuration failures separate from package build failures. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The approved release currently fails during npm's registry PUT while the workflow relies on an NPM_TOKEN secret. This change configures npm trusted publishing so infrequent releases no longer depend on an expiring publishing token.
The existing Rolling Versions repository-dispatch approval trigger is preserved. The publish workflow uses Node 24 and npm 11, grants id-token: write, removes token-based registry configuration and NODE_AUTH_TOKEN, and pins the inspected Rolling Versions CLI to 3.5.0. Its published implementation invokes the runner's npm publish and inherits the OIDC environment. A release guide records exact npm-side configuration and retry instructions.
Validation: workflow YAML and release invariants checked; ES2015, ESM, CommonJS and AMD build targets compiled successfully under Node 24 using the existing local dependency installation; git diff --check passed. No package was published. Actual OIDC authorization requires a GitHub-hosted run after npm configuration; neither npm whoami nor dry-run publishing proves that authorization.
Before release, configure the package's npm trusted publisher: GitHub user ericblade, repository react-currency-input, workflow publish.yml, no environment name, and allow direct npm publish. Merge this change and approve/retry with a fresh Rolling Versions dispatch so the new default-branch workflow is used. Do not assume rerunning the old failed run picks up this workflow.