Skip to content

fix: updates release workflow #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattinannt merged 1 commit into from
Feb 19, 2026
Merged

fix: updates release workflow #54

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,10 @@ jobs:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Setup Node.js 22.x
- name: Setup Node.js
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
with:
node-version: 22.x
node-version: 24.x
registry-url: "https://registry.npmjs.org"

- name: Install pnpm
Expand All @@ -46,4 +46,4 @@ jobs:
- name: Publish to npm
run: |
cd packages/react-native
npm publish --access public --provenance
npm publish --access public
Comment on lines 46 to +49
Copy link

@coderabbitai coderabbitai bot Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/release.yml

Repository: formbricks/react-native

Length of output: 1622

🏁 Script executed:

# Check if there's any npm configuration or documentation about trusted publishing
fd -type f -name "package.json" packages/react-native | head -5

Repository: formbricks/react-native

Length of output: 237

🏁 Script executed:

# Search for any references to NODE_AUTH_TOKEN or npm auth in the repo
rg "NODE_AUTH_TOKEN|npm.*auth|publishConfig" --type json --type yaml --type yml

Repository: formbricks/react-native

Length of output: 94

🏁 Script executed:

# Check if there are any other workflow files that might show npm auth setup patterns
git ls-files ".github/workflows/" | xargs grep -l "publish\|npm" 2>/dev/null

Repository: formbricks/react-native

Length of output: 183

🏁 Script executed:

# Check package.json in packages/react-native
cat packages/react-native/package.json

Repository: formbricks/react-native

Length of output: 1788

🏁 Script executed:

# Search for NODE_AUTH_TOKEN in all workflow files
rg "NODE_AUTH_TOKEN" .github/workflows/

Repository: formbricks/react-native

Length of output: 49

🏁 Script executed:

# Search for npm auth or publishConfig in the codebase
rg "publishConfig|npm auth|OIDC" --multiline

Repository: formbricks/react-native

Length of output: 49

Missing authentication for npm publish — add NODE_AUTH_TOKEN or confirm npm trusted publishing is configured.

The publish step has no NODE_AUTH_TOKEN env var set. When registry-url is configured in actions/setup-node, it generates an .npmrc expecting NODE_AUTH_TOKEN. The workflow declares permissions: id-token: write # Required for OIDC, indicating OIDC intent, but npm trusted publishing requires explicit per-package configuration on npmjs.com and will not work without it. Publishing will fail unless one of these is true:

  1. npm trusted publishing (OIDC granular tokens) is configured for this package on npmjs.com, or
  2. NODE_AUTH_TOKEN is explicitly passed:
      - name: Publish to npm
        run: |
          cd packages/react-native
          npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Confirm which authentication method is intended and ensure it is properly configured.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 46 - 49, The "Publish to npm"
workflow step is missing authentication; either ensure npm "trusted publishing"
via OIDC is configured for this package on npmjs.com or pass NODE_AUTH_TOKEN
into the Publish to npm step; specifically, update the Publish to npm step (the
job step named "Publish to npm") to set NODE_AUTH_TOKEN from a repository secret
(e.g., secrets.NPM_TOKEN) when using actions/setup-node with a registry-url, or
alternatively confirm and document that OIDC/granular token trust for this
package is configured so the step can run without NODE_AUTH_TOKEN.

Copy link

@coderabbitai coderabbitai bot Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Dropping --provenance removes a supply chain security guarantee.

npm package provenance cryptographically links a published package to its source repository and the specific GitHub Actions build that produced it — enabling consumers to verify the package wasn't tampered with between source and registry. The id-token: write permission (Line 4) is still present in this workflow, meaning OIDC is still available and --provenance would continue to work alongside OIDC-based authentication. Removing provenance is a security posture regression that the PR description ("use Node.js 24.x for OIDC authentication") does not justify.

Consider restoring the flag:

🛡️ Restore provenance attestation 
-          npm publish --access public
+          npm publish --provenance --access public
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
npm publish --access public
npm publish --provenance --access public
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml at line 49, The npm publish step currently
drops the --provenance flag which weakens supply-chain guarantees; update the
publish invocation (the command that runs npm publish --access public) to
include the --provenance option so the workflow emits a provenance attestation
(e.g., change the npm publish command to include --provenance) while keeping the
existing id-token: write OIDC permissions intact.