chore(npm): Update release npm action to stop using tokens - #526
Merged
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR modernizes the CI/CD workflows by updating Node.js versions, pinning GitHub Actions to specific commit SHAs for security, and transitioning to a more secure npm authentication method using OIDC.
Key changes:
- Upgraded Node.js from version 18 to version 20 across both workflows
- Pinned GitHub Actions to commit SHAs with version tags for immutability and security
- Refactored npm authentication from
.npmrctoken approach toregistry-urlconfiguration with OIDC permissions
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/workflows/ci.yml |
Updated Node version to 20.x, pinned actions to commit SHAs, and added emoji labels to workflow steps |
.github/workflows/cd.yml |
Updated Node version to 20, added OIDC permissions block, replaced manual npm token setup with registry-url configuration, and added emoji labels to workflow steps |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ShaneK
approved these changes
Nov 10, 2025
ShaneK
added a commit
that referenced
this pull request
Aug 19, 2026
* docs: correct typo in monorepo description (#522) * chore(npm): Update release npm action to stop using tokens (#526) * Update release yaml to use trusted publishers approach * Update cd.yml * Finetuned workflows triggers and improved linting issues (#527) * feat(many): support for Ionic Framework v9 (#532) * feat!: support Angular 21 and 22 via peerDependencies (#531) * fix(ci): fixing eslint and prettier * feat!: support Angular 21 and 22 via peerDependencies * fix: regenerating lock files * fix(schematics): default page and component schematics to standalone * chore(npm): updating package-lock.json * fix(schematics): update templates to Ionic 9 component import paths * fix(schematics): repair generated component code and route registration BREAKING CHANGE: Generated code now targets Ionic 9 and Angular 21 or 22. Pages and components import `IonicModule` from `@ionic/angular/lazy` and standalone components from the `@ionic/angular` root, which is the Ionic 9 export layout, so generated code no longer compiles against Ionic 8. The `page` and `component` schematics now default to standalone, and peerDependencies drop Angular 20 and below. --------- Co-authored-by: mohammad altamash <78483966+Shaikhaltamash861@users.noreply.github.com> Co-authored-by: Gonçalo M. <goncalo.martins@outsystems.com>
This was referenced Aug 19, 2026
ShaneK
added a commit
that referenced
this pull request
Aug 19, 2026
The release workflow has never completed a publish since #526 moved it off tokens. Four separate problems, none of which had run yet: - `npm install -g npm@latest` now resolves to npm 12, which requires Node >=22.22.2 while the workflow pins Node 20. Pinned to npm 11, the newest line that runs on Node 20 and still supports provenance and OIDC. - `lerna publish --provenance` fails outright. Lerna 4's CLI is yargs `.strict()` and does not declare that option, so it exits with "Unknown argument: provenance". - Lerna 4 uploads through `libnpmpublish@4`, which supports neither provenance nor OIDC trusted publishing, so no npm CLI upgrade can make `lerna publish` work. The release is now split: `lerna version` still handles bumps, changelogs, tags and the GitHub release, and `scripts/publish-packages.sh` does the upload with `npm publish --provenance`. - `permissions: contents: read` cannot push the release commit or tags, or create the GitHub release. Before #526 there was no permissions block, so the default write access applied. The publish script skips any package whose version is already on the registry, since lerna versions these independently and a release may bump only one of them.
ShaneK
added a commit
that referenced
this pull request
Aug 19, 2026
The release workflow has never completed a publish since #526 moved it off tokens. Four separate problems, none of which had run yet: - `npm install -g npm@latest` now resolves to npm 12, which requires Node >=22.22.2 while the workflow pins Node 20. Pinned to npm 11, the newest line that runs on Node 20 and still supports provenance and OIDC. - `lerna publish --provenance` fails outright. Lerna 4's CLI is yargs `.strict()` and does not declare that option, so it exits with "Unknown argument: provenance". - Lerna 4 uploads through `libnpmpublish@4`, which supports neither provenance nor OIDC trusted publishing, so no npm CLI upgrade can make `lerna publish` work. The release is now split: `lerna version` still handles bumps, changelogs, tags and the GitHub release, and `scripts/publish-packages.sh` does the upload with `npm publish --provenance`. - `permissions: contents: read` cannot push the release commit or tags, or create the GitHub release. Before #526 there was no permissions block, so the default write access applied. The publish script skips any package whose version is already on the registry, since lerna versions these independently and a release may bump only one of them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the current behavior?
NPM_TOKEN, so it cannot use npm’s trusted-publisher (OIDC) flow.GitHub Issue Number: N/A
What is the new behavior?
id-token: write, configuresactions/setup-node@v6with the npm registry, upgrades npm, and runsnpm run publish:ciwithout writing.npmrc, so publishing uses the short-lived OIDC credential.actions/checkoutandactions/setup-nodeto the most recent versions.Does this introduce a breaking change?
Testing
Other information