feat(release): adopt npm OIDC trusted publishing with provenance - #1011
feat(release): adopt npm OIDC trusted publishing with provenance#1011kylemcd wants to merge 1 commit into
Conversation
Sorry, something went wrong.
Sorry, something went wrong.
⚠️ No Changeset foundLatest commit: 3fed165 Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset. This PR includes no changesetsWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Click here to learn what changesets are, and how to add one. Click here if you're a maintainer who wants to add a changeset to this PR |
Sorry, something went wrong.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Sorry, something went wrong.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5ad53bd. Configure here.
Sorry, something went wrong.
Replace the long-lived NPM_TOKEN with short-lived OIDC trusted publishing and provenance. Split release.yml into version/build/publish/release jobs so id-token: write is isolated to a publish job that runs nothing but `yarn npm publish` (no install, no build, no dependency scripts) — the post-TanStack architecture. - Bump Yarn 4.9.1 -> 4.18.0 for scoped-package OIDC; keep main's enableScripts:false hardening, pin the publish registry to npm - Publish via Yarn native OIDC; provenance attestations on every package - Registry-diff publish gate + fail-loud pre-flight for unenrolled packages - Preserve git tags + GitHub Releases via changesets/action (release job) - Add repository metadata to all packages (required for provenance) - Add trusted-publisher enrollment script; document OIDC publishing and the new-package bootstrap in RELEASES.md KNO-13137
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #1011 +/- ##
=======================================
Coverage 73.06% 73.06%
=======================================
Files 139 139
Lines 4351 4351
Branches 1278 1278
=======================================
Hits 3179 3179
Misses 1055 1055
Partials 117 117 |
Sorry, something went wrong.
Reviewers
At least 1 approving review is required to merge this pull request.
Description
Replaces the long-lived NPM_TOKEN in release.yml with npm OIDC trusted publishing + provenance, and restructures the release pipeline so the short-lived OIDC token is isolated to a job that runs nothing but yarn npm publish. Implements KNO-13137.
Why. Today one static NPM_TOKEN can publish every @knocklabs package from anywhere if it leaks. OIDC swaps it for a token minted per run that expires in minutes and only works from this repo's release.yml, and provenance cryptographically links each published tarball to the exact commit + workflow run. The job split is the post-TanStack architecture: that compromise worked because the release job held publish power while also running yarn install/build, so malicious dependency code read the token from runner memory. Here, install/build run in a job with no publish power, and the id-token job runs no untrusted code.
Why now. The July 9 stable release (run) failed publishing @knocklabs/eslint-config@0.0.6 — npm rejected the NPM_TOKEN PUT with a 404 (a masked permission rejection; the package exists) — and the topological publish aborted, stranding 6 packages (client@0.21.14, react@0.11.23, …) versioned on main but absent from npm. OIDC replaces the token whose per-package grants are failing, and the registry-diff gate below picks up the stranded versions automatically on the first post-merge release.
How — release.yml is now four jobs:
Also in this PR:
Preserved (no functional regression): npm dist-tags (latest/canary/rc), workspace: → version substitution, --tolerate-republish, prerelease/canary→main promotion logic, git tags (incl. private example apps), and GitHub Releases with changelog notes.
Validated locally: build, type:check, lint, format:check, and the full test suite (940 tests) pass on Yarn 4.17.1; yarn --immutable passes with the committed lockfile; yarn npm publish substitutes workspace: ranges and engages --provenance with no install. The OIDC handshake itself is exercised on the first real release (going direct to main, no canary pre-flight).
Todos
Out-of-repo rollout (npm org admin / GitHub settings), not code changes: