From ad04489caa71e329943f045fec28f31bd7a8e8e3 Mon Sep 17 00:00:00 2001 From: kseniyakuzina Date: Tue, 15 Sep 2026 09:16:10 +0300 Subject: [PATCH 1/3] feat: configure trusted publishing --- .github/workflows/release.yml | 30 ++++++++++++++++++++++++++---- README.md | 26 ++++++++++++++++++++++++-- 2 files changed, 50 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7d137e4..cb5d32d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,11 +4,33 @@ on: push: branches: [main] +permissions: {} + jobs: release: + if: ${{ !github.event.repository.is_template }} runs-on: ubuntu-latest + permissions: + contents: read + outputs: + created: ${{ steps.release_action.outputs['release-created'] }} + sha: ${{ steps.release_action.outputs['release-sha'] }} steps: - - uses: gravity-ui/release-action@v1 - with: - github-token: ${{ secrets.GRAVITY_UI_BOT_GITHUB_TOKEN }} - npm-token: ${{ secrets.GRAVITY_UI_BOT_NPM_TOKEN }} + - name: Create GitHub release + id: release_action + uses: gravity-ui/release-action@v3 + with: + github-token: ${{ secrets.GRAVITY_UI_BOT_GITHUB_TOKEN }} + node-version-file: .nvmrc + publish: 'false' + + publish: + needs: release + if: ${{ needs.release.outputs.created == 'true' }} + permissions: + contents: read + id-token: write + uses: gravity-ui/release-action/.github/workflows/npm-publish.yml@v3 + with: + release-sha: ${{ needs.release.outputs.sha }} + environment-name: npm-publish diff --git a/README.md b/README.md index a4471d7..150415a 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,32 @@ # @gravity-ui/package-example · [![npm package](https://img.shields.io/npm/v/@gravity-ui/package-example)](https://www.npmjs.com/package/@gravity-ui/package-example) [![CI](https://img.shields.io/github/actions/workflow/status/gravity-ui/package-example/.github/workflows/ci.yml?label=CI&logo=github)](https://github.com/gravity-ui/package-example/actions/workflows/ci.yml?query=branch:main) [![storybook](https://img.shields.io/badge/Storybook-deployed-ff4685)](https://preview.gravity-ui.com/package-example/) -This is a template for typical package. +This is a template for a typical package. 1. Create a new repository and use this repository as a template. 2. Replace `package-example` through the whole repository with your name. -3. Overwrite other things at your desire. +3. Configure npm trusted publishing as described below. +4. Overwrite other things at your desire. + +## Publishing setup + +The release workflow publishes through OpenID Connect and does not require an npm token. + +1. Make sure the package already exists on npm. Creating a trusted publisher for a package that has not been + published yet is not supported. +2. Create a GitHub Environment named `npm-publish` and restrict its deployment branches to protected branches. +3. With npm 11.15.0 or newer, configure the package's trusted publisher once: + +```shell +npm trust github @gravity-ui/your-package \ + --repo gravity-ui/your-repository \ + --file release.yml \ + --env npm-publish \ + --allow-publish +``` + +The npm account running this command must have write access to the package and two-factor authentication enabled. +The `GRAVITY_UI_BOT_GITHUB_TOKEN` organization secret must be available to the repository so that the release action +can create and update the release pull request. ## Install From aee574042bd2c483f55f872933aef96cb71e32f8 Mon Sep 17 00:00:00 2001 From: kseniyakuzina Date: Tue, 15 Sep 2026 09:22:05 +0300 Subject: [PATCH 2/3] docs: clarify publishing setup --- README.md | 44 +++++++++++++++++++++++++++++++------------- 1 file changed, 31 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 150415a..99170e7 100644 --- a/README.md +++ b/README.md @@ -2,19 +2,29 @@ This is a template for a typical package. -1. Create a new repository and use this repository as a template. -2. Replace `package-example` through the whole repository with your name. -3. Configure npm trusted publishing as described below. -4. Overwrite other things at your desire. +## Repository setup -## Publishing setup +1. Create a new repository using this repository as a template. +2. Replace `package-example` throughout the repository with your package and repository name. +3. Complete the publishing setup below. +4. Adjust the remaining package settings as needed. -The release workflow publishes through OpenID Connect and does not require an npm token. +## Required publishing setup -1. Make sure the package already exists on npm. Creating a trusted publisher for a package that has not been - published yet is not supported. -2. Create a GitHub Environment named `npm-publish` and restrict its deployment branches to protected branches. -3. With npm 11.15.0 or newer, configure the package's trusted publisher once: +The template already contains `.github/workflows/release.yml`. It creates releases with +`gravity-ui/release-action@v3` and publishes to npm through OpenID Connect (OIDC), so package repositories do not need +an npm token or a custom publish action. + +Complete these steps once for every repository created from the template: + +1. Make sure the package already exists on npm. npm cannot configure a trusted publisher for an unpublished package; + use the approved bootstrap publishing process for its first version. +2. In the GitHub repository, open **Settings → Environments**, create an environment named `npm-publish`, and set + **Deployment branches and tags** to **Protected branches only**. +3. Make sure the organization secret `GRAVITY_UI_BOT_GITHUB_TOKEN` is available to the repository. It is used to + create and update the release pull request; it is not used to publish to npm. +4. Use npm 11.15.0 or newer and an npm account that has write access to the package and account-level two-factor + authentication enabled. Configure the trusted publisher: ```shell npm trust github @gravity-ui/your-package \ @@ -24,9 +34,17 @@ npm trust github @gravity-ui/your-package \ --allow-publish ``` -The npm account running this command must have write access to the package and two-factor authentication enabled. -The `GRAVITY_UI_BOT_GITHUB_TOKEN` organization secret must be available to the repository so that the release action -can create and update the release pull request. +The trusted publisher must reference the repository's own `release.yml` workflow, not the reusable +`npm-publish.yml` workflow from `gravity-ui/release-action`. + +5. Verify the saved configuration: + +```shell +npm trust list @gravity-ui/your-package +``` + +The result must contain the expected GitHub repository, `release.yml`, the `npm-publish` environment, and permission +to publish. After this setup, releases publish without `NPM_TOKEN` or `GRAVITY_UI_BOT_NPM_TOKEN`. ## Install From 43c9cbf0894fc57c493cb074b0c4d2c7c1d47124 Mon Sep 17 00:00:00 2001 From: kseniyakuzina Date: Wed, 23 Sep 2026 16:47:17 +0300 Subject: [PATCH 3/3] fix: simplify trusted publishing setup --- .github/workflows/release.yml | 24 +++++------------------- README.md | 16 +++++++++++----- 2 files changed, 16 insertions(+), 24 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cb5d32d..31a4ba9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,27 +10,13 @@ jobs: release: if: ${{ !github.event.repository.is_template }} runs-on: ubuntu-latest + environment: npm-publish permissions: contents: read - outputs: - created: ${{ steps.release_action.outputs['release-created'] }} - sha: ${{ steps.release_action.outputs['release-sha'] }} + id-token: write steps: - - name: Create GitHub release - id: release_action - uses: gravity-ui/release-action@v3 + - name: Release + uses: gravity-ui/release-action@v2 with: github-token: ${{ secrets.GRAVITY_UI_BOT_GITHUB_TOKEN }} - node-version-file: .nvmrc - publish: 'false' - - publish: - needs: release - if: ${{ needs.release.outputs.created == 'true' }} - permissions: - contents: read - id-token: write - uses: gravity-ui/release-action/.github/workflows/npm-publish.yml@v3 - with: - release-sha: ${{ needs.release.outputs.sha }} - environment-name: npm-publish + node-version: '24' diff --git a/README.md b/README.md index 99170e7..0fc1fae 100644 --- a/README.md +++ b/README.md @@ -12,15 +12,17 @@ This is a template for a typical package. ## Required publishing setup The template already contains `.github/workflows/release.yml`. It creates releases with -`gravity-ui/release-action@v3` and publishes to npm through OpenID Connect (OIDC), so package repositories do not need -an npm token or a custom publish action. +`gravity-ui/release-action@v2` and publishes to npm in the same job through OpenID Connect (OIDC). +The release job uses Node.js 24 and grants `id-token: write`, so npm can obtain a short-lived publishing token. +Do not pass an npm token to the action or add a separate publishing job. Complete these steps once for every repository created from the template: 1. Make sure the package already exists on npm. npm cannot configure a trusted publisher for an unpublished package; use the approved bootstrap publishing process for its first version. 2. In the GitHub repository, open **Settings → Environments**, create an environment named `npm-publish`, and set - **Deployment branches and tags** to **Protected branches only**. + **Deployment branches and tags** to **Protected branches only**. Make sure `main` is protected in + **Settings → Rules → Rulesets** or **Settings → Branches**; without branch protection, this setting allows any branch. 3. Make sure the organization secret `GRAVITY_UI_BOT_GITHUB_TOKEN` is available to the repository. It is used to create and update the release pull request; it is not used to publish to npm. 4. Use npm 11.15.0 or newer and an npm account that has write access to the package and account-level two-factor @@ -34,8 +36,7 @@ npm trust github @gravity-ui/your-package \ --allow-publish ``` -The trusted publisher must reference the repository's own `release.yml` workflow, not the reusable -`npm-publish.yml` workflow from `gravity-ui/release-action`. +The trusted publisher must reference this repository's `release.yml` workflow and match its `npm-publish` environment. 5. Verify the saved configuration: @@ -46,6 +47,11 @@ npm trust list @gravity-ui/your-package The result must contain the expected GitHub repository, `release.yml`, the `npm-publish` environment, and permission to publish. After this setup, releases publish without `NPM_TOKEN` or `GRAVITY_UI_BOT_NPM_TOKEN`. +6. Merge a release pull request and check that the **Release** workflow succeeds and the new version appears on npm. + The action creates the GitHub Release and runs `npm publish` once; npm obtains a short-lived token automatically. + +Releases are skipped in the template repository itself and enabled in repositories created from it. + ## Install ```shell