Migrate to npm trusted publishing - #12
Conversation
Combine publish-on-merge and release workflows into a single publish workflow. This simplifies CI/CD by providing a unified approach to versioning and publishing. The new workflow supports both automatic publishing on PR merge and manual dispatch for specific versioning needs. Co-authored-by: csark0812 <csark0812@gmail.com>
|
Cursor Agent can help with this pull request. Just |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR is being reviewed by Cursor Bugbot
Details
You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| if [ -n "${{ inputs.version }}" ]; then | ||
| NEW_VERSION="${{ inputs.version }}" | ||
| echo "Using provided version: $NEW_VERSION" | ||
| npm version $NEW_VERSION --no-git-tag-version --allow-same-version |
There was a problem hiding this comment.
Bug: Version mismatch when manually providing version
When manually triggering the workflow with a provided version, NEW_VERSION is set from the input before running npm version, but never updated afterward. If npm normalizes the version string (e.g., "2.2" becomes "2.2.0"), the variable will contain the unnormalized value, causing mismatches in git tags, commit messages, and GitHub releases compared to the actual package.json version.
2 participants
Migrate npm publishing to Trusted Publishing by consolidating two workflows into one and using OIDC for authentication.
Note
Consolidates release workflows into a single OIDC-based Trusted Publishing pipeline that supports PR-merge and manual releases, with automated versioning and GitHub Release creation.
/.github/workflows/publish.ymlcombining PR-merge and manual (workflow_dispatch) release paths.versionorbump_type; otherwise infers bump from PR labels (major/minor/patch).id-token: writeand publishes to npm using OIDC (Trusted Publishing); installsnpm@latest.package.json, commits, tags, pushes, publishes to npm, and creates a GitHub Release./.github/workflows/publish-on-merge.ymland/.github/workflows/release.yml.Written by Cursor Bugbot for commit 8afcc73. This will update automatically on new commits. Configure here.