chore(release): publish to npm with trusted publishing by cs-raj · Pull Request #283 · contentstack/contentstack-utils-javascript

cs-raj · 2026-10-01T08:21:18Z

Problem

npm-publish.yml publishes @contentstack/utils to npm with a long-lived NPM_TOKEN.

The SE1 publishing policy requires OIDC trusted publishing instead: no token, a release.yml workflow that runs when a release is published, Node 24.

The GitHub Packages job also authenticates with a personal token (GIT_TOKEN) and lacks the packages: write permission.

Fix

npm-publish.yml is renamed to release.yml. The existing guard that publishes only v-prefixed tags is kept. What changes inside it:

	Before	After
Trigger	`release: created`	`release: published`
npm auth	`NPM_TOKEN`	OIDC — `id-token: write`, no token
npm publish	`npm publish`	`npm publish --access public`; pre-releases go to the `beta` dist-tag, releases to `latest`
GitHub Packages	`GIT_TOKEN` (personal token), no `packages: write`	`github.token` with `packages: write`
Node / npm	22.x / npm 10	24 / latest npm
Checkout	release tag, credentials persisted	release tag, `persist-credentials: false`
Actions	`checkout@v4`, `setup-node@v4`	`@v7`

Verification

Node 22 and Node 24: install, build, tests and npm pack all pass.

Also in this PR

ci.yml's build-test job gets checks: write and pull-requests: write so its coverage report and test reporter can post again — they have failed on every PR since 24 Sept with the default read-only token, while the tests themselves pass. The coverage action is pinned to the commit v2 resolves to today, and that file is exempted from Talisman's hex-string check in .talismanrc.

Publish on release:published from release.yml so the npm trusted publisher can be keyed on the filename, drop NODE_AUTH_TOKEN in favour of id-token: write (OIDC), run on Node 24 with npm@latest (trusted publishing needs npm >= 11.5.1), check out the release tag without persisted credentials. GitHub pre-releases go to the beta dist-tag. The existing guard that publishes only v-prefixed tags is kept. The GitHub Packages job gains the packages: write permission it was missing and publishes with the job's own token instead of a personal token. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

snyk-io · 2026-10-01T08:21:32Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-10-01T08:22:18Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

Copilot

Copilot review overview

🟡 Changes recommended

The nonexistent checkout@v7 and setup-node@v7 versions prevent both publishing jobs from running.

Review effort: Balanced
Findings: 1

Open (1)

Update release instructions for the migrated workflow · New

What changed in this PR

Migrates package publishing to OIDC trusted publishing and GitHub-provided credentials.

Changes:

Publishes releases using Node 24 and npm OIDC.
Adds prerelease/latest npm tags and GitHub Packages permissions.
Renames the publishing workflow.

File	Description
`.github/workflows/release.yml`	Adds the revised release publishing workflow.
`.github/workflows/npm-publish.yml`	Removes the token-based publishing workflow.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

The build-test job runs with the default read-only token, so the coverage report, sticky comment and test reporter fail with "Missing checks: write" even though the tests pass (red on every pull request since 2026-09-24). Grant the job just what those steps need, pin the coverage action to the commit the v2 tag resolves to today, and exempt the pinned file from Talisman's hex-string check. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

github-actions · 2026-10-01T08:34:08Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

github-actions · 2026-10-01T08:34:10Z

Coverage report

St.^❔	Category	Percentage	Covered / Total
🟢	Statements	99.17%	720/726
🟢	Branches	92.44%	538/582
🟢	Functions	100%	152/152
🟢	Lines	99.4%	666/670

Test suite run success

430 tests passing in 22 suites.

Report generated by 🧪jest coverage report action from 2d2c96e

Copilot

Copilot review overview

🟡 Changes recommended

The Talisman checksum does not match the modified CI workflow, preventing the exemption from working.

Review effort: Balanced
Findings: 1 · 1

Open (2)

Regenerate checksum for updated CI workflow exemption · New
Update release instructions for the migrated workflow

Refuse to publish when the release tag is not "v" + the package.json version, so a tag cut on the wrong commit cannot publish an older version under a newer tag. The GitHub Packages job now uses the same beta/latest dist-tag rule as the npm job, so a GitHub pre-release never becomes latest on either registry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md and the dev-workflow skill still described npm-publish.yml on release: created with NPM_TOKEN / GIT_TOKEN. Publishing now runs from release.yml on release: published, npm through OIDC trusted publishing and GitHub Packages with the job token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-10-13T09:45:15Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

Copilot

🔵 Needs a closer look

The Talisman checksum does not match the updated CI workflow, preventing the intended exemption.

1 open finding

Update release instructions for the migrated workflow

1 resolved since last review

Regenerate checksum for updated CI workflow exemption

🧠 Review effort: Balanced

Snyk (dev, all-projects): critical 2 -> 0, high 76 -> 6, medium 33 -> 8, low 6 -> 1 npm audit: critical 4 -> 3, high 40 -> 33, moderate 9 -> 10, low 4 -> 0 .talismanrc: package-lock.json now ignores filecontent and base64content (sha512 integrity hashes; false positives). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-10-14T09:04:56Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

Copilot

🟡 Changes recommended

Security-scanning exclusions, mutable write-enabled actions, unrelated dependency upgrades, and changed GitHub package visibility remain unresolved.

3 open findings

1 resolved since last review

Update release instructions for the migrated workflow

🧠 Review effort: Balanced

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-10-14T10:03:15Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

github-actions · 2026-10-14T10:03:33Z

Coverage report

St.^❔	Category	Percentage	Covered / Total
🟢	Statements	99.17%	720/726
🟢	Branches	92.44%	538/582
🟢	Functions	100%	152/152
🟢	Lines	99.4%	666/670

Test suite run success

430 tests passing in 22 suites.

Report generated by 🧪jest coverage report action from 2d2c96e

Copilot

🔵 Needs a closer look

The Talisman exemptions are ineffective or overly broad, and unrelated dependency upgrades should be removed or reviewed separately.

1 open finding

Pin third-party actions before granting write permissions

2 resolved since last review

🧠 Review effort: Balanced

Copilot AI balanced review requested due to automatic review settings October 1, 2026 08:21

cs-raj requested a review from a team as a code owner October 1, 2026 08:21

cs-raj self-assigned this Oct 1, 2026

Copilot AI reviewed Oct 1, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

Copilot started reviewing on behalf of cs-raj October 1, 2026 08:23

View session

Copilot AI balanced review requested due to automatic review settings October 1, 2026 08:33

cs-raj requested a review from a team as a code owner October 1, 2026 08:33

Copilot started reviewing on behalf of cs-raj October 1, 2026 08:34

View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

Comment thread .talismanrc

cs-raj and others added 2 commits October 13, 2026 15:08

Copilot AI balanced review requested due to automatic review settings October 13, 2026 09:44

Copilot started reviewing on behalf of cs-raj October 13, 2026 09:44

View session

Copilot AI reviewed Oct 13, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 14, 2026 09:04

Copilot started reviewing on behalf of cs-raj October 14, 2026 09:04

View session

Copilot AI reviewed Oct 14, 2026

View reviewed changes

Comment thread .github/workflows/ci.yml

Comment thread .github/workflows/release.yml Outdated

Comment thread .talismanrc

Add public access to npm publish command

2d2c96e

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings October 14, 2026 10:02

Copilot started reviewing on behalf of cs-raj October 14, 2026 10:03

View session

Copilot AI reviewed Oct 14, 2026

View reviewed changes

netrajpatel approved these changes Oct 14, 2026

View reviewed changes

amit-kanswal-cs approved these changes Oct 14, 2026

View reviewed changes

Conversation

cs-raj commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Verification

Also in this PR

Uh oh!

snyk-io Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Oct 1, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage report

Test suite run success

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

github-actions Bot commented Oct 13, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

github-actions Bot commented Oct 14, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 14, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Oct 14, 2026

Coverage report

Test suite run success

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

cs-raj commented Oct 1, 2026 •

edited

Loading

snyk-io Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading