Skip to content

ci: restore secure tokenless npm publishing #400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thomson-t merged 1 commit into from
Sep 18, 2026
Merged

ci: restore secure tokenless npm publishing #400

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 25 additions & 19 deletions .github/workflows/release-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,19 +8,20 @@ on:
- VERSION

permissions:
contents: write
id-token: write # Required for npm OIDC trusted publishing
contents: read

jobs:
react-tests:
name: Run React Native Unit Tests
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Setup Node.js
uses: actions/setup-node@v7
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
cache: yarn
Expand All @@ -37,7 +38,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Run Android Unit Tests
run: cd android && ./gradlew test
Expand All @@ -46,31 +49,31 @@ jobs:
name: Publish to npm and Create GitHub Release
runs-on: ubuntu-latest
needs: [react-tests, android-unit-tests]
permissions:
contents: write
id-token: write # Required for npm OIDC trusted publishing
steps:
- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Read version from VERSION
id: version
run: echo "version=$(cat VERSION)" >> "$GITHUB_OUTPUT"

- name: Setup Node.js
uses: actions/setup-node@v7
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
registry-url: https://registry.npmjs.org
cache: yarn
cache-dependency-path: yarn.lock
package-manager-cache: false

- name: Install node modules
run: yarn install

- name: Build SDK
run: yarn build

- name: Ensure npm CLI supports OIDC
run: npm install -g npm@latest

- name: Extract release notes from CHANGELOG.md
id: release-notes
uses: ffurrer2/extract-release-notes@273da39a24fb7db106a35526c8162815faffd31d
Expand All @@ -81,9 +84,12 @@ jobs:
run: npm publish --provenance

- name: Create GitHub Release
uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd
with:
tag: ${{ steps.version.outputs.version }}
name: ${{ steps.version.outputs.version }}
bodyFile: RELEASE_NOTES.md
commit: ${{ github.sha }}
env:
GH_TOKEN: ${{ github.token }}
RELEASE_VERSION: ${{ steps.version.outputs.version }}
RELEASE_COMMIT: ${{ github.sha }}
run: >-
gh release create "$RELEASE_VERSION"
--title "$RELEASE_VERSION"
--notes-file RELEASE_NOTES.md
--target "$RELEASE_COMMIT"
Loading