Add publishing workflow with OIDC provenance - #20
Conversation
Add a manual dispatch workflow for publishing to npm using OIDC-based provenance. The workflow runs checks first, builds the package, bumps the version, publishes with provenance, and creates a GitHub release. Also bump Node.js to 24 in both checks and publish workflows.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
There was a problem hiding this comment.
Pull request overview
This PR adds a complete publishing workflow for automated npm package releases with OIDC-based provenance attestation, and updates the Node.js version to 24 across both workflows.
Changes:
- Adds a new manual-dispatch publish workflow with version bumping, npm publishing, and GitHub release creation
- Supports multiple version bump types (patch, minor, major, and prerelease variants) with dry-run capability
- Updates Node.js version from 22 to 24 in the checks workflow
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/publish.yml | New workflow for publishing to npm with OIDC provenance, version management, and release automation |
| .github/workflows/checks.yml | Updates Node.js version to 24 for consistency with publish workflow |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| echo "- **Dry run:** ${{ inputs.dry_run }}" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| - name: Publish to npm | ||
| if: ${{ inputs.dry_run == false }} |
There was a problem hiding this comment.
The npm publish step is missing authentication configuration. When using actions/setup-node@v4 with registry-url, you need to set the NODE_AUTH_TOKEN environment variable in the publish step. Without this, npm publish will fail with an authentication error.
Add an env section to the publish step with NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} (assuming you have an NPM_TOKEN secret configured in your repository settings).
| if: ${{ inputs.dry_run == false }} | |
| if: ${{ inputs.dry_run == false }} | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |
Add a manual dispatch workflow for publishing to npm using OIDC-based provenance. The workflow runs checks first, builds the package, bumps the version, publishes with
--provenance, and creates a GitHub release. Supports prerelease versions and dry runs.Also bumps Node.js to 24 in both checks and publish workflows.