ci: harden release with OIDC trusted publishing (TanStack-style, tokenless)#258
Merged
Conversation
The release version bump left "files": ["dist"] formatted multi-line, which biome check rejects. CI's test:ci script doesn't run biome check (only the local pre-commit hook does), so this slipped onto main.
commit: |
Replaces the PAT-based approach with npm Trusted Publishing (OIDC), mirroring TanStack's release flow. This removes long-lived publishing secrets entirely and addresses the security review findings. - npm auth via OIDC: add .npmrc provenance=true + id-token:write, and remove the NPM_TOKEN secret usage. Requires a trusted publisher to be configured for react-router-devtools on npmjs.com. - Drop the RELEASE_GITHUB_TOKEN PAT; the changesets action uses only the ephemeral GITHUB_TOKEN (to open the Release PR + create GH releases). - Pin all action versions to commit SHAs (supply-chain hardening). - Guard the job to this repo + main only (covers workflow_dispatch), so a dispatch can never publish from a non-main ref or a fork. - Pin Node 24 (npm 11) so OIDC works if pnpm delegates to npm publish. - Drop unused actions:write permission; add concurrency (no cancel). - Keep workflow_dispatch as a guarded manual recovery valve.
AlemTuzlak
force-pushed
the
fix/release-workflow-pat
branch
from
8562779 to
81befa3
Compare
AlemTuzlak
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reworks the release flow to be tokenless, mirroring TanStack/ai. Supersedes the earlier PAT-based approach (the PAT added the exact secret-exposure risk we were trying to avoid, and the automated commit security review flagged it).
Why the publish never happened for v6.2.1
The version bump (#257) landed on main but the package was never published to npm. The Release run that does
changeset publishdidn't fire after the Release PR merge (likely disrupted by the recent repo move). Rather than paper over it with a PAT, this adopts the more secure, proven TanStack pattern + a manual recovery valve.Changes
.npmrcprovenance=true+id-token: write; noNPM_TOKEN, no PAT. pnpm 10.18 supports OIDC (pnpm#9812, closed 2025-07-30).github.repository_owner == 'code-forge-io' && github.ref == 'refs/heads/main'— no fork runs, andworkflow_dispatchcan only publish from main.npm publish.actions: write; added non-cancellingconcurrency.workflow_dispatchkept as a guarded manual recovery valve."files": ["dist"]in package.json (biome was rejecting the multi-line form left by the version bump).Resolves security review findings
GITHUB_TOKENremains.main.Required before this can publish (one-time, owner-only)
Configure a trusted publisher for
react-router-devtoolson npmjs.com:npmjs.com -> package settings -> Publishing access -> Trusted publisher -> GitHub Actions
code-forge-io/react-router-devtoolspublish.yamlOrder matters: configure the trusted publisher before merging, otherwise the publish step will have no npm auth (NPM_TOKEN is gone).
Publishing the stuck 6.2.1
After the trusted publisher is set up and this PR merges, the merge push triggers a Release run; with no changesets on main it goes straight to
changeset publishand publishes 6.2.1 with provenance. (Or rungh workflow run Releasemanually.)🤖 Generated with Claude Code