chore: keep the publish credential away from the code it publishes

[robrigo]

Why

The publish job held an OIDC id-token while it installed dependencies and ran the package lifecycle scripts, so a postinstall anywhere in either tree could mint the credential npm exchanges for a publish token. The workflow now splits: the build job runs the release gates, the install, the tests, and packs the tarball while holding no credential, and the publish job holds the id-token alone beside that prebuilt tarball, with no checkout and no dependency install.

The approval now rests on something mechanical. A build gate fails any tag whose commit is not an ancestor of main, so a green run is what the approver confirms. The gate names refs/remotes/origin/main in full, because a full-history checkout also fetches tags and git resolves a bare origin/main as refs/tags/origin/main first, which a pushed tag of that name could exploit. It runs directly after checkout, before the toolchain steps that execute configuration from the tagged commit. Every action is pinned by commit sha, and the npm CLI in the credentialed job is pinned exact and installed with --ignore-scripts.

scripts/release-notes.sh also stops printing the origin remote when it refuses a non-GitHub URL, which can carry credentials.

Validation

The workflows parse, and the mechanical checks hold: the build job carries no id-token and no environment; the publish job carries needs, the environment, id-token: write alone, and a tarball publish with --provenance --ignore-scripts; every uses line is a 40-hex sha with a version comment. The release-notes suite passes with its count unchanged from main. The split path itself runs at the next tag; the rendered workflow is the evidence until then.

The publishability gate also widens: it reads optionalDependencies and peerDependencies beside dependencies, and flags bare owner/repo shorthand and the gitlab, bitbucket and gist prefixes, which the old pattern let through.

[Copilot]

Pull request overview

This PR hardens the npm publish workflow by separating build/test/pack from the credentialed publish step, reducing the risk that dependency lifecycle scripts can access an OIDC token during installation.

Changes:

• Split publish.yml into a non-credentialed build job (gates, install, test, pack) and a credentialed publish job (OIDC only + tarball publish with --ignore-scripts).
• Add a “tag must be on main” ancestry gate and broaden the “publishability” gate to reject more git-resolved dependency spec forms.
• Reduce potential credential leakage in scripts/release-notes.sh and document the trusted publishing/OIDC model in RELEASING.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
scripts/release-notes.sh	Stops echoing the origin URL in the non-GitHub-origin failure path to avoid leaking credentials embedded in remotes.
RELEASING.md	Updates release process guidance to reflect the split build/publish jobs and adds documentation for npm trusted publishing auth.
.github/workflows/publish.yml	Implements the split build vs. publish jobs, adds tag-on-main gating and expanded dependency spec checks, and publishes a prebuilt tarball with OIDC provenance.

Suppressed comments (1)

.github/workflows/publish.yml:133

• The publish job sets permissions to only id-token: write, which likely prevents actions/download-artifact from reading artifacts via the Actions API. Add actions: read so the tarball download can succeed while still keeping the token tightly scoped.

    permissions:
      id-token: write

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.