fix(ci): switch publish-package.yml to npm Trusted Publishers (OIDC) - #395
Merged
Conversation
The previous flow authenticated `npm publish` with a long-lived `NPM_TOKEN` secret whose per-package allowlist couldn't be inspected or rotated by the convertcom org owners. Result: out of 13 `@convertcom/js-sdk-*` packages, only `js-sdk` and `js-sdk-cloudflare` could be published (last success: 2026-04-06); publishes for `types`, `utils`, `rules`, etc. have been 404'ing on the registry PUT for months — 7 GitHub-tagged versions never made it to npm. With Trusted Publishers (per npm docs at https://docs.npmjs.com/trusted-publishers), authentication moves to GitHub OIDC, configured per package by the npm org owners. Each package's npm settings now lists this workflow file as a trusted publisher, so the workflow needs three changes: 1. Grant the job `id-token: write` so the runner can mint an OIDC token for npm to validate. 2. Upgrade the bundled npm CLI to >= 11.5.1 (Node 22 ships 10.9.x); OIDC publish support requires the newer CLI. 3. Drop the `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` env from each publish step — OIDC replaces it; leaving the token in would defeat the security gain. Also pins `actions/checkout@v4` to the tag passed via `workflow_dispatch -f tag=<tag>` (or the release event's `tag_name`), so backfill dispatches build the *tagged commit's* source — not main HEAD — which is required to publish the 7 missing prior versions (e.g. dispatching `js-sdk-types-v3.12.0` must build the 3.12.0 source, not the current 3.13.0 in `packages/types/package.json` on main). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
JosephSamirL
approved these changes
May 25, 2026
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The previous flow authenticated
npm publishwith a long-livedNPM_TOKENwhose per-package allowlist couldn't be inspected or rotated by the org owners. Out of 13@convertcom/js-sdk-*packages, onlyjs-sdkandjs-sdk-cloudflarecould be published with that token (last success: 2026-04-06). Seven GitHub-tagged versions never made it to npm:@convertcom/js-sdk@convertcom/js-sdk-types@convertcom/js-sdk-utils@convertcom/js-sdk-rulesAll packages have now been configured with npm Trusted Publishers on the npm side, listing this workflow file (
publish-package.yml) as a trusted publisher. This PR updates the workflow accordingly.Workflow changes
permissions: id-token: writeat the job level — required by npm OIDC.npm install -g npm@latestaftersetup-node— Trusted Publishers OIDC needs npm CLI ≥ 11.5.1; Node 22 ships 10.9.x.actions/checkout@v4withref: ${{ github.event.release.tag_name || inputs.tag }}— fixes a pre-existing bug whereworkflow_dispatchalways built main HEAD instead of the dispatched tag, making it impossible to publish older versions. This is what unblocks the 7-version backfill.NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}env from all 13 publish steps — OIDC replaces it; leaving the token in would defeat the security gain.Test plan
gh workflow run publish-package.yml -f tag=js-sdk-types-v3.12.0gh workflow run publish-package.yml -f tag=js-sdk-types-v3.13.0gh workflow run publish-package.yml -f tag=js-sdk-utils-v2.3.0gh workflow run publish-package.yml -f tag=js-sdk-utils-v2.4.0gh workflow run publish-package.yml -f tag=js-sdk-rules-v2.2.0gh workflow run publish-package.yml -f tag=js-sdk-v4.4.1gh workflow run publish-package.yml -f tag=js-sdk-v4.4.2npm view @convertcom/js-sdk-types versionsreports3.12.0and3.13.0after the corresponding runs.🤖 Generated with Claude Code