Skip to content

Configure trusted publishing #1427

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Strift wants to merge 2 commits into
base: main
Choose a base branch
from
+27 −21
Open

Configure trusted publishing #1427

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0b7428e
Update permissions
Strift Dec 11, 2025
a43c11f
Refactor GitHub Actions workflow for package versioning and publishing
Strift Dec 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 27 additions & 21 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,38 +4,44 @@ on:
push:
branches:
- main
- 'pre-release-beta/**'
- 'beta/**'
- 'prototype-beta/**'
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
- "pre-release-beta/**"
- "beta/**"
- "prototype-beta/**"

permissions:
id-token: write # Required for OIDC
contents: read
Comment on lines +11 to +13
Copy link

@coderabbitai coderabbitai bot Dec 11, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

changesets/action OIDC trusted publishing npm support

💡 Result:

Short answer: changesets/action does not yet support npm Trusted Publishing / OIDC. The action still expects an NPM_TOKEN (secret) for publishing; there is an open feature request to add Trusted‑Publishing / OIDC support. [1][2][3]

What to do now (concise):

  • Use a separate publish job that uses npm's Trusted Publishing (OIDC) flow (give workflow permission id-token: write and run npm@>=11.5.1 or an action that supports OIDC). Example actions and docs show using OIDC instead of a stored NPM_TOKEN. [3][4]

Sources:

  • changesets/action README (publishing uses NPM_TOKEN secret). [1]
  • changesets/action issues — open feature request “Support Trusted Publishing”. [2]
  • npm Trusted Publishing / OIDC docs (how to configure OIDC publish and required workflow permissions). [3]
  • Example npm-publish action docs showing OIDC/trusted-publishing usage (omit token when trusted publishing is configured). [4]

OIDC permissions are correctly scoped, but the workflow cannot currently use them.

The permissions block properly enables OIDC token generation with id-token: write and restricts repository access with contents: read. However, changesets/action@v1 does not yet support npm Trusted Publishing / OIDC—it still requires NPM_TOKEN secrets. The permissions alone will not enable OIDC in this workflow.

The workflow should either:

  1. Await OIDC support in changesets/action (open feature request), or
  2. Replace the changesets/action publish step with a separate job using an OIDC-compatible action (e.g., npm@>=11.5.1 or a dedicated npm-publish action that supports Trusted Publishing).

Currently, the NPM_TOKEN secrets (lines 11, 36, 44) remain the only authentication mechanism for publishing.

Copy link
Member

@curquiza curquiza Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Strift can you check what we can do with changeset please? 😊

Copy link

@coderabbitai coderabbitai bot Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!

Copy link
Collaborator Author

@Strift Strift Dec 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai review the changes to workflow structure

Copy link

@coderabbitai coderabbitai bot Dec 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Strift, here's my review of the workflow structure changes:

Workflow Structure Analysis

✅ Good Structural Elements

  1. Clear Job Separation: The workflow maintains two distinct jobs with well-defined responsibilities:

    • version-packages: Handles versioning using changesets (Node 18.x)
    • publish-packages: Handles building and publishing (Node 24.x)

  2. Permissions Block: The new top-level permissions block is correctly positioned and scoped:

    • id-token: write enables OIDC token generation
    • contents: read provides minimal repository access
    • Applies to both jobs in the workflow

  3. Branch Triggers: Double-quoted branch patterns maintain the same filtering logic (main, pre-release-beta, beta, prototype-beta)

⚠️ Structural Concerns

  1. No Job Dependencies: The two jobs appear to run in parallel with no explicit ordering. Consider if publish-packages should depend on version-packages:

    publish-packages:
  needs: version-packages
  name: Publish Packages

  2. Missing OIDC Configuration: While the permissions enable OIDC token generation, the workflow lacks the configuration to actually use it:

    • No .npmrc setup for provenance
    • No --provenance flag in the publish command
    • Still relies on NODE_AUTH_TOKEN from secrets (line 11)
    • The yarn release command needs to be configured to use OIDC instead of the token

  3. Incomplete OIDC Migration: The workflow appears to be in a hybrid state:

    • OIDC permissions are enabled
    • But traditional NPM_TOKEN authentication is still configured
    • The publishing mechanism may not actually use the OIDC token

💡 Recommendations

To complete the OIDC/trusted publishing migration:

  1. Configure npm for provenance in the publish job:

    - name: Setup .npmrc for provenance
  run: |
    echo "provenance=true" >> .npmrc

  2. Verify yarn release is configured to use npm >= 11.5.1 or properly configured for OIDC

  3. Consider removing NODE_AUTH_TOKEN once OIDC is fully configured (npm will automatically use OIDC tokens when available)

  4. Add job dependencies if versioning should complete before publishing

The structural foundation for OIDC is in place, but the workflow needs additional configuration to actually leverage trusted publishing.


jobs:
publish-npm:
name: Release
version-packages:
name: Version Packages
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v5
with:
node-version: '18.x'
registry-url: https://registry.npmjs.org/
node-version: "18.x"
- name: Install dependencies
run: yarn
- name: Create .npmrc file
run: |
cat << EOF > "$HOME/.npmrc"
//registry.npmjs.org/:_authToken=$NPM_TOKEN
always-auth = true
EOF
env:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
- name: Create Release Pull Request or Publish to npm
- name: Create Release Pull Request
uses: changesets/action@v1
with:
publish: yarn release
publish: false
version: yarn version-packages
env:
GITHUB_TOKEN: ${{ secrets.MEILI_BOT_GH_PAT }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

publish-packages:
name: Publish Packages
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v5
with:
node-version: "24.x"
- name: Install dependencies
run: yarn
- name: Build packages
run: yarn build
- name: Publish to npm
run: yarn release