mirror of
https://github.com/Fission-AI/OpenSpec.git
synced 2026-09-14 20:16:53 +08:00
Tabish Bidiwale
6de04f3b2b
Replace classic npm token authentication with OIDC trusted publishing: - Add `id-token: write` permission for OIDC token generation - Upgrade to Node 24 (includes npm 11.5.1+ required for OIDC) - Remove NPM_TOKEN/NODE_AUTH_TOKEN env vars (OIDC replaces them) This eliminates the need for rotating npm access tokens and provides cryptographically verified publisher identity with automatic provenance attestation. Requires configuring trusted publisher on npmjs.com: - Organization: Fission-AI - Repository: OpenSpec - Workflow: release-prepare.yml
49 lines
1.3 KiB
YAML
49 lines
1.3 KiB
YAML
name: Release (prepare)
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
id-token: write # Required for npm OIDC trusted publishing
|
|
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
prepare:
|
|
if: github.repository == 'Fission-AI/OpenSpec'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 9
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24' # Node 24 includes npm 11.5.1+ required for OIDC
|
|
cache: 'pnpm'
|
|
registry-url: 'https://registry.npmjs.org'
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
# Opens/updates the Version Packages PR; publishes when the Version PR merges
|
|
- name: Create/Update Version PR
|
|
uses: changesets/action@v1
|
|
with:
|
|
title: 'chore(release): version packages'
|
|
createGithubReleases: true
|
|
# Use CI-specific release script: relies on version PR having been merged
|
|
# so package.json already contains the bumped version.
|
|
publish: pnpm run release:ci
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
# npm authentication handled via OIDC trusted publishing (no token needed)
|