Skip to content

chore(release): publish to npm with trusted publishing - #73

Open
cs-raj wants to merge 7 commits into
developmentfrom
feat/DX-27614
Open

chore(release): publish to npm with trusted publishing#73
cs-raj wants to merge 7 commits into
developmentfrom
feat/DX-27614

Conversation

@cs-raj

@cs-raj cs-raj commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Problem

release.yml publishes @contentstack/webhook-listener to npm with a long-lived NPM_TOKEN.

The SE1 publishing policy requires OIDC trusted publishing instead: no token, a release.yml workflow that runs when a release is published, Node 24.

Fix

release.yml is rewritten in place. What changes inside it:

Before After
Trigger release: created release: published
npm auth NPM_TOKEN OIDC — id-token: write, no token
npm publish npm publish --tag latest --access public npm publish --access public; pre-releases go to the beta dist-tag, releases to latest
Node / npm 22.x / npm 10 24 / latest npm
Build npm run build-ts unchanged
Checkout release tag, credentials persisted release tag, persist-credentials: false
Actions checkout@v4, setup-node@v4 @v7
Tag check — publish stops if the release tag is not v + the package.json version
Release tarball attached by github-release.yml when it created the release upload-release-asset job in release.yml, after a successful publish (npm pack)
github-release.yml created the release with GITHUB_TOKEN on every version bump pushed to master removed — releases raised with that token cannot trigger release.yml; releases are created by a person

Verification

Node 22 and Node 24: install, build and npm pack all pass.

@cs-raj @claude
chore(release): publish to npm with trusted publishing
07a7fa6 
Publish on release:published so the npm trusted publisher keyed on release.yml
can be used, drop NODE_AUTH_TOKEN in favour of id-token: write (OIDC), run on
Node 24 with npm@latest (trusted publishing needs npm >= 11.5.1), check out the
release tag without persisted credentials, keep the explicit build-ts step.
GitHub pre-releases go to the beta dist-tag.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 1, 2026 09:30
@cs-raj cs-raj self-assigned this Oct 1, 2026
@snyk-io

snyk-io Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The nonexistent actions/checkout@v7 and actions/setup-node@v7 references prevent the workflow from running.

Review effort: Balanced
Findings: None

What changed in this PR

Migrates npm releases from token authentication to OIDC trusted publishing.

Changes:

  • Publishes on release publication using Node 24 and OIDC.
  • Routes prereleases to beta and stable releases to latest.
  • Disables persisted checkout credentials.
File Description
.github/​workflows/​release.yml Updates the npm publishing workflow.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@cs-raj @claude
chore(release): verify the release tag matches package.json
6d6d478 
Refuse to publish when the release tag is not "v" + the package.json version,
so a tag cut on the wrong commit cannot publish an older version under a
newer tag. The tag reaches the check through an env variable, never through
a shell line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 13, 2026 09:44
Copilot AI reviewed Oct 13, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Releases created with GITHUB_TOKEN will not trigger this publishing workflow.

1 open finding

🧠 Review effort: Balanced

Comment thread .github/workflows/release.yml
@cs-raj @claude
chore(release): drop github-release.yml, attach the tarball in releas…
c4322c4 
…e.yml

github-release.yml created the GitHub release with GITHUB_TOKEN on every
version bump pushed to master. Events raised by that token do not start other
workflows, so with publishing on release: published a bot-created release
would never run release.yml and npm would silently miss the version.
Releases are created by a person instead (as since v1.1.3), and release.yml
now attaches the npm pack tarball after a successful publish.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 13, 2026 11:58
Copilot AI reviewed Oct 13, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The consolidated workflow correctly implements the stated release policy without unresolved issues.

0 open findings

1 resolved since last review

🧠 Review effort: Balanced

@cs-raj @claude
fix: resolve qs vulnerabilities via lock file refresh
c847a78 
Regenerated package-lock.json (clean npm install); no package.json change.

qs 6.15.3 -> 6.16.0 (via body-parser)
Fixes SNYK-JS-QS-19432017 and SNYK-JS-QS-19432019
Snyk: 2 medium findings -> 0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 14, 2026 09:01
Copilot AI reviewed Oct 14, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The supply-chain workflow depends on external npm trusted-publisher configuration that cannot be validated from the repository.

0 open findings

🧠 Review effort: Balanced

cs-raj and others added 2 commits October 24, 2026 19:36
@cs-raj
Merge remote-tracking branch 'origin/development' into feat/DX-27614
e860b70
@cs-raj @claude
fix: bump 1 dep to resolve Snyk vulnerabilities
03afb7c 
Lock file regenerated (fixed 2 on its own).
Direct upgrades: body-parser ^2.3.0 -> ^2.4.0 (library floor raise;
installs body-parser 2.4.0 and qs 6.16.1)
Overrides: none
.talismanrc: package-lock.json checksum entry replaced by a
filecontent/base64content ignore so lock regens stop tripping Talisman.
Vuln count: snyk 2 -> 0, npm audit 1 -> 0. Build verified passing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cs-raj
cs-raj requested review from a team as code owners October 24, 2026 14:30
@github-actions

github-actions Bot commented Oct 24, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

1 similar comment
@github-actions

github-actions Bot commented Oct 24, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@cs-raj @claude
chore(release): bump version to 1.1.5
b2db42c 
The check-version-bump workflow requires package.json to be above the
latest tag once a PR changes it; this PR's Snyk lock fix does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 24, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@amit-kanswal-cs amit-kanswal-cs amit-kanswal-cs left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@cs-raj cs-raj

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@cs-raj @amit-kanswal-cs