Skip to content

Harden npm trusted publishing workflow #178

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kentcdodds merged 7 commits into from
May 12, 2026
Merged

Harden npm trusted publishing workflow #178

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
9f2ec0d
ci: harden npm release workflow
kody-bot May 12, 2026
3c5a6c3
ci: fix workflow utf-8 encoding
kody-bot May 12, 2026
f2f5b8a
ci: address workflow review feedback
kody-bot May 12, 2026
fa56c33
ci: include next-major in release gate
kody-bot May 12, 2026
0918abb
ci: align release workflow guards
kody-bot May 12, 2026
b0f2b48
Apply suggestion from @kentcdodds
kentcdodds May 12, 2026
3c35e00
Apply suggestion from @kentcdodds
kentcdodds May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 57 additions & 14 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,7 @@ concurrency:
cancel-in-progress: true

permissions:
actions: write
contents: write # to be able to publish a GitHub release
id-token: write # to enable use of OIDC for npm provenance
issues: write # to be able to comment on released issues
pull-requests: write # to be able to comment on released pull requests
contents: read

defaults:
run:
Expand Down Expand Up @@ -48,31 +44,78 @@ jobs:
- uses: codecov/codecov-action@v6
if: ${{ matrix.coverage }}

publish:
name: ⚙️ Release
build-release-artifact:
name: 📦 Build release artifact
needs: [test]
runs-on: ubuntu-latest
permissions:
contents: read
if: ${{ github.repository == 'epicweb-dev/cachified' && github.event_name == 'push' }}
steps:
- name: ⬇️ Checkout repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: ⎔ Setup node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: lts/*
package-manager-cache: false

- name: 📥 Install deps
run: npm install --ignore-scripts

- name: 📦 Prepare package
run: npm run build

- name: 📦 Upload package artifact
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: npm-package-artifact
path: dist
if-no-files-found: error
retention-days: 7

publish:
name: 🚀 Release
needs: [build-release-artifact]
runs-on: ubuntu-latest
permissions:
contents: write # to be able to publish a GitHub release
id-token: write # to enable use of OIDC for npm provenance
issues: write # to be able to comment on released issues
pull-requests: write # to be able to comment on released pull requests
Comment on lines +78 to 86

@Xiphe Xiphe May 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What I've been doing on other projects lately is tying the OIDC on npm side to a dedicated github environment that requires review from a maintainer before being executed.

That way there's always a human in the loop with publishing. Happy to set that up and keeping an eye on it if you feel thats worth it @kentcdodds

Details

Looks like this on npm side:

Image Image

@kentcdodds kentcdodds May 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you'd like to do that, go for it 👍

if: ${{ github.repository == 'epicweb-dev/cachified' && github.event_name == 'push' }}
steps:
- name: ⬇️ Checkout repo
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: ⎔ Setup node
uses: actions/setup-node@v6
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: lts/*
node-version: 24
registry-url: https://registry.npmjs.org
package-manager-cache: false

- name: 📥 Download deps
uses: bahmutov/npm-install@v1
- name: 📦 Download package artifact
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: npm-package-artifact
path: dist

- name: ⚙️ Semantic Release
uses: cycjimmy/semantic-release-action@v6.0.0
- name: 🚀 Release
uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
with:
semantic_version: 25
branches: |
[
'+([0-9])?(.{+([0-9]),x}).x',
'main',
'next',
'next-major',
{name: 'beta', prerelease: true},
{name: 'alpha', prerelease: true}
]
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_CONFIG_PROVENANCE: true
NPM_CONFIG_IGNORE_SCRIPTS: true