Add OIDC trusted publishing + staged npm releases via GitHub Actions#447
Closed
patocallaghan wants to merge 4 commits into
Closed
Add OIDC trusted publishing + staged npm releases via GitHub Actions#447patocallaghan wants to merge 4 commits into
patocallaghan wants to merge 4 commits into
Conversation
jasonpraful
added a commit
that referenced
this pull request
Jun 15, 2026
…privilege) Pull in security hardening from #447: SHA-pinned actions, env-var indirection for release tag (script-injection fix), top-level least-privilege permissions, persist-credentials: false, disabled package-manager cache, concurrency + timeout, default-branch ancestry gate, dist-tag resolution, and npm staged publishing via OIDC trusted publishing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jasonpraful
added a commit
that referenced
this pull request
Jun 15, 2026
* chore: migrate npm release from CircleCI to GitHub Actions Use OIDC trusted publishing for npm releases instead of token-based auth. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore: harden release workflow (OIDC staged publish, SHA pins, least-privilege) Pull in security hardening from #447: SHA-pinned actions, env-var indirection for release tag (script-injection fix), top-level least-privilege permissions, persist-credentials: false, disabled package-manager cache, concurrency + timeout, default-branch ancestry gate, dist-tag resolution, and npm staged publishing via OIDC trusted publishing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: keep m4pro.medium runner, restore Socket Firewall check, trim workflow comments - Revert CircleCI resource_class back to m4pro.medium (M4) - Restore Socket Firewall registry verification in install-dependencies - Remove redundant inline comments from release.yml (keep SHA version pins) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: drop workflow_dispatch trigger from release workflow Release is now triggered only by publishing a GitHub Release; remove the manual dispatch input and its now-dead github.event.inputs.tag fallbacks. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: pin test/publish to the SHA validated in validate (tag-mutability TOCTOU) validate emits the resolved, ancestry-checked SHA; test and publish check out that SHA instead of re-resolving the mutable tag by name, closing the window where a force-updated tag could ship a malicious build with provenance. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…d runtime Apply the fixes validated on the passport-intercom and cli publish workflows: - verify: use fetch-depth: 0 and drop the manual `git fetch --depth=1`, so the default-branch ancestry check has the history it needs (the double-shallow version could only pass when the tag was the branch tip) - add a top-level concurrency group so overlapping releases serialize instead of racing for a dist-tag - add timeout-minutes: 15 to stage-publish Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pin to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 (v7.0.0). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
patocallaghan
force-pushed
the
patoc/oidc-staged-publishing
branch
from
8a88a21 to
3631286
Compare
Member
Author
|
Closed as redundant.
This PR adds a second |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
Moves npm publishing onto short-lived, per-run OIDC credentials with a human approval step, removing the need for a stored long-lived npm token.
How?
Adds a release-triggered GitHub Actions workflow that authenticates to npm via OIDC (no token) and uses npm's staged publishing, so each release is queued for a maintainer to approve before it goes live.
Opened as an alternative for discussion against the existing migration:
The difference: this layers a human staged-approval gate (
npm stage publish) on top of OIDC, rather than publishing directly on release.Generated with Claude Code