chore(npm): Update release npm action to stop using tokens #30778
+170
−171
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull Request Overview
This PR updates GitHub Actions workflows to pin action versions using commit hashes for security, migrate to OIDC-based npm authentication, and improve workflow usability with emojis and configuration refinements.
- Pin
actions/checkoutandactions/setup-nodeto specific commit hashes with version comments - Migrate from NPM_TOKEN secret to OIDC authentication with provenance publishing
- Add emoji prefixes to workflow step names for better visibility
- Change
preidinput from choice to string type for flexibility - Add caching step for @ionic/angular-server build artifact
Reviewed Changes
Copilot reviewed 28 out of 28 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/update-screenshots.yml |
Pin checkout action to commit hash |
.github/workflows/stencil-nightly.yml |
Pin checkout action to commit hash |
.github/workflows/release.yml |
Change preid to string type, add permissions, remove NPM_TOKEN, pin checkout |
.github/workflows/release-ionic.yml |
Add permissions, remove NPM_TOKEN, pin checkout, add angular-server cache |
.github/workflows/nightly.yml |
Pin checkout action to commit hash |
.github/workflows/dev-build.yml |
Pin checkout action to commit hash |
.github/workflows/codeql-analysis.yml |
Pin checkout action to commit hash |
.github/workflows/build.yml |
Pin checkout action to commit hash |
.github/workflows/actions/upload-archive/action.yml |
Add emoji to step name |
.github/workflows/actions/update-reference-screenshots/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/test-vue-e2e/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/test-react-router-e2e/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/test-react-e2e/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/test-core-spec/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/test-core-screenshot/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/test-core-lint/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/test-core-clean-build/action.yml |
Pin setup-node, add emoji to step name |
.github/workflows/actions/test-angular-e2e/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/publish-npm/action.yml |
Remove token input, add OIDC config, refactor preid handling, add emojis |
.github/workflows/actions/download-archive/action.yml |
Add emoji to step name |
.github/workflows/actions/build-vue/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/build-vue-router/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/build-react/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/build-react-router/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/build-core/action.yml |
Pin checkout and setup-node, add emojis to step names |
.github/workflows/actions/build-core-stencil-prerelease/action.yml |
Pin checkout and setup-node, add emojis to step names |
.github/workflows/actions/build-angular/action.yml |
Pin setup-node, add emojis to step names |
.github/workflows/actions/build-angular-server/action.yml |
Pin setup-node, add emojis to step names |
Comments suppressed due to low confidence (1)
.github/workflows/release.yml:59
- The --preid flag is always included even when inputs.preid is empty. This could cause lerna to fail or behave unexpectedly when no preid is provided (e.g., for non-prerelease versions like patch, minor, or major). The command should conditionally include --preid only when inputs.preid is not empty.
run: lerna version ${{ inputs.version }} --yes --force-publish='*' --conventional-commits --create-release github --preid=${{ inputs.preid }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 28 out of 28 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The previous default of 24.x was there to match the Node version used elsewhere in the repo, so dropping it to 20 only adds confusion. I’ll set the composite action’s node-version default back to 24.x so every caller still gets a consistent runtime, while individual jobs remain free to override it if they need a different Node release.
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 28 out of 28 changed files in this pull request and generated 2 comments.
Comments suppressed due to low confidence (1)
.github/workflows/actions/build-angular/action.yml:6
- This file was not updated to use the pinned SHA version for actions/setup-node while all other similar files were updated. For consistency and security, this should be changed to
actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0to match the pattern used in other workflow files.
- uses: actions/setup-node@v6
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Documented the expected prerelease identifiers in the composite action—preid now explicitly lists common values (alpha, beta, rc, next) and notes that leaving it blank skips prerelease tagging. This preserves validation guidance without reintroducing the linter issue from a choice input. Lint remains clean.
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 28 out of 28 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 28 out of 28 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
.github/workflows/actions/build-angular/action.yml:6
- Inconsistent action pinning:
actions/setup-node@v6should be pinned to the specific SHA2028fbc5c25fe9cf00d9f06a71cc4710d4507903like all other files in this PR for security and reproducibility.
- uses: actions/setup-node@v6
.github/workflows/dev-build.yml:34
- Inconsistent authentication mechanism: This workflow still passes
NPM_TOKENas a secret torelease-ionic.yml, but that workflow has been updated to use OIDC provenance instead. These lines should be removed, andcontents: readpermission should be added to therelease-ionicjob.
secrets:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
.github/workflows/nightly.yml:39
- Inconsistent authentication mechanism: This workflow still passes
NPM_TOKENas a secret torelease-ionic.yml, but that workflow has been updated to use OIDC provenance instead. These lines should be removed, andcontents: readpermission should be added to therelease-ionicjob.
secrets:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue number: resolves #
What is the current behavior?
NPM_TOKENvia.npmrc, so publishes do not use npm’s trusted OIDC flow.What is the new behavior?
actions/publish-npmcomposite action now configuressetup-nodewith the npm registry, upgrades npm in place, and publishes with--provenancewithout writing.npmrc.release-dev.yml,release-nightly.yml, andrelease-production.ymlcall into that trusted flow by removing the token input and (for production) inlining the same OIDC setup beforenpm run release.ci.Does this introduce a breaking change?
Other information