From 10c894350b5154f7d0e920d704c2c1d2a7a09836 Mon Sep 17 00:00:00 2001
From: tajo <vojtech@miksu.cz>
Date: Sat, 27 Jun 2026 23:16:21 -0700
Subject: [PATCH] ci: migrate release to npm Trusted Publishing (OIDC) + GitHub
 App token

Replace long-lived secrets in the release pipeline:

- npm: drop NPM_TOKEN and the hand-written ~/.npmrc; publish via npm
  Trusted Publishing (OIDC). The job already had `id-token: write`, and
  the trusted publisher for @ladle/react is configured on npmjs.com. Add
  `registry-url` and force `npm@latest` since OIDC needs npm >= 11.5.1
  and the runner's bundled npm can be older.
- git: replace the GIT_DEPLOY_KEY PAT with a scoped, short-lived GitHub
  App installation token (actions/create-github-app-token@v3), passed to
  both checkout and changesets/action. App-token pushes still trigger
  downstream workflows, so the Version Packages PR keeps re-triggering
  the release.

New repo secrets: RELEASE_BOT_APP_ID, RELEASE_BOT_PRIVATE_KEY.
NPM_TOKEN and GIT_DEPLOY_KEY can be revoked once the first run is verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9ced8e61..c64f0063 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,11 +16,19 @@ jobs:
       pull-requests: write
       id-token: write
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
+          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
+
       - name: Checkout Repo
         uses: actions/checkout@v4
         with:
           # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
           fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
 
       - uses: pnpm/action-setup@v4
 
@@ -29,29 +37,22 @@ jobs:
         with:
           node-version: 24.x
           cache: "pnpm"
+          registry-url: "https://registry.npmjs.org"
+
+      # Trusted Publishing (OIDC) needs npm >= 11.5.1; the runner's bundled npm may be older.
+      - name: Update npm for trusted publishing
+        run: npm install -g npm@latest
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Creating .npmrc
-        run: |
-          cat << EOF > "$HOME/.npmrc"
-            email=vojtech@miksu.cz
-            //registry.npmjs.org/:_authToken=$NPM_TOKEN
-          EOF
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         uses: changesets/action@v1
         with:
           publish: pnpm release
         env:
-          GITHUB_TOKEN: ${{ secrets.GIT_DEPLOY_KEY }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
       - name: Publishing next version
         run: cd packages/ladle && pnpm types && ./publish-next.js
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}