Repository navigation
Stage releases on npm from a version tag - #7
Merged
Merged
Conversation
A version tag now runs the checks and uploads the package to npm's stage queue with provenance, using trusted publishing, so no npm token is stored. Nothing becomes public until a maintainer approves it with 2FA. Pull requests that change the workflow and manual runs do everything except the upload. docs/RELEASING.md has the steps, including the npm setting this needs.
npm refuses even a dry run for a version it already has, and main is on one between releases, so the dry run failed every time. It now uses a version that can never exist. The change stays on the runner and is never committed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a workflow that stages each release on npm from a version tag, with provenance. A maintainer still approves every release with 2FA. This changes nothing on npm until the trusted-publisher setting below is turned on, and nothing in the package itself.
How it works
v0.4.0npm stage publish --provenance. The package is not public until approved on npmjs.comrelease.yml, or a manual runnpm stage publish --dry-run. Nothing is uploadedBefore uploading, it stops if the tag doesn't match
package.json, if the commit isn't onmain, or if the version is already on npm.Safety choices
npm stage publish, so a compromised workflow can't publish directly, and approval still needs 2FA.ci.ymlis unchanged.${{ }}expressions inside shell scripts.npm-releaseenvironment, used only by tag runs, so the npm setting can be tied to it.What this PR proves, and what it doesn't
This PR's run tests the checks, the tarball test and a dry run of the upload on GitHub's runners. It can't test the real upload. Trusted publishing, staging through OIDC and provenance will only run for real at the next release, and the steps for that are in
docs/RELEASING.md. Until then,npm trustand--provenancewithnpm stage publishare based on npm's docs, not on a run of this workflow.Locally, I checked the file's structure and safety properties with a small script, ran the tag-matching logic by hand, and confirmed the integrity calculation matches npm's value for 0.3.0.
actionlintwas not available. There has been no outside review.One npm setting, later
Trusted publishing needs a setting on npmjs.com, which only the owner can make, and it isn't made yet. npm removes a new setting if it has no successful publish within 2 days, so it should be added right before the next release, not now.
docs/RELEASING.mdlists the exact values.