Harden npm trusted publishing workflow - #178
Conversation
Sorry, something went wrong.
| publish: | ||
| name: 🚀 Release | ||
| needs: [build-release-artifact] | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write # to be able to publish a GitHub release | ||
| id-token: write # to enable use of OIDC for npm provenance | ||
| issues: write # to be able to comment on released issues | ||
| pull-requests: write # to be able to comment on released pull requests |
There was a problem hiding this comment.
What I've been doing on other projects lately is tying the OIDC on npm side to a dedicated github environment that requires review from a maintainer before being executed.
That way there's always a human in the loop with publishing. Happy to set that up and keeping an eye on it if you feel thats worth it @kentcdodds
DetailsLooks like this on npm side:
-
github actions: https://github.com/cmx-tools/packages/blob/main/.github/workflows/ci.yml#L56
-
environment config
Sorry, something went wrong.
There was a problem hiding this comment.
If you'd like to do that, go for it 👍
Sorry, something went wrong.
|
🎉 This PR is included in version 5.6.3 🎉 The release is available on: Your semantic-release bot 📦🚀 |
Sorry, something went wrong.
Summary
Context
Triggered by the TanStack npm supply-chain compromise postmortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
Testing