Skip to content

ci: migrate release workflow to npm trusted publishing (OIDC) #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
derodero24 merged 2 commits into from
Mar 21, 2026
Merged

ci: migrate release workflow to npm trusted publishing (OIDC) #68

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
571b028
ci: migrate release workflow to npm trusted publishing (OIDC)
derodero24 Mar 20, 2026
95b742c
fix(ci): restore pinned SHA for dtolnay/rust-toolchain
derodero24 Mar 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,9 @@ jobs:
with:
node-version-file: .nvmrc
cache: pnpm
- uses: dtolnay/rust-toolchain@stable
- uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
with:
toolchain: stable
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
shared-key: release-version
Expand Down Expand Up @@ -140,8 +142,9 @@ jobs:
with:
node-version-file: .nvmrc
cache: pnpm
- uses: dtolnay/rust-toolchain@stable
- uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
with:
toolchain: stable
targets: ${{ matrix.settings.target }}
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
Expand Down Expand Up @@ -238,11 +241,11 @@ jobs:
echo ""
done

# npm trusted publishing (OIDC) — no NPM_TOKEN needed.
# Requires each package to be linked to this repo on npmjs.com:
# npmjs.com → Package Settings → Trusted publishers → Add GitHub Actions
# Repository: derodero24/zflate | Workflow: release.yml
- name: Publish to npm
run: |
npm config set provenance true
npm publish --access public --provenance
run: npm publish --provenance --access public
Comment on lines +244 to +249

@coderabbitai coderabbitai Bot Mar 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== .nvmrc =="
cat .nvmrc

echo
echo "== release workflow npm-related steps =="
rg -n -C2 'setup-node|npm publish|npm --version|install -g npm|id-token' .github/workflows/release.yml

Repository: derodero24/zflate

Length of output: 1457

🌐 Web query:

What is the minimum npm CLI version required for npm Trusted Publishing (OIDC) and npm publish --provenance in GitHub Actions?

💡 Result:

The minimum npm CLI version required for npm Trusted Publishing (OIDC) in GitHub Actions is 11.5.1. The npm publish --provenance flag requires npm CLI version 9.5.0 or later, but since Trusted Publishing automatically generates provenance attestations, version 11.5.1 covers both features when used together in GitHub Actions.

Citations:

npm の最小バージョン要件をワークフローで強制してください。

Line 249 の npm publish --provenance --access public は Trusted Publishing に対応していますが、現在のワークフローは npm v11.5.1 以上の要件を保証していません。.nvmrc は Node.js のバージョン指定のみで、npm のバージョンは環境に依存するため、Trusted Publishing が失敗するリスクがあります。

🔧 提案差分（版バージョン検証ステップの追加） 
       - run: pnpm install --frozen-lockfile
+      - name: Verify npm version for trusted publishing
+        run: |
+          REQUIRED="11.5.1"
+          CURRENT="$(npm --version)"
+          if [ "$(printf '%s\n' "$REQUIRED" "$CURRENT" | sort -V | head -n1)" != "$REQUIRED" ]; then
+            echo "npm >= ${REQUIRED} is required for trusted publishing/provenance (current=${CURRENT})"
+            exit 1
+          fi
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 244 - 249, The workflow’s Publish
to npm step (the run: npm publish --provenance --access public) can fail if the
runner’s npm is older than the Trusted Publishing requirement; add a new job
step immediately before the Publish to npm step that enforces npm >= 11.5.1
(either by activating a specific npm via corepack e.g., prepare/activate
npm@11.5.1 or by checking npm --version and failing the job if it’s too low), so
the publish step always runs with a compatible npm version; refer to the
existing Publish to npm step name when inserting this version-check/activation
step and keep .nvmrc as-is for node version management.

env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}