Skip to content

chore(release): publish to npm with trusted publishing - #152

Open
cs-raj wants to merge 3 commits into
developmentfrom
feat/DX-27614
Open

chore(release): publish to npm with trusted publishing#152
cs-raj wants to merge 3 commits into
developmentfrom
feat/DX-27614

Conversation

@cs-raj

@cs-raj cs-raj commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Problem

npm-publish.yml publishes @contentstack/marketplace-sdk to npm with a long-lived NPM_TOKEN.

The SE1 publishing policy requires OIDC trusted publishing instead: no token, a release.yml workflow that runs when a release is published, Node 24.

The GitHub Packages job also lacks the packages: write permission it needs.

Fix

npm-publish.yml is renamed to release.yml. What changes inside it:

Before After
Trigger release: created release: published
npm auth NPM_TOKEN OIDC — id-token: write, no token
npm publish npm publish --access public same; pre-releases go to the beta dist-tag, releases to latest
GitHub Packages secrets.GITHUB_TOKEN, no packages: write github.token (same token) with packages: write
Node / npm 22.x / npm 10 24 / latest npm
Checkout implicit, credentials persisted the release tag, persist-credentials: false
Actions checkout@v4, setup-node@v4 @v7

Verification

Node 22 and Node 24: install, build, unit tests and npm pack all pass.

@cs-raj @claude
chore(release): publish to npm with trusted publishing
75c1894 
Publish on release:published from release.yml so the npm trusted publisher can
be keyed on the filename, drop NODE_AUTH_TOKEN in favour of id-token: write
(OIDC), run on Node 24 with npm@latest (trusted publishing needs npm >= 11.5.1),
check out the release tag without persisted credentials. GitHub pre-releases go
to the beta dist-tag. The GitHub Packages job gains the packages: write
permission it was missing and keeps publishing with the job's own token.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 1, 2026 07:15
@cs-raj
cs-raj requested a review from a team as a code owner October 1, 2026 07:15
@cs-raj cs-raj self-assigned this Oct 1, 2026
@snyk-io

snyk-io Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 8 0 25 ✅ Passed
🟡 Medium Severity 5 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The workflow changes consistently implement the described release policy without identified defects.

Review effort: Balanced
Findings: None

What changed in this PR

Replaces token-based package publishing with release-triggered OIDC trusted publishing.

Changes:

  • Publishes npm releases with Node 24 and prerelease-aware dist-tags.
  • Adds required GitHub Packages permissions and safer checkout settings.
  • Removes the superseded npm-publish.yml workflow.
File Description
.github/​workflows/​release.yml Adds npm and GitHub Packages release jobs.
.github/​workflows/​npm-publish.yml Removes the legacy token-based workflow.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@cs-raj @claude
chore(release): verify the tag matches package.json, tag github packages
cc482ac 
Refuse to publish when the release tag is not "v" + the package.json version,
so a tag cut on the wrong commit cannot publish an older version under a
newer tag. The GitHub Packages job now uses the same beta/latest dist-tag rule
as the npm job, so a GitHub pre-release never becomes latest on either
registry.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 13, 2026 09:44
Copilot AI reviewed Oct 13, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@github-actions

github-actions Bot commented Oct 13, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 8 0 25 ✅ Passed
🟡 Medium Severity 5 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@cs-raj @claude
fix: bump axios to ^1.20.0 to clear Snyk findings
4fd07c2 
Snyk (snyk test --all-projects): 13 issues (8 high, 5 medium, all axios 1.18.1) -> 0.
Regenerated package-lock.json (axios 1.18.1 -> 1.20.0).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 14, 2026 09:06
@cs-raj
cs-raj requested a review from a team as a code owner October 14, 2026 09:06
@github-actions

github-actions Bot commented Oct 14, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

Copilot AI reviewed Oct 14, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The unrelated runtime dependency upgrade and broad lockfile refresh should be reverted or separately documented and reviewed.

1 open finding

🧠 Review effort: Balanced

Comment thread package.json
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@amit-kanswal-cs amit-kanswal-cs amit-kanswal-cs approved these changes

At least 1 approving review is required to merge this pull request.

Assignees

@cs-raj cs-raj

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@cs-raj @amit-kanswal-cs