From 1c542af57d2cbc05e8669465248583d1d89460fb Mon Sep 17 00:00:00 2001 From: Jan Wendling <7381150+jwndlng@users.noreply.github.com> Date: Fri, 24 Oct 2025 16:15:43 +0200 Subject: [PATCH 1/4] chore: updates workflow to enable npm trusted publishing ## Motivation NPM package publishing will be migrated to use Trusted Publishing (via OIDC). ## Changes * Pins node version to 24 * Removes NPM token * Pins external action to commit SHA --- .github/workflows/release.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 86d30e9..61616fe 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,6 +19,9 @@ jobs: environment: name: npm url: https://www.npmjs.com/package/@dfinity/pic + permissions: + contents: read + id-token: write steps: - name: Checkout Code uses: actions/checkout@v4 @@ -31,6 +34,8 @@ jobs: - name: Setup PNPM uses: dfinity/ci-tools/actions/setup-pnpm@main + with: + node_version: 24 - name: Determine if Beta Release id: is_beta @@ -43,8 +48,6 @@ jobs: uses: dfinity/ci-tools/actions/generate-release-notes@main - name: Publish to npm - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }} run: | npm pack ./packages/pic/ @@ -56,7 +59,7 @@ jobs: $release_cmd - name: Create Github release - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0 with: artifacts: 'dfinity-pic-${{ github.ref_name }}.tgz' bodyFile: 'RELEASE_NOTES.md' From 65014b6786a17b303296d38c005bfdd6686facec Mon Sep 17 00:00:00 2001 From: Jan Wendling <7381150+jwndlng@users.noreply.github.com> Date: Fri, 24 Oct 2025 16:51:19 +0200 Subject: [PATCH 2/4] chore: updates contents read to write Co-authored-by: Luca Bertelli --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 61616fe..1b111e3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: name: npm url: https://www.npmjs.com/package/@dfinity/pic permissions: - contents: read + contents: write id-token: write steps: - name: Checkout Code From cf507961efac338a557a71c6e247dfd61671c77f Mon Sep 17 00:00:00 2001 From: Jan Wendling <7381150+jwndlng@users.noreply.github.com> Date: Fri, 24 Oct 2025 16:52:55 +0200 Subject: [PATCH 3/4] chore: removes node version --- .github/workflows/release.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1b111e3..c0c69ba 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,8 +34,6 @@ jobs: - name: Setup PNPM uses: dfinity/ci-tools/actions/setup-pnpm@main - with: - node_version: 24 - name: Determine if Beta Release id: is_beta From 5078a7b4973961fec0151cd4278c0620365cb2da Mon Sep 17 00:00:00 2001 From: Jan Wendling <7381150+jwndlng@users.noreply.github.com> Date: Fri, 24 Oct 2025 16:55:43 +0200 Subject: [PATCH 4/4] chore: sets NPM_CONFIG_PROVENANCE for npm publish step Add NPM_CONFIG_PROVENANCE environment variable for npm publish --- .github/workflows/release.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c0c69ba..51fcd66 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -46,6 +46,8 @@ jobs: uses: dfinity/ci-tools/actions/generate-release-notes@main - name: Publish to npm + env: + NPM_CONFIG_PROVENANCE: 'true' run: | npm pack ./packages/pic/