From 1779089c008e4fcfff075ea421f3cf99d979758b Mon Sep 17 00:00:00 2001
From: Thomson Thomas <thomson.thomas@rokt.com>
Date: Fri, 18 Sep 2026 12:26:02 -0400
Subject: [PATCH] ci(release): restore tokenless npm publishing

Remove token-based registry setup that breaks Yarn caching with
setup-node v7.

Scope release permissions, pin actions, and disable persisted
credentials so OIDC publishing remains secure.

#agentic
---
 .github/workflows/release-publish.yml | 44 +++++++++++++++------------
 1 file changed, 25 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index 2468ee2..9a9bd2b 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -8,8 +8,7 @@ on:
       - VERSION
 
 permissions:
-  contents: write
-  id-token: write # Required for npm OIDC trusted publishing
+  contents: read
 
 jobs:
   react-tests:
@@ -17,10 +16,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: yarn
@@ -37,7 +38,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run Android Unit Tests
         run: cd android && ./gradlew test
@@ -46,21 +49,24 @@ jobs:
     name: Publish to npm and Create GitHub Release
     runs-on: ubuntu-latest
     needs: [react-tests, android-unit-tests]
+    permissions:
+      contents: write
+      id-token: write # Required for npm OIDC trusted publishing
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Read version from VERSION
         id: version
         run: echo "version=$(cat VERSION)" >> "$GITHUB_OUTPUT"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          registry-url: https://registry.npmjs.org
-          cache: yarn
-          cache-dependency-path: yarn.lock
+          package-manager-cache: false
 
       - name: Install node modules
         run: yarn install
@@ -68,9 +74,6 @@ jobs:
       - name: Build SDK
         run: yarn build
 
-      - name: Ensure npm CLI supports OIDC
-        run: npm install -g npm@latest
-
       - name: Extract release notes from CHANGELOG.md
         id: release-notes
         uses: ffurrer2/extract-release-notes@273da39a24fb7db106a35526c8162815faffd31d
@@ -81,9 +84,12 @@ jobs:
         run: npm publish --provenance
 
       - name: Create GitHub Release
-        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd
-        with:
-          tag: ${{ steps.version.outputs.version }}
-          name: ${{ steps.version.outputs.version }}
-          bodyFile: RELEASE_NOTES.md
-          commit: ${{ github.sha }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_VERSION: ${{ steps.version.outputs.version }}
+          RELEASE_COMMIT: ${{ github.sha }}
+        run: >-
+          gh release create "$RELEASE_VERSION"
+          --title "$RELEASE_VERSION"
+          --notes-file RELEASE_NOTES.md
+          --target "$RELEASE_COMMIT"