Repository navigation
chore(release): publish to npm with trusted publishing - #115
Conversation
Publish on release:published from release.yml so the npm trusted publisher can be keyed on the filename, drop the NPM_TOKEN passed to JS-DevTools/npm-publish in favour of id-token: write (OIDC), run on Node 24 with npm@latest (trusted publishing needs npm >= 11.5.1), check out the release tag without persisted credentials, and keep contents: write only on the job that needs it. The tarball is attached to the release from a separate job with gh release upload instead of the archived upload-release-asset action. GitHub pre-releases go to the beta dist-tag. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Release-tag shell injection remains unresolved, and external trusted-publishing prerequisites require verification.
Review effort: Balanced
Findings: 1
What changed in this PR
Migrates DataSync’s npm release workflow from token authentication to OIDC trusted publishing.
Changes:
- Publishes released versions using Node 24 and release-specific npm tags.
- Separates tarball uploads into a job with write permissions.
- Uses clean installs and checks out release tags without persisted credentials.
| File | Description |
|---|---|
.github/workflows/release.yml |
Replaces token-based publishing and modernizes release asset uploads. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Refuse to publish when the release tag is not "v" + the package.json version, so a tag cut on the wrong commit cannot publish an older version under a newer tag. The tag now reaches the upload step through the RELEASE_TAG env variable instead of being interpolated into the shell line (GitHub Actions script-injection hardening). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
Regenerated package-lock.json from scratch (no package.json change). npm audit: critical 1 -> 0, high 50 -> 49 (moderate 10 -> 13, total 61 -> 62). Snyk (prod deps): clean before and after. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
Problem
release.ymlpublishes@contentstack/datasync-managerto npm with a long-livedNPM_TOKENthroughJS-DevTools/npm-publish@v3, and attaches the tarball to the release with the archivedactions/upload-release-asset@v1.The SE1 publishing policy requires OIDC trusted publishing instead: no token, a
release.ymlworkflow that runs when a release is published, Node 24.Fix
release.ymlis rewritten in place. What changes inside it:release: createdrelease: publishedNPM_TOKENviaJS-DevTools/npm-publish@v3id-token: write, no token, plainnpm publishnpm publish --access public; pre-releases go to thebetadist-tag, releases tolatestcontents: writeon the whole jobcontents: readon the publish job;contents: writeonly on the upload jobactions/upload-release-asset@v1(archived) inside the publish jobupload-release-assetjob, runs after a successful publish:npm pack+gh release upload --clobberwith the job tokennpm installnpm cinpm run build-tspersist-credentials: falsecheckout@v4,setup-node@v4@v7Verification
Node 22 and Node 24: install, build and
npm packall pass.