ci: Publish releases using OIDC instead of npm token - #909
Conversation
|
I thought I'd be able to test this before merging, but had forgotten that the non-master branch check takes place before anything else. So the build runs, but Semantic Release takes no action. Afraid this will have to be one of those "hope it works" PRs. For a confidence boost, the diff is practically identical to the corresponding Lambda Wrapper PR: comicrelief/lambda-wrapper#1224 |
There was a problem hiding this comment.
Makes sense to me, thanks for the context-ful links!
(I couldn't seem to find the Trusted Publishers section though, as I was curious to have a looksie. Is access to this tied to a specific user? I'm owner already tho 😕 Couldn't see any such link when inside our Organisation on there either.
Ignore me, they meant specific packages, not the 'Packages' screen 🤦 |
|
Looks good; we've got the all-important success message: |
|
🎉 This PR is included in version 8.77.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
2 participants
PR description
What is it doing?
Replaces long-lived token authentication with OpenID Connect in the npm publishing workflow.
The workflow needs to be using npm ≥11.5.1 and Semantic Release ≥25.0.1. I've also configured GitHub Actions to be this package's trusted publisher on npm.
For more about how this works, see npm's Trusted Publishing docs and GitHub's OpenID Connect docs docs.
Why is this required?
As part of ongoing efforts to strengthen supply chain security, npm will remove the ability to publish using 2FA-bypass tokens from January 2027. Full details can be found in this post.
Switching to Trusted Publishing allows us to continue to fully automate our publishing workflow.
link to Jira ticket:
ENG-5182
Quick Checklist:
My PR title follows the Conventional Commit spec.
I have filled out the PR description as per the template above.
I have added tests to cover new or changed behaviour.
I have updated any relevant documentation.